Date: Wed, 26 Nov 2003 23:10:01 -0800 From: Terry Lambert <tlambert2@mindspring.com> To: Clifton Royston <cliftonr@tikitechnologies.com> Cc: freebsd-hackers@freebsd.org Subject: Re: getpwnam with md5 encrypted passwds Message-ID: <3FC5A349.3FCA4DE9@mindspring.com> References: <20031126200101.8B45116A4D0@hub.freebsd.org> <20031126112014.C8040@tikitechnologies.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Clifton Royston wrote: > If you will need to do authentication after your program drops > privileges, your best course is probably to go through PAM, to install > a separate daemon which implements a PAM-supported protocol and which > runs with privileges, and then to enable that protocol as a PAM > authentication method for your application. [ ... RADIUS example with LDAP mention ... ] Sounds like a good approach, though I'll point out that had you tried LDP, you would have been hard-put to use LDAP as a proxy protocol to another authentication base (a PAM backend for an LDAP server, while not quite impossible, would be very hard). How did you avoid the recursion problem of the RADIUS server trying to authenticate via pam_radius to the RADIUS server tyring to authenticate ... -- Terry?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3FC5A349.3FCA4DE9>