From: Les Mikesell lesmikesell@gmail.com
Good call! That and the corresponding grpck found a couple of duplicate lines that seemed to be confusing things.
Any reason you haven't considered NIS? If you're worried about passwords, setup Kerberos for authentication. It's easier than you think.
-- Bryan J. Smith mailto:b.j.smith@ieee.org
On Thu, 2005-07-14 at 16:42, Bryan J. Smith wrote:
From: Les Mikesell lesmikesell@gmail.com
Good call! That and the corresponding grpck found a couple of duplicate lines that seemed to be confusing things.
Any reason you haven't considered NIS? If you're worried about passwords, setup Kerberos for authentication. It's easier than you think.
The machines in question were set up years ago when it wasn't so easy and are on opposite sides of a firewall (but sometimes have NFS mounts in common). One machine has all user accounts and things are managed normally there. The others only have small subsets of users (on purpose) and I've pasted in the passwd entries from the machine that has them all to keep the uids in sync for NFS and rsync'ing chunks of stuff around. I just had some duplicated lines from the last OS version change where I copied too much from the previous one. I might re-do it with LDAP someday, but it's probably more work to control the users that aren't supposed to log into these machines than to separately add the ones that are.
On Thu, 2005-07-14 at 17:02 -0500, Les Mikesell wrote:
I might re-do it with LDAP someday, but it's probably more work to control the users that aren't supposed to log into these machines than to separately add the ones that are.
Stuff pam_netgroups into system-auth then make a group per machine.
http://www2.physics.umd.edu/~payerle/Software/PAM/
On 7/14/05 3:15 PM, Ignacio Vazquez-Abrams wrote:
On Thu, 2005-07-14 at 17:02 -0500, Les Mikesell wrote:
I might re-do it with LDAP someday, but it's probably more work to control the users that aren't supposed to log into these machines than to separately add the ones that are.
Stuff pam_netgroups into system-auth then make a group per machine.
If you set up netgroups, you can specify login rights easily:
* /etc/passwd
[...] +@login-group +:::::/dev/null:/sbin/nologin
* /etc/nsswitch.conf
passwd: compat shadow: compat group: files nis netgroup: files nis
-
Bryan J. Smith <b.j.smith＠ieee.org> -
Ignacio Vazquez-Abrams -
Les Mikesell -
Paul Heinlein