[8424] in Info-AFS_Redistribution
Re: AFS 3.6, PAM, Solaris, "optional" !!??
daemon@ATHENA.MIT.EDU (Brandon S. Allbery KF8NH)
Tue Jan 23 13:04:59 2001
Date: Tue, 23 Jan 2001 12:28:47 -0500
From: "Brandon S. Allbery KF8NH" <allbery@ece.cmu.edu>
To: Jeff Blaine <jblaine@linus.mitre.org>, info-afs@transarc.com
Message-ID: <6050000.980270927@pyanfar.ece.cmu.edu>
In-Reply-To: <995386292.980247929@jblaine-pc.mitre.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
On Tuesday, January 23, 2001 11:05:29 -0500, Jeff Blaine
<jblaine@linus.mitre.org> wrote:
+-----
| Solaris PAM will make sure that one of the modules succeeds if they are
| all marked as 'optional', but why is this requirement in place? This
| seems very broken to me.
|
| So broken, in fact, that in our testbed cell I changed ours to be:
|
| login auth sufficient /usr/lib/security/pam_afs.so
| login auth required /usr/lib/security/pam_unix.so.1
|
| And it works perfectly fine.
|
| What is going on here? Could someone from Transarc (or anyone else)
| explain this?
+--->8
I do that as well, and it does work correctly. But that and the failure to
handle use_first_pass/try_first_pass makes me think that Transarc doesn't
understand PAM.
--
brandon s. allbery [os/2][linux][solaris][japh] allbery@kf8nh.apk.net
system administrator [WAY too many hats] allbery@ece.cmu.edu
electrical and computer engineering KF8NH
carnegie mellon university ["better check the oblivious first" -ke6sls]
