27

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of research.

Citing:

NSS allows administrators to specify a list of sources where authentication files, host names and other information will be stored and searched for

and

PAM is a set of libraries that provide a configurable authentication platform for applications and the underlying operating system

What I don't understand is how PAM and NSS work and interact together. In this book the architecture is explained pretty well: I configure PAM to use pam_ldap for LDAP accounts and pam_unix for local accounts, then I configure nsswitch.conf to fetch information from local files and LDAP.

If I have understood correctly LDAP is used twice: first by pam_ldap and then by NSS which is itself called from pam_unix. Is that right? Is LDAP really used twice? But why do I need to configure both NSS and PAM? My explanation is that PAM performs different tasks than NSS and it is used by other programs. But, then, it should be possible to use only NSS or only PAM, as I have read in this page.

So I experimented a bit and I have first tried to delete LDAP from the nsswitch.conf (and the authentication stopped to work as if only pam_ldap is not enough to do the job). Then I re-enabled LDAP in NSS and I deleted it from the PAM configuration (this time everything worked fine, as if pam_ldap is useless and NSS is enough to authenticate a user).

Is there anyone who can help me to clarify this? Many thanks in advance.

UPDATE

I've just tried something now. I removed again all the pam_ldap entries in all pam configuration fields and I have also removed shadow: ldap from nsswitch.conf. As now in all the system there are only the lines: passwd: ldap files and group: ldap files in nsswitch.conf. Well... the login with LDAP users works perfectly, those two lines (plus /etc/ldap.conf) are enough to configure LDAP auth.

From my knowledge PAM in independent from NSS, but my tests showed it's not. So I ask myself is it possible to completely disable NSS and use only PAM?

Improve this question
2
  • I didn't see your update. Please run the following commands and report your findings, replacing LDAPUSER with the user who you think is only configured in LDAP. getent shadow | grep LDAPUSER grep LDAPUSER /etc/shadow
    – Andrew B
    Sep 17, 2013 at 14:39
  • hi its a request but can i get a view of your nsswitch.conf file it would really help me a lot??
    – hariharan baskaran
    Jan 27, 2023 at 9:11

2 Answers 2

Reset to default
31

It helps to break things down like this in your head:

  • NSS - A module based system for controlling how various OS-level databases are assembled in memory. This includes (but is not limited to) passwd, group, shadow (this is important to note), and hosts. UID lookups use the passwd database, and GID lookups use the group database.

  • PAM - A module based system for allowing service based authentication and accounting. Unlike NSS, you are not extending existing databases; PAM modules can use whatever logic they like, though shell logins still depend on the passwd and group databases of NSS. (you always need UID/GID lookups)

The important difference is that PAM does nothing on its own. If an application does not link against the PAM library and make calls to it, PAM will never get used. NSS is core to the operating system, and the databases are fairly ubiquitous to normal operation of the OS.

Now that we have that out of the way, here's the curve ball: while pam_ldap is the popular way to authenticate against LDAP, it's not the only way.

  • If shadow is pointing at the ldap service within /etc/nsswitch.conf, any authentication that runs against the shadow database will succeed if the attributes for those shadow field mappings (particularly the encrypted password field) are present in LDAP and would permit login.
    • This in turn means that pam_unix.so can potentially result in authentication against LDAP, as it authenticates against the shadow database. (which is managed by NSS, and may be pointing at LDAP)
  • If a PAM module performs calls against a daemon that in turn queries the LDAP database (say, pam_sss.so, which hooks sssd), it's possible that LDAP will be referenced.
Improve this answer
6
  • Many thanks, I know that nsswitch.conf + pam_unix can to all the work by themselves. But also PAM should be able to do the same, because it's independent, as you wrote too. My understanding is that the module pam_ldap should be enough to authenticate the user against an ldap server. Isn't it?
    – ColOfAbRiX
    Sep 13, 2013 at 10:41
  • 6
    Authenticate yes, but unless you have another way to obtain user information (local /etc/passwd or whatever) you still need a way to find out group membership, home directory etc. You are still confusing authentication and authorization/attribute enumeration.
    – TheFiddlerWins
    Sep 13, 2013 at 12:40
  • 1
    @ColOfAbRiX TheFIddlerWins is correct. It's enough to authenticate, but you still need a way to lookup UIDs + GID memberships as I noted. These are obtained from the passwd and group databases (NSS), which means they must be on the local system (/etc/passwd+/etc/group), or obtained via the ldap NSS module.
    – Andrew B
    Sep 13, 2013 at 19:44
  • 3
    Here's a way to help you understand: run getent passwd and getent group with LDAP enabled for both databases in /etc/nsswitch.conf. Then disable LDAP in that file, and run both commands again. getent is a command for dumping NSS databases.
    – Andrew B
    Sep 13, 2013 at 19:53
  • At last I was able to understand everything with a bit more of work. Thank you guys!
    – ColOfAbRiX
    Oct 4, 2013 at 16:55
1

NSS is there to enumerate information about services/users (what group you belong to, where your home directory is etc). PAM determines what to do about that information.

If you want to use LDAP for authentication you need pam_ldap. If you are using something else (local accounts, Kerberos etc) then you may not.

So they do different things. NSS gets information, PAM determines who is allowed to do what once that information is obtained.

Improve this answer
5
  • Thanks, but the problem is that it doesn't work in that way, in my system at least :) At the beginnin I understood the same but then I have tried to remove all the pam_ldap entries in PAM and LDAP authentication still worked (and disabled the cache). This increased my confusion :)
    – ColOfAbRiX
    Sep 12, 2013 at 15:29
  • How are you verifying that you are authenticating via pam_ldap after removing it? Post the contents of your common-auth please. I am not sure about the paths in SUSE but in answer to the first part of your third question, even with pam_ldap working you need some way for the system to know who you are - this is provided by NSS
    – TheFiddlerWins
    Sep 12, 2013 at 17:21
  • I'am sorry, I mean that after removing pam_ldap, LDAP auth worked without it, I guess it worked through NSS. The file common-auth contained only pam_env, pam_unix and pam_deny.
    – ColOfAbRiX
    Sep 13, 2013 at 8:03
  • That does not make sense, how did you confirm LDAP auth worked?
    – TheFiddlerWins
    Sep 13, 2013 at 12:37
  • Logging in using an LDAP account and monitoring the ldap servers' log. nscd (caching) is disabled
    – ColOfAbRiX
    Sep 13, 2013 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .