is there a possibility to use a (mysql) Database to manage SSH login credentials instead of /etc/passwd ?

I know I could use ldap but I only want simple user management and ldap seems a little bit overpowered for this job.


Yes. Linux authentication is based around the pluggable authentication modules (PAM) which allows for easy switching from one authentication backend to another. Simply install and configure a PAM MySQL module, with a corresponding user database in MySQL.

Pre-compiled packages are available in the EPEL archive for RHEL/CentOS as pam_mysql and a pam-mysql package should be available in Debian/Ubuntu.

  • 1
    Thanks! Exactly what I'm looking for. Sometimes its hard to google when you don't know the exact terms ;) – W0bble Jun 27 '14 at 14:34

While PAM-MySQL can manage login credentials, it is an incomplete solution, since it only handles the authentication portion. It does not create a user account on the system. For example:

In other words, PAM-MySQL is a replacement for /etc/shadow, not for /etc/passwd. You will need to either create both an /etc/passwd entry and a MySQL entry for each user, or supplement PAM-MySQL with NSS MySQL.

LDAP is indeed the better tool for the job, as you will be able to centralize the user account information in one place. I don't believe it is overpowered. Rather it's a kind of database that is specially designed to manage user accounts, so best practice would be to just use LDAP as a standard solution rather than hacking together a non-standard system with MySQL. Either OpenLDAP or 389 Directory Server would be a more appropriate user database than MySQL. (Both of them can be configured to use an SQL back-end, if you insist.)

  • Agreed. LDAP can even be used with a MySQL backend if needed. – EEAA Jun 27 '14 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.