PAM:
login,su….application… …..
PAM Library
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| …. | ||
|
| PAM_UNIX |
|
| PAM_LDAP |
| PAM_Kerberos | |||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| NSS: |
|
|
|
|
|
|
|
|
|
|
| ||||||
|
|
| getpwnam() |
|
| getgrnam() | …. | |||||||||||
|
|
|
|
|
|
|
|
| ||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| NSS Engine |
|
|
|
|
|
|
|
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| ||
|
|
|
|
|
|
|
|
|
|
|
|
|
| …. | ||||
|
| NSS_FILES |
|
|
| NSS_NIS |
|
|
| NSS_LDAP |
|
| ||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Application services
Reads /etc/pam.conf to see which authentication module to use
Authentication modules
APIs to access user/system information
Reads /etc/nsswitch.conf to decide which name service module to use
Name service modules
Windows 2000
Following two primary Windows 2000 features built on top of existing industry standards improve Windows 2000’s capability to interoperate with UNIX platforms:
Active Directory (AD):
This is an LDAP based directory which Windows 2000 uses to store all its data. LDAP is an open internet standard. The support of LDAP allows Windows 2000 to interoperate with other vendors’ LDAP directory enabled applications.
Kerberos Services:
Kerberos is the primary authentication method for Microsoft clients connecting to Windows 2000 server. Kerberos is an industry standard for network security. With the support of Kerberos authentication, Windows 2000 is able to authenticate Kerberos clients regardless of what platforms the clients reside on.
Active Directory and Kerberos are integrated seamlessly in the Windows 2000 operating system. Active Directory domain controllers are automatically configured to provide Kerberos with authentication services, and by default, all Windows 2000 computers are configured to operate as Kerberos clients.
Services for UNIX (SFU):
5