During the last days I've been fiddling around with LDAP authentication and I've managed to configure some Linux systems (CentOS 6 and 7) to perform the SSH authentication process against an OpenLDAP server (which I also installed and configured). However, and even though everything works as I intend, there's still something about the LDAP authentication process that is bugging me.
What I don't quite understand is how PAM and NSS work with each other and how they interact with one another. After researching about the theme, I came to the conclusion that (Reference):
- NSS offers a name service mechanism to obtain the user and group name information;
- PAM offers a flexible authentication mechanism used by the application software thus involves password data exchange.
But what is the authentication flow? How are the files/services that I configured used (/etc/nsswitch.conf, /etc/nslcd.conf, /etc/nscd.conf/, /etc/pam.d/password-auth) and in what order?
Note: If I remove from "nsswitch.conf" the line correspondent to the shadow database, the authentication process still works without any problem. This means that the file "nsswitch.conf" is never used for obtaining the sources for password lookups?