Re: libpam-sshauth and libnss-sshsock

On Mon, Nov 14, 2011 at 01:11:04PM -0500, Gideon Romm wrote:
> >> 2. We could use a different pam module, like pam_group that
> >> automatically adds users as members to system groups, and simply
> >> modify that module's configuration (even via lts.conf).
> >
> > This, to my mind, seems to be a cleaner solution.  Since we're
> > going to want to use the pam_exec module anyway, part of the
> > scripting could be updating the /etc/security/group.conf file,
> > before the pam_group module's loaded.
> >
> > We might not even need to do that...  Couldn't we just have static
> > entries adding everyone to the groups we need... sound, plugdev, fuse
> > etc. ?  Seems like we could just do that at chroot build time.
> >
> > I could be missing something...
> 
> Yeah, I was leaning more towards #2, myself. Although we *could* do it
> statically, I would *prefer* to write it dynamically upon connecting
> to the LDM_SERVER.

Sure.  In that case, pam_exec provides the perfect way to do it.  IIRC,
it waits for the script to end before moving onto the next module in the
pam stack, so doing the dynamic jiggery-pokery there should be fine, and
if pam_group's the next one in the stack, so much the better.

What would REALLY be handy is if there were a rc.d type system for
pam_group.  Then rather than editing the file, you could just drop a
brand new file somewhere, with the perms you need, and then simply
erase it on logout.

I can have a look tonight at pam_group.  I wouldn't expect it would
be that hard to add, but unless upstream wants to add it, it's of
limited usefulness.

Scott

------------------------------------------------------------------------------
RSA(R) Conference 2012
Save $700 by Nov 18
Register now
http://p.sf.net/sfu/rsa-sfdev2dev1
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net