Subject: Re: PAM
To: Ken Hornstein <>
From: Greg A. Woods <>
List: current-users
Date: 09/25/2002 12:37:41
[ On Wednesday, September 25, 2002 at 11:16:54 (-0400), Ken Hornstein wrote: ]
> Subject: Re: PAM 
> I know I don't need PAM; I have certainly lived without it on many systems.
> However, I find myself wasting a lot of time struggling with problems
> that PAM would let me solve, even on open-source operating systems.

I think you've been snowed.  PAM is no panacea.  Perhaps you should talk
more to those who've actually tried to use it on a variety of
non-compatible systems.  A lot of the problems you say you've been
struggling with might disappear entirely if a different approach is

> I am skeptical that someone has already implemented a new API for AFS
> that will solve my needs, and google didn't come up with anything useful
> for me; I'm willing to look at something, though (but it has to be
> REAL, not some research project that has been quietly bit-rotting).
> So point me to some URL's; I'll check 'em out.

For "bit-rotting research projects" I suspect you're referring to Robert
Watson's experimental implementation of a new design in FreeBSD (and
perhaps Linux too?):

Regardless these ideas are only bit-rotting of course because folks such
as yourself are happy to continue using the bad hacks of even more
bit-rotted implementations.  I suspect Watson's code is still available,
and given what it does it can't have bit-rotted very much at all.  While
Watson does also advocate PAM, it's not a fundamental part of the design
he promotes.

Douglas Engert has also implemented some interesting ideas in this area:

The basic idea though is trivial.  Keeping the PAG directly in the proc
structure where it should have been put in the first place instead of
over-loading the group list, and allowing a child process, or even a
sufficiently privileged random "unrelated" process, to set the PAG for a
given process is only a SMOP.  :-)

Being blinded by the requirements of the past is not a decent way to
build for the future of your "Real World".  PAM is no more "real" now
in the context of NetBSD than of these other things. 

								Greg A. Woods

+1 416 218-0098;            <>;           <>
Planix, Inc. <>; VE3TCP; Secrets of the Weird <>