Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to set up an automated install process for a PAM module that provides LDAP-like HTTP authentication. Since this is an alternative authentication module, I would need to add something like this:

auth sufficient mypam.so authserver=https://someserver.com

Since my application is a daemon that 'listens' to user authentication, it doesn't really deserve it's own config file, so it would have to leach onto something else (like GDM, SSH, etc).

I basically have two options here:

  • Append or prepend to appropriate config files (and log all changes)
  • Output the lines to add with suggestions for the sysadmin to manually edit

Which of these two options would a *nix admin prefer?

Are there any other approaches that I am missing that a *nix admin would prefer?

Note:

I am trying to market this to a sys-admin for widespread use in a corporate setting. This may also be marketed to end users, but in that case I would do the first option by default.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

I don't think that making automated changes in pam config file is a good idea.

  1. There is so many possible configurations that is impossible to predict in which line of config we should insert ours.
  2. Sometimes configs are spitted into many files and included to main config.
  3. User may want to use your authorization backend only for specified services like ssh or ftp not systemwide.
  4. In worst case scenario manipulation on pam config may cause:
    • blocking of login to system (when you don't have configured your database and queue of modules to check ends on your module)
    • no effect (when you put it after pam_permit)
    • possibility to login using any (random) credentials (?)

Good idea is to provide few example configuration files in which you show how to use your module to: log in using only your database, log in using your db or system users, etc.

share|improve this answer
1  
+1, I to strongly recommend your package NOT touch the system PAM, that should always be the realm of the distro installation and then the system administrator. Provide samples for how to edit the pam configs to make your system work, but leave it up to the administrator to actually touch the files. If you want to add a file follow the target distros guidelines, but if you need to edit an existing one to tag along with something, that SHOULD require manual administrator intervention. –  Caleb Jul 9 '11 at 9:13
    
Ok, that makes sense. I guess I will create some sample config files and give detailed instructions on the preferred setup. –  tjameson Jul 9 '11 at 18:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.