I wish to enable the "compat" mode for users using the /etc/passwd approach in my Linux OEL5x server. But I am not really sure how "compat" works in linux. I have made the following configurations- set passwd to compat in /etc/nsswitch.conf and added the user details in /etc/passwd. I am able to fix login issues by few changes to system-auth,, but protocols like ssh.. are not enabled still. Is there any way to fix this issue?
2
-
What exactly are you expecting compat to do ? What problem are you trying to solve ?– user9517Nov 16, 2012 at 17:44
-
Problem I am facing is - I am unable to use login to the server using kerberos. If I do a krsh serv1 'commad' It will give me: kshd: Login denied.– BalualwaysNov 16, 2012 at 22:10
Add a comment
|
1 Answer
I'm fairly sure you're barking up the wrong tree here. compat is more about compatibility with NIS, not with Kerberos. (You're probably not using NIS.)
Two comments on your actual issue:
The root of your problem is likely that you haven't set up Kerberos authorization (as opposed to authentication). Kerberos has to know that a given principal is allowed to log on to a given account. There are two main ways to do this: one is to create a
.k5loginfile in each user's home directory listing the users who are allowed to log on to that account, and the other is to set the default realm, in which case the default policy is that a principal whose local part matches the local account name and whose realm matches the default realm is allowed to log on to that account. There are also more complex options that involve setting up aname to lname mappings in your/etc/krb5.conffile.You really don't want to be using krsh these days. It's not maintained, and it doesn't have a great security track record in the protocol. (The Heimdal and MIT implementations are also incompatible.) Instead, I encourage you to switch to ssh, which now supports GSS-API authentication and is a much nicer alternative.
