Re: SSO on Linux

Spurge wrote:
> Is anyone aware of any kerberised RPMs of apache / postfix / vsftpd ?

Try mod_auth_pam for Apache (http://pam.sourceforge.net/mod_auth_pam/). 
   Since your system-auth is now set to AD+Kerberos, you can tell Apache 
to use the same technique to authenticate its users.

You'll need to make sure that the appropriate AddModule and LoadModule 
directives for mod_auth_pam are added to httpd.conf, and you'll want to 
include some authentication scheme like this in either httpd.conf or 
.htaccess files as appropriate:

AuthType	Basic
AuthName	"Who are you?"
require		valid-user

And, of course, in /etc/pam.d you'll need a file named httpd that looks 
like this:

# more /etc/pam.d/httpd
#%PAM-1.0
auth       required     /lib/security/pam_stack.so service=system-auth
account    required     /lib/security/pam_stack.so service=system-auth

I don't know about postfix; I never require authentication for my SMTP 
users.  Using sendmail, I just control access with entries in the 
/etc/mail/access.db hash database.  As for vsftpd, Fedora ships a file 
in /etc/pam.d for this daemon that uses system-auth.  It should work out 
of the box if your system-auth uses Kerberos.

Fully-Kerberized daemons were common in RedHat distributions, but Fedora 
doesn't seem to support Kerberos to the same degree as RH Enterprise. 
You might take a peek at WhiteBox Linux (http://www.whiteboxlinux.org), 
a rebuild of RHEL from source RPMs with all the proprietary RedHat stuff 
removed.  Still, I would bet that once you get system-auth to use 
Kerberos, it should be easy to get the other applications to use it via PAM.

Peter