Naming and Directory Services (DNS, NIS, and LDAP)

For example, if you set the credential level to anonymous, then anyone must beable to read the userPassword attribute. Similarly, If you set the credential levelto proxy, then the proxy user must be able to read the userPassword attribute.Note – pam_unix is not compatible with the sasl authentication methoddigest-MD5, since Sun Java System Directory Server requires passwords to be storedin the clear in order to use digest-MD5. pam_unix requires the password be storedin crypt format.pam_ldapWhen implementing pam_ldap, the user binds to the LDAP server by using theauthentication method defined in pam_ldap’s serviceAuthenticationMethodparameter, if one exists. Otherwise, authenticationMethod is used.If pam_ldap is able to bind to the server with the user’s identity and suppliedpassword, it authenticates the user.Note – After you enable pam_ldap account management, all users must provide apassword any time they log in to the system. A login password is required forauthentication. Therefore, nonpassword-based logins using tools such as rsh,rlogin, orssh will fail.pam_ldap does not read the userPassword attribute. Therefore, there is no need togrant access to read the userPassword attribute unless there are other clients usingpam_unix. Also, pam_ldap does not support the none authentication method. Thus,you must define the serviceAuthenticationMethod or theauthenticationMethod attributes so clients can use pam_ldap. See thepam_ldap(5) man page for more information.Caution – If the simple authentication method is used, the userPassword attributecan be read on the wire by third parties.See “Example pam.conf File for pam_ldap” on page 199.The following table summarizes the main differences between pam_unix andpam_ldap.148 System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) • January 2005