Subject: Re: PAM
To: Ken Hornstein <email@example.com>
From: Greg A. Woods <firstname.lastname@example.org>
Date: 09/25/2002 12:37:41
[ On Wednesday, September 25, 2002 at 11:16:54 (-0400), Ken Hornstein wrote: ]
> Subject: Re: PAM
> I know I don't need PAM; I have certainly lived without it on many systems.
> However, I find myself wasting a lot of time struggling with problems
> that PAM would let me solve, even on open-source operating systems.
I think you've been snowed. PAM is no panacea. Perhaps you should talk
more to those who've actually tried to use it on a variety of
non-compatible systems. A lot of the problems you say you've been
struggling with might disappear entirely if a different approach is
> I am skeptical that someone has already implemented a new API for AFS
> that will solve my needs, and google didn't come up with anything useful
> for me; I'm willing to look at something, though (but it has to be
> REAL, not some research project that has been quietly bit-rotting).
> So point me to some URL's; I'll check 'em out.
For "bit-rotting research projects" I suspect you're referring to Robert
Watson's experimental implementation of a new design in FreeBSD (and
perhaps Linux too?):
Regardless these ideas are only bit-rotting of course because folks such
as yourself are happy to continue using the bad hacks of even more
bit-rotted implementations. I suspect Watson's code is still available,
and given what it does it can't have bit-rotted very much at all. While
Watson does also advocate PAM, it's not a fundamental part of the design
Douglas Engert has also implemented some interesting ideas in this area:
The basic idea though is trivial. Keeping the PAG directly in the proc
structure where it should have been put in the first place instead of
over-loading the group list, and allowing a child process, or even a
sufficiently privileged random "unrelated" process, to set the PAG for a
given process is only a SMOP. :-)
Being blinded by the requirements of the past is not a decent way to
build for the future of your "Real World". PAM is no more "real" now
in the context of NetBSD than of these other things.
Greg A. Woods
+1 416 218-0098; <email@example.com>; <firstname.lastname@example.org>
Planix, Inc. <email@example.com>; VE3TCP; Secrets of the Weird <firstname.lastname@example.org>