[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: BSD Auth
On 18-Aug-08, at 7:50 AM, markucz%gmail.com@localhost wrote:
Straight to the point: is there a way to use BSD Auth with NetBSD?
One can try porting the BSD Auth code from OpenBSD. I have not yet
tried that myself.
In 4.0 one
can't do without PAM.
Perhaps not without building yourself from source. :-)
However I seem to be doing fine without PAM in my netbsd-4 systems.
I use the following settings in my mk.conf (plus there should be some
changes to some makefiles and to the sets lists, but I haven't got
around to them yet):
MKPAM = no
USE_PAM = no
I've lived happily without it so far. I don't mind
having it in base, I'm just curious whether it's possible to replace
functionality by BSD Auth. I managed to find some code written in
and now I'm examining it to see what can be done with it and if it
somehow integrated alongside with PAM.
I'm not sure it would make sense to have them integrated together into
the same system. In my estimation they can't really both be there in
the same build (certainly not for anyone who wants the full and
guaranteed privilege separation offered by BSD Auth), and with a
compile-time option the non-default one is sure to bitrot. Previous
discussions resulted in nothing really and PAM was blasted into the
tree without taking into account any technical considerations. Lame
excuses were given that somehow BSD Auth could be implemented as a PAM
module after PAM was fully integrated, but of course that blows one of
the main benefits of BSD Auth right out of the picture (true
guaranteed privilege separation).
Personally I think since OpenPAM is already well supported as a stand-
alone project it should be they who provide an optional patch to apply
to NetBSD for those system integrators who wish to offer PAM instead
of BSD Auth. :-)
Greg A. Woods; Planix, Inc.
Main Index |
Thread Index |