Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is there a possibility to use a (mysql) Database to manage SSH login credentials instead of /etc/passwd ?

I know I could use ldap but I only want simple user management and ldap seems a little bit overpowered for this job.

share|improve this question
add comment

2 Answers 2

up vote 9 down vote accepted

Yes. Linux authentication is based around the pluggable authentication modules (PAM) which allows for easy switching from one authentication backend to another. Simply install and configure a PAM MySQL module, with a corresponding user database in MySQL.

Pre-compiled packages are available in the EPEL archive for RHEL/CentOS as pam_mysql and a pam-mysql package should be available in Debian/Ubuntu.

share|improve this answer
1  
Thanks! Exactly what I'm looking for. Sometimes its hard to google when you don't know the exact terms ;) –  W0bble Jun 27 at 14:34
add comment

While PAM-MySQL can manage login credentials, it is an incomplete solution, since it only handles the authentication portion. It does not create a user account on the system. For example:

In other words, PAM-MySQL is a replacement for /etc/shadow, not for /etc/passwd. You will need to either create both an /etc/passwd entry and a MySQL entry for each user, or supplement PAM-MySQL with NSS MySQL.

LDAP is indeed the better tool for the job, as you will be able to centralize the user account information in one place. I don't believe it is overpowered. Rather it's a kind of database that is specially designed to manage user accounts, so best practice would be to just use LDAP as a standard solution rather than hacking together a non-standard system with MySQL. Either OpenLDAP or 389 Directory Server would be a more appropriate user database than MySQL. (Both of them can be configured to use an SQL back-end, if you insist.)

share|improve this answer
    
Agreed. LDAP can even be used with a MySQL backend if needed. –  EEAA Jun 27 at 18:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.