[2317] in Kerberos
Re: Kerberos and NIS make strange bedfellows?
daemon@ATHENA.MIT.EDU (Jim Hendrick)
Fri Oct 30 04:37:38 1992
Date: 29 Oct 92 01:22:41 GMT
From: hendrick@ctron.com (Jim Hendrick)
To: kerberos@shelby.Stanford.EDU
In article <HENDRICK.92Oct27084911@marlins.ctron.com> hendrick@ctron.com (Me :-) wrote:
Path: balrog!ctron.com!hendrick
From: hendrick@ctron.com (Jim Hendrick)
Newsgroups: comp.protocols.kerberos
Date: 27 Oct 92 13:49:11 GMT
Sender: usenet@balrog.ctron.com
Distribution: comp
Organization: Cabletron Systems Inc.
Lines: 25
Nntp-Posting-Host: marlins
Hi,
I am sure this is a trivial question, but one I have not seen the
answer to. How does one use NIS (or any name service for that matter)
for user IDs etc but Kerberos for password authentication? I have a Kerberos
testbed set up by which I use the K's version of login on my machine. How do
I get K to be *THE* authority for password authentication? I have noticed
that IF my NIS password matches that in K's database, I get a ticket on
login. However, if they are different, I can *still* login but need to use
kinit for my tickets. Obviously, I would like to be able to only allow
login to only those principals with a kerberos ID and use kpasswd to change
these passwords, but I need to have the NIS map still used for the rest of
the info (uid, gid, gecos, shell, home). Is this an easy thing?
Thanks in advance!!
Jim
--
Well,
In response to my own question I wish to say "Use the source Luke . . ."
I looked at login.c in the K distribution and found (commented and everything)
that the kerberized login uses "lpassok" to allow login. This can be changed
to "kpassok" and then only kerberos principals can login to the machine. This
coupled with using +:*:0:0::: in /etc/passwd uses NIS for user information
such as uid, gid, gecos, shell but disallows login. Since the login program
however allows kerberos folk in, you have the desired effect.
Thanks,
Jim
--
###########################################################################
### Jim Hendrick (hendrick@ctron.com) ### ###
### Cabletron Systems Inc. ### " My opinions, etc are ###
### P. O. Box 5005 ### exclusively the property ###
### Rochester, NH 03867-5005 ### of nobody in particular." ###
### (603) 332-9400 x1457 ### ###
### fax:(603)332-1019 ### ###
###########################################################################
