Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wish to enable the "compat" mode for users using the /etc/passwd approach in my Linux OEL5x server. But I am not really sure how "compat" works in linux. I have made the following configurations- set passwd to compat in /etc/nsswitch.conf and added the user details in /etc/passwd. I am able to fix login issues by few changes to system-auth,, but protocols like ssh.. are not enabled still. Is there any way to fix this issue?

share|improve this question
    
What exactly are you expecting compat to do ? What problem are you trying to solve ? –  Iain Nov 16 '12 at 17:44
    
Problem I am facing is - I am unable to use login to the server using kerberos. If I do a krsh serv1 'commad' It will give me: kshd: Login denied. –  Balualways Nov 16 '12 at 22:10
add comment

1 Answer 1

I'm fairly sure you're barking up the wrong tree here. compat is more about compatibility with NIS, not with Kerberos. (You're probably not using NIS.)

Two comments on your actual issue:

  1. The root of your problem is likely that you haven't set up Kerberos authorization (as opposed to authentication). Kerberos has to know that a given principal is allowed to log on to a given account. There are two main ways to do this: one is to create a .k5login file in each user's home directory listing the users who are allowed to log on to that account, and the other is to set the default realm, in which case the default policy is that a principal whose local part matches the local account name and whose realm matches the default realm is allowed to log on to that account. There are also more complex options that involve setting up aname to lname mappings in your /etc/krb5.conf file.

  2. You really don't want to be using krsh these days. It's not maintained, and it doesn't have a great security track record in the protocol. (The Heimdal and MIT implementations are also incompatible.) Instead, I encourage you to switch to ssh, which now supports GSS-API authentication and is a much nicer alternative.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.