Pam behaviour
Pupeno <[email protected]>
| Newsgroups | gmane.linux.arklinux.devel |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please, check the post about the Ark Linux User Management Tool first. Now... the Ark Linux User Management Tool has to do some privileges set up like kapabilities does but in a much more user friendly way... I could just clone kapabilities functionality (and might be done at first anyway) but I have a proposal... let's take my favourite case, kuser... there we have this line: auth sufficient /lib/security/pam_userlist.so users=arklinux which allows the user arklinux to run kuser, ok. Then, my tool, (as kapabilities would do), may add other users (let's say, pupeno and charly) to the user management 'list of users, so, that line would turn into: auth sufficient /lib/security/pam_userlist.so users=arklinux,pupeno,charly and I think that doesn't scale too well because another tool for user management may come, let's say, superusertool which would have a pam configuration like /etc/pam.d/superusertool and that won't be handle very well by kapabilities nor my Ark Linux User Management Tool... (it would require to update sources on the tools, and that's not a good thing). So, I have a better proposal that would even add some separation from arklinux user and the rest of users, let's add this line (after "auth sufficient /lib/security/pam_userlist.so users=arklinux") to /etc/pam.d/kuser: auth sufficient /lib/security/pam_listfile.so onerr=fail item=user sense=allow file=/etc/security/privileges/usermanagement so, then, my user management application would do something easier: add a user to the list of users in /etc/security/privileges/usermanagement and adding another usermanagement tool won't require any software change, just adding "auth sufficient /lib/security/pam_listfile.so onerr=fail item=user sense=allow file=/etc/security/privileges/usermanagement" to the pam.d file. What do you people think ? I'm about to develop the Ark Linux Management Tool... what would you like me to do, implement this modified pam idea or copy the code from kapabilities and do it like it is done now ? (might be changed latter anyway). Thanks. - -- Pupeno: [email protected] http://www.pupeno.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQFAEetstCepaMf3unIRArpaAJoDVnDacA1752ZUsWq2VmELjbZV8ACdGI53 U1g2DJqSJJCgysbcdrCx0iE= =1mUo -----END PGP SIGNATURE-----