[GLLUG] proftd and PAM

Mon, 29 Jul 2002 11:05:02 -0400

There are several PAM modules that are designed to work with Windows NT
(or any SMB domain controller.)  You can find them here at:
http://www.kernel.org/pub/linux/libs/pam/modules.html under the "Samba"
heading (no <#tag>, sorry!).  This page also has links to modules with
LDAP support, which could be used to authenticate to a Win2K ADC or
NetWare 5-6 server.

Hope that helps!

PaulM

-----Original Message-----
From: Ex Fed [mailto:exfed@hotmail.com]
Sent: Monday, July 29, 2002 10:43 AM
To: Melson, Paul
Subject: RE: [GLLUG] proftd and PAM

Is there a module for PAM that would allow say a NT domain controller
act as 
a centralized password manager for a linux server.  When the password on
the 
NT box was changed those changes were made automatically to the linux
box?

Thanks,

Lee

>From: "Melson, Paul" <PMelson@sequoianet.com>
>To: "Ex Fed" <exfed@hotmail.com>, <linux-user@egr.msu.edu>
>Subject: RE: [GLLUG] proftd and PAM
>Date: Mon, 29 Jul 2002 09:30:23 -0400
>MIME-Version: 1.0
>Received: from [63.97.219.13] by hotmail.com (3.2) with ESMTP id 
>MHotMailBF0E8ED80057400431123F61DB0D0FBD0; Mon, 29 Jul 2002 06:32:09
-0700
>Received: from seqhqemailbh.seqnt.com ([63.97.219.16]) by 
>intmail.sequoianet.com with InterScan Messaging Security Suite for
SMTP; 
>Mon, 29 Jul 2002 09:31:27 -0400
>Received: from lansingemail.seqnt.com ([172.18.2.73]) by 
>seqhqemailbh.seqnt.com with Microsoft SMTPSVC(5.0.2195.4905); Mon, 29
Jul 
>2002 09:30:24 -0400
>From PMelson@sequoianet.com Mon, 29 Jul 2002 06:32:54 -0700
>X-MimeOLE: Produced By Microsoft Exchange V6.0.5762.3
>content-class: urn:content-classes:message
>Message-ID:
<0FD9D979B9535D4890AE309799B6D1E52CBB14@lansingemail.seqnt.com>
>X-MS-Has-Attach:
>X-MS-TNEF-Correlator:
>Thread-Topic: [GLLUG] proftd and PAM
>Thread-Index: AcI2/18sm74J68A8TN2TUKwa1mxItwAAgHhg
>Return-Path: PMelson@sequoianet.com
>X-OriginalArrivalTime: 29 Jul 2002 13:30:24.0262 (UTC) 
>FILETIME=[180BD260:01C23704]
>
>For all intents and purposes, this is no longer the case.  In older
UNIX
>systems, the DES hashes were stored in the /etc/passwd file and were
>readable by any user on the system.  It used to be that any dunce with
a
>copy of Crack could download this file and run a brute-force attack
>against it to identify passwords.
>
>In most modern UNIX systems (Linux and BSD very much included), shadow
>passwords are used.  The /etc/passwd file still contains the login,
>default shell, home directory, and GECOS info for all of your users,
but
>the password hash is missing.  Instead, it's stored in a file
(typically
>/etc/shadow) that is only readable by root.  If you can't read the
>hashes, you can't crack them.  If you're already root, you don't need
to
>crack them.
>
>You can use PAM to enhance your password security in other ways,
though.
>You can use the pam_cracklib or pam_pwdb module to enforce password
>standards and prevent users from choosing weak passwords.  PAM has lots
>of other modules that can be used to increase user/login security.
And,
>of course, if it's a larger environment (say, NDS or AD), you can use
>PAM to authenticate your users to the directory via LDAP or RADIUS and
>let the directory manage your password policies for your Linux systems
>as well.
>
>PaulM
>
>-----Original Message-----
>From: Ex Fed [mailto:exfed@hotmail.com]
>Sent: Monday, July 29, 2002 8:54 AM
>To: linux-user@egr.msu.edu
>Subject: [GLLUG] proftd and PAM
>
>
>From what I understand, given the contents of /etc/passwords, it is
>possible
>for an individual to use this information, along with crypt and a
>dictionary
>or a brute force attempt to figure out what are your passwords.
>
>Does PAM provide us with greater security (does it still use
>/etc/passwords
>or shadow passwords, and is it easy to configure with most software
that
>
>supports it?
>
>
>Lee
>
>
>
>
>
>
>
>
>
>_________________________________________________________________
>Chat with friends online, try MSN Messenger: http://messenger.msn.com
>
>_______________________________________________
>linux-user mailing list
>linux-user@egr.msu.edu
>http://www.egr.msu.edu/mailman/listinfo/linux-user

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com