Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to recreate the functionality of pam_userdb.so to make an application authenticate virtual users (valid for one specific service only) on Solaris?

Situation is: higher-ups have dictated that we use a file distribution tool that only supports password-based authentication, and transfers passwords in the clear. Because of the amount of data that will be transferred, using SSL tunnels is impractical.

The application is pam-aware so we can configure a special authentication stack for it. On our linux servers, we configure pam_userdb to use a separate passwd database so no one can use the password to login direcctly:

someapp auth sufficient pam_userdb.so db=/etc/someapp-passwd try_first_pass

There seems to be no equivalent on Solaris.

share|improve this question
    
It would help if you describe the pam_userdb feature(s) you are looking for. –  jlliagre Jan 19 '11 at 21:35

3 Answers 3

You could use pam in Solaris but my experience so far has been of pure pain, it wouldn't be a bad idea in your case to just use kerberos or yp based auth so you can also share a common user database between those servers to keep things in line.

share|improve this answer

Are you just trying to allow authentication but not allow a shell login? You can do that by changing the user's shell to something that just kicks them back off. You can also log the attempt to make sure no one is trying to abuse the account.

share|improve this answer

Have you tried taking the pam_userdb source for the module you use on Linux and building it on Solaris? The whole point of PAM is to allow you to plugin additional modules, including ones that aren't provided with the system.

share|improve this answer
    
I've looked into that, but Linux PAM has diverged significantly from Solaris. It's not a simple download-compile job. –  pra Mar 23 '11 at 18:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.