Naming and Directory Services (DNS, NIS, and LDAP)

TABLE 9–5 pam_unix versus pam_ldapPassword Sentpam_unixUses passwd serviceauthentication methodpam_ldapUses passwd serviceauthentication methodNew Password Sent Encrypted No encryption (unless TLS isused)New Password Stored crypt format Password storage schemedefined on Sun Java SystemDirectory ServerRequires password read? Yes Nosasl/digest-MD5compatibility after changingpasswordNo. Password is not stored inclear. User cannotauthenticate.Yes. As long as default storagescheme is set to clear, usercan authenticate.PAM and Changing PasswordsUse passwd(1) to change a password. In order to change the password, theuserPassword attribute must be writable by the user. Remember that theserviceAuthenticationMethod for passwd-cmd overrides theauthenticationMethod for this operation. Depending on the authentication used,the current password might be unencrypted on the wire.In the case of pam_unix, the new userPassword attribute is encrypted using UNIXcrypt format and tagged before being written to LDAP. Therefore, the new passwordis encrypted on the wire, regardless of the authentication method used to bind to theserver. See the pam_authtok_store(5) man page for more information.As of the Solaris 10 software release, pam_ldap no longer supports password update.The previously recommended use of pam_authtok_store with theserver_policy option now replaces the pam_ldap password update capability.When you use pam_authtok_store, the new password is sent to the LDAP server inthe clear. Therefore, to ensure privacy, use TLS. If TLS is not used, the newuserPassword is subject to snooping. If you set an untagged password with SunJava System Directory Server, the software encrypts the password by using thepasswordStorageScheme attribute. For more information about thepasswordStorageScheme, see the section on user account management in theAdministration Guide for the version of Sun Java System Directory Server that you areusing.Chapter 9 • LDAP Basic Components and Concepts (Overview) 149