can anyone give me a basic explanation on what are NSS , LDAP and PAM and what they used for and what is their relationship/differences ?

1 Answer 1


LDAP is a directory service (a type of database) along with a protocol that describes what information is stored, how to search it, etc. All kinds of things can be stored there, but in this case it'd be Unix user and group info. Very loosely, an alternative to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Or to NIS.

NSS is glibc's name service switch. It lets you (via /etc/nsswitch.conf) configure how various types of 'names' are resolved. Names include host names, user names, group names, and several other things. You could tell it to look up user names, group names, and passwords via LDAP instead of files.

PAM handles authentication (checking who you claim you are), authorisation (grant or deny access to a given service), session setup, etc. When you're prompted for a password, that's usually PAM's doing. By editing its config you can completely customize that (e.g., you could ask for two passwords, or none at all, or a one-time password, or...). In an LDAP setup, you'd typically configure it to check passwords via the LDAP server. It also handles password changes, which you'd configure to be done in LDAP.

  • Thanks, so PAM source can be NSS, LDAP and whatever else? Commented Nov 5, 2014 at 16:07
  • 1
    @AliAlipourR Correct. PAM can check if a credential such as a password is acceptable almost anywhere.
    – derobert
    Commented Nov 5, 2014 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .