PLEASE NOTE. Currently few group functions have been implemented.
This section documents the current state of the UNIX module. From the
point of view of the application, it is named "unix" and has the
pwdb_type
PWDB_UNIX
.
Entries supported by the "user" class of the UNIX module are as follows:
user
- username
uid
- user-id
gid
- group-id
passwd
- encrypted password
defer_pass
- "U" unless set by other database
gecos
- user information
dir
- home directory
shell
- shell executable
Entries supported by the "group" class of the UNIX module are as follows:
group
- username
gid
- group-id
passwd
- encrypted password
users
- text list of user names separated by commas
The pwdb_request()
function call is only supported for the
"group" class. The two entries that may be requested are:
groups
- text list of group names separated by commas
groupids
- array of gid_t
values that
contain the numerical form of the "groups" entry.
pwdb **
argument prior to the
pwdb_request()
call.
This section documents the current implementation of the shadow database module.
The shadow module does not make any use of the id
parameter. Since the shadow database does not contain such an entry,
the only way of identifying a user is with a name
argument.
However, an id
based lookup is possible, if the shadow
database is searched after a database that contains a user-uid
mapping. In this case the ``user
'' entry in the partially
built pwdb
structure is used to locate the appropriate entry in
the shadow file.
The shadow module is designed to work in conjunction with a database
that provides the standard user-uid
mapping. It should be
noted that it does not provide sufficient information to support a
user login session.
Entries supported by the "user" class of the shadow module are:
user
- username
passwd
- encrypted password
last_change
- date password was last changed
min_change
- minimum period before password can be changed
max_change
- lifetime of current password
warn_change
- number of days prior to expiry that the user should be warned
defer_change
- grace period before password is finally invalid
expire
- date account expires
Entries supported by the "group" class of the shadow module are:
group
- groupname
passwd
- encrypted group password
users
- text list of user names separated by commas (members of the group)
admins
- text list of user names separated by commas (administrators of the group)
The RADIUS module is acting just as a user validation mechanism. The official Livingston radiusd 2.0 is supported, but in order to take advantage of the all information and auth tokens the radius server can provide, a session PAM module should be written, and be stacked over pam_unix.
The following should be taken into consideration when writing applications to authenticate to a radius server:
However, with few hacks to the radius server and proper modification
of the /etc/raddb/dictionary
file this module uses, a NIS-like
environment could be achieved. Full documentation on how to achieve this
will be added later.
PWDB_SUCCESS
, the pass_phrase entry is wiped out.
pass_phrase
and passwd
entries in clear text. By
convention, the pass_phrase
contains the old password (which is
required by the RADIUS server to authenticate the user) and the
passwd
entry contains the new password. One should be very
careful about this issue, as some other modules used before RADIUS
authentication may set the value of passwd
entry, and the
application should make sure that the clear text password is passed to
the RADIUS module for changing password. The RADIUS module will wipe
out both pass_phrase
and password
entries - thus the
application can not rely on validity of any of those entries in the
pwdb structure after a call to the update function of the RADIUS
module.
Note that the RADIUS server must permit changing of the passwords user passwords. IF the RADIUS does not accept changing the user passwords, a PWDB_TIMEOUT will occur.
Entries supported by this database are set according to the definitions
from /etc/raddb/dictionary
file. Three entries have a special
meaning when calling the RADIUS functions: user
, passwd
and
pass_phrase
. The passwd
and pass_phrase
will be wiped out by
the RADIUS functions as soon as the module can dispose them. The reponse
from the RADIUS server is processed and entries are set in the pwdb
structure according to the names from the dictionary file.
A sample RADIUS dictionary
entry list is provided here - valid for
Livingston RADIUSD 2.0:
#---------------------------------------------------------------------------
#
# @(#)dictionary 1.3 10/1/96 Copyright 1991 Livingston Enterprises Inc
#
#---------------------------------------------------------------------------
#
# This file contains dictionary translations for parsing
# requests and generating responses. All transactions are
# composed of Attribute/Value Pairs. The value of each attribute
# is specified as one of 4 data types. Valid data types are:
#
# string - 0-253 octets
# ipaddr - 4 octets in network byte order
# integer - 32 bit value in big endian order (high byte first)
# date - 32 bit value in big endian order - seconds since
# 00:00:00 GMT, Jan. 1, 1970
#
ATTRIBUTE User-Name 1 string
ATTRIBUTE Password 2 string
ATTRIBUTE CHAP-Password 3 string
ATTRIBUTE NAS-IP-Address 4 ipaddr
ATTRIBUTE NAS-Port 5 integer
ATTRIBUTE Service-Type 6 integer
ATTRIBUTE Framed-Protocol 7 integer
ATTRIBUTE Framed-IP-Address 8 ipaddr
ATTRIBUTE Framed-IP-Netmask 9 ipaddr
ATTRIBUTE Framed-Routing 10 integer
ATTRIBUTE Filter-Id 11 string
ATTRIBUTE Framed-MTU 12 integer
ATTRIBUTE Framed-Compression 13 integer
ATTRIBUTE Login-IP-Host 14 ipaddr
ATTRIBUTE Login-Service 15 integer
ATTRIBUTE Login-TCP-Port 16 integer
ATTRIBUTE Reply-Message 18 string
ATTRIBUTE Callback-Number 19 string
ATTRIBUTE Callback-Id 20 string
ATTRIBUTE Framed-Route 22 string
ATTRIBUTE Framed-IPX-Network 23 ipaddr
ATTRIBUTE State 24 string
ATTRIBUTE Session-Timeout 27 integer
ATTRIBUTE Idle-Timeout 28 integer
ATTRIBUTE Termination-Action 29 integer
ATTRIBUTE Called-Station-Id 30 string
ATTRIBUTE Calling-Station-Id 31 string
ATTRIBUTE Acct-Status-Type 40 integer
ATTRIBUTE Acct-Delay-Time 41 integer
ATTRIBUTE Acct-Input-Octets 42 integer
ATTRIBUTE Acct-Output-Octets 43 integer
ATTRIBUTE Acct-Session-Id 44 string
ATTRIBUTE Acct-Authentic 45 integer
ATTRIBUTE Acct-Session-Time 46 integer
ATTRIBUTE Acct-Terminate-Cause 49 integer
ATTRIBUTE NAS-Port-Type 61 integer
ATTRIBUTE Port-Limit 62 integer