NIS (yp) w/ PAM and CIFs

[Jeff Solomon]

Hi HPUX gurus,

I'm setting up an NIS network with HP workstations that all have unames similar to this:

HP-UX hp1 B.11.00 A 9000/785 2009466367 two-user license

Each also has the CIFS/9000 Bundle installed as shown in swlist:

B8724AA A.01.02 CIFS/9000 Client Lic. for 9000 Wkst.

We use a PDC to authenticate UNIX users, so /etc/passwd entries contain a "*" in the passwd section. I'm trying to setup an NIS network and the problem is that the CIFS PAM module doesn't seem to be able to find a users passwd entry unless it's in /etc/passwd. I think I have everything setup correctly.

"ypcat passwd" shows the correct thing.

The nsswitch.conf line is this:

passwd: files nis

And I can verify this is working with a little test using getpwnam().

The /etc/pam.conf looks like this:


# PAM configuration
#
# Authentication management
#
OTHER auth sufficient /usr/lib/security/libpam_ntlm.1 debug
OTHER auth required /usr/lib/security/libpam_unix.1 try_first_pass

#
# Account management
#
OTHER account required /usr/lib/security/libpam_unix.1

#
# Session management
#
OTHER session required /usr/lib/security/libpam_unix.1

#
# Password management
#
OTHER password required /usr/lib/security/libpam_ntlm.1
OTHER password optional /usr/lib/security/libpam_unix.1 try_first_pass

My best guess is that libpam_ntlm is somehow doing the wrong thing. I would have thought that using NIS to get to get usernames, uids and the like would be transparent to any PAM module. Shouldn't it?

Our systems are setup to allow password login using remsh, but when I try to remsh into a machine where the username only has an entry in NIS, it asks for a password, then a system password, then it fails.

Anyway, I'm really grasping at straws here and I would appreciate any info that anybody has.

Thanks,

Jeff
(jsolomon@vlsi.stanford.edu)