Re: authentication question

From: K. Richard Pixley (rich_at_noir.com)
Date: 03/18/04

  • Next message: K. Richard Pixley: "Re: authentication question" 
    Date: Wed, 17 Mar 2004 20:33:41 -0800
To: golharam@umdnj.edu, General Red Hat Linux discussion list <redhat-list@redhat.com>

    NIS has several problems. First, the only way I can see to get samba to
    authenticate via NIS is to convince all the windows clients to send
    their passwords in the clear. That's bad for two reasons, I have to
    touch each and every windows client, and the passwords cross the network
    in the clear. These days that's not acceptable.

    Second, NIS sends it's encrypted passwords over the wire. This means
    that anyone with a sniffer can snag a few and start running dictionary
    password crackers. NIS+ fixes this, but apparently at a high
    administrative cost. IPSEC might fix this too. The situation is moot
    in this case, though as when windows clients send encrypted passwords,
    they are doing essentially the same thing. And that's the best windows
    has to offer right now.

    --rich

    Ryan Golhar wrote:

    > I would suggest using NIS. I currently have about 20 linux hosts that
    > users can use. All users are authenticated via NIS. Its pretty easy to
    > set up and run...
    >
    > -----
    > Ryan Golhar
    > Computational Biologist
    > The Informatics Institute at
    > The University of Medicine & Dentistry of NJ
    >
    > Phone: 973-972-5034
    > Fax: 973-972-7412
    > Email: golharam@umdnj.edu
    >
    > -----Original Message-----
    > From: redhat-list-bounces@redhat.com
    > [mailto:redhat-list-bounces@redhat.com] On Behalf Of K. Richard Pixley
    > Sent: Wednesday, March 17, 2004 7:52 PM
    > To: General Red Hat Linux discussion list
    > Subject: authentication question
    >
    >
    > I'm at a loss for how to do authentication well for a small group of
    > linux machines.
    >
    > We have several linux hosts, all of which run samba, and all of which
    > should use a single password per user, or at least, a single password
    > change program which changes all passwords. Samba really wants to use a
    >
    > domain server or to keep it's own password database separate from the
    > unix passwords.
    >
    > Any suggestions on how to get these all authenticated off the same
    > database?
    >
    > The only thing I can see to do is to turn one into a domain controller
    > and have everything else authenticate off that. Are there any other
    > alternatives?
    >
    > --rich
    >
    > 

    -- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: K. Richard Pixley: "Re: authentication question"

    Relevant Pages

    • Re: Linux authentication via AD
      ... What I do to integrate with Windows is to use NIS and Samba. ... a way to do this under older AIX) allows people to login authenticating ... authentication is done to the Windows Password Server. ... text passwords authenticate to the Windows Password Server as well. ...
      (comp.os.linux.security)
    • Problems w/NIS Clients in Compat Mode
      ... I'm using OpenAFS for authentication and using NIS to push out the password maps. ... I'm using NIS compat mode, using netgroups to specify user account access to each machine. ... The problem with this is that they expire, causing the system to ask to change it (I don't want any local passwords). ... I'm specifically using NIS because it won't expire passwords; this is being controlled on the OpenAFS server side. ...
      (comp.os.linux.misc)
    • Re: Sparc Solaris NIS client Linux NIS server
      ... >> I'll check over the nsswitch.conf and verify that its right. ... >> insecurities with NIS. ... If "shadow" passwords are enabled properly, ... once I get the authentication working I will ...
      (comp.os.linux.setup)
    • Re: Method to customize SSH settings per user
      ... > What I am hoping to do it create an account on a system which can only ... Configure PAM to do it. ... It will still allow other users to authenticate ... with passwords. ...
      (comp.security.ssh)
    • Re: overcome NIS
      ... > AFAIK, NIS doesn't transmit passwords over the network, ... It does when changeing passwords (although there are workarounds to this, ... > so each machine can use the hashes to authenticate. ... They need not even sniff the wire for this ...
      (comp.os.linux.security)