From owner-freebsd-stable@FreeBSD.ORG  Mon Jul 15 23:07:46 2013
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id EA85D8B2
 for <freebsd-stable@freebsd.org>; Mon, 15 Jul 2013 23:07:46 +0000 (UTC)
 (envelope-from crest@rlwinm.de)
Received: from mail.rlwinm.de (mail.rlwinm.de [46.4.89.243])
 by mx1.freebsd.org (Postfix) with ESMTP id AD7D1FCD
 for <freebsd-stable@freebsd.org>; Mon, 15 Jul 2013 23:07:46 +0000 (UTC)
Received: from hexe.rlwinm.de (p4FE67BC6.dip0.t-ipconnect.de [79.230.123.198])
 (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mail.rlwinm.de (Postfix) with ESMTPSA id 895F1116E0
 for <freebsd-stable@freebsd.org>; Mon, 15 Jul 2013 23:04:18 +0000 (UTC)
Message-ID: <51E480C3.50008@rlwinm.de>
Date: Tue, 16 Jul 2013 01:07:47 +0200
From: Jan Bramkamp <crest@rlwinm.de>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:17.0) Gecko/20130707 Thunderbird/17.0.7
MIME-Version: 1.0
To: freebsd-stable@freebsd.org
Subject: Re: LDAP authentication confusion
References: <Pine.GSO.4.64.1307151438370.8901@sea.ntplx.net>
 <CAHDg04v8xV-yaCXDzSbOzWEvHRMhDy8x0A=B2eho4iK4b1UuJA@mail.gmail.com>
 <Pine.GSO.4.64.1307151507130.8901@sea.ntplx.net>
 <1373915752.13754.140661255962197.3CA2BD96@webmail.messagingengine.com>
 <Pine.GSO.4.64.1307151550030.8901@sea.ntplx.net>
 <20130715224748.GA45649@anubis.morrow.me.uk>
In-Reply-To: <20130715224748.GA45649@anubis.morrow.me.uk>
X-Enigmail-Version: 1.5.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Jul 2013 23:07:47 -0000

On 16.07.2013 00:47, Ben Morrow wrote:
> Quoth Jan Bramkamp <crest@rlwinm.de>:
>> On 15.07.2013 21:51, Daniel Eischen wrote:
>>>
>>> Wouldn't it be easier just to edit /etc/nsswitch.conf
>>> anyway?
>> PAM and NSS switch are two different subsystems. NSS is just for
>> resource lookups (users, groups, hosts, ...). PAM is for access control.
>>
>> With ldap in nsswitch.conf for users and groups you can lookup a LDAP
>> user but the user can't log into $service through PAM. This requires
>> pam_ldap.so in pam.d/$service.
> 
> The default pam_unix.so calls getpwent, so if nss_ldap returns cryptable
> passwords in its result I think pam_unix can authenticate against those.
> 
> This is not the same as authenticating by LDAP bind, but may end up
> accepting the same passwords.

If you want every process to read your hashed passwords and you use
non-portable crypt hashes it could work. The correct solution would be
authenticate users by LDAP binds without allowing anyone to read the
password or to use the {SASL} password style and authenticate users
against Kerberos with saslauthd. Just don't let you users play with
passwords. Either your password policy allows dumb users to pick trivial
password or it forces complex password structures on them resulting in
post-it notes with passwords around every second desk.