[ILUG] Authentication ideas

[Paul Jakma]

On Tue, 20 Jan 2004, Stephane Dudzinski wrote:

> I basically want to move to a central 1/2 servers model where i would
> have all my users without using NIS. I have a variety of servers ranging
> from Linux to FreeBSD and Solaris. Any thoughts ?

In an ideal world:

Kerberos for authentication.
LDAP for distributing information (user/group/etc.. account info)

You could use LDAP for the authorisation side, but to my mind getting
the LDAP acl's right can be finicky with OpenLDAP's slapd server, and
if you make a mistake you can leave the userPasswords readable and
you've gained nothing over NIS. If authentication is handled by
kerberos you dont really have to care too much about locking down
LDAP. The docs for MIT kerberos are pretty good are cover everything
you need to know about setting up a KDC step by step.

The down side can be OS support. RH9 and Fedora support krb5 and ldap
out of the box.  Dont know about FreeBSD. Solaris 8 does not, iirc.
Solaris 9, not sure, it might but if not I think there are point
updates that add support - next release of Solaris definitely does
support krb5 and LDAP though. If thats all you run, you're grand, but
other Nixes tend not to have support (eg IRIX doesnt unless you have
a support contract and access to the latest point releases).

> Steph

regards,
-- 
Paul Jakma	paul at clubi.ie	paul at jakma.org	Key ID: 64A2FF6A
	warning: do not ever send email to spam at dishone.st
Fortune:
Don't mind him; politicians always sound like that.