[ On Wednesday, September 25, 2002 at 11:16:54 (-0400), Ken Hornstein wrote: ]
> Subject: Re: PAM 
>
> I know I don't need PAM; I have certainly lived without it on many systems.
> However, I find myself wasting a lot of time struggling with problems
> that PAM would let me solve, even on open-source operating systems.

I think you've been snowed.  PAM is no panacea.  Perhaps you should talk
more to those who've actually tried to use it on a variety of
non-compatible systems.  A lot of the problems you say you've been
struggling with might disappear entirely if a different approach is
taken.

> I am skeptical that someone has already implemented a new API for AFS
> that will solve my needs, and google didn't come up with anything useful
> for me; I'm willing to look at something, though (but it has to be
> REAL, not some research project that has been quietly bit-rotting).
> So point me to some URL's; I'll check 'em out.

For "bit-rotting research projects" I suspect you're referring to Robert
Watson's experimental implementation of a new design in FreeBSD (and
perhaps Linux too?):

	http://www.watson.org/fbsd-hardening/tokens/fbsd-tokens-0.2/docs/proposal.txt

Regardless these ideas are only bit-rotting of course because folks such
as yourself are happy to continue using the bad hacks of even more
bit-rotted implementations.  I suspect Watson's code is still available,
and given what it does it can't have bit-rotted very much at all.  While
Watson does also advocate PAM, it's not a fundamental part of the design
he promotes.

Douglas Engert has also implemented some interesting ideas in this area:

	http://www.ornl.gov/~jar/dfs-afs.html

The basic idea though is trivial.  Keeping the PAG directly in the proc
structure where it should have been put in the first place instead of
over-loading the group list, and allowing a child process, or even a
sufficiently privileged random "unrelated" process, to set the PAG for a
given process is only a SMOP.  :-)

Being blinded by the requirements of the past is not a decent way to
build for the future of your "Real World".  PAM is no more "real" now
in the context of NetBSD than of these other things. 

-- 
								Greg A. Woods

+1 416 218-0098;            <g.a.woods@ieee.org>;           <woods@robohack.ca>
Planix, Inc. <woods@planix.com>; VE3TCP; Secrets of the Weird <woods@weird.com>