Password/userid synchronisation

[Frode Vold]

I am working in a company situated in about 40 different locations. Many of our users have userid on several of these machines (hpux (10.20 and some 11.0) on every location + 1 NT server (1 domain)).
In some cases the users have many different passwords to remember + it gives us unnecessary support.
Is there any tools that uses the NT-user password to synchronise the /etc/passwd on hpux servers, or vice versa ?
(+ maybe automatical creation of the home area on these hpux servers)

[Lasse Knudsen]

Hi,

It is not possible to "syncronize" the the passwords between the systems (both uses one-way encryptions schemes and are not combatible).

You could however authenticate you users towards the NT-server (so they use the NT-password as their Unix password)

You need a NTLM Pam module and I think it is only available on 11.00 - look for it on http://www.software.hp.com, I do not recall if it is included with the CIFS9000 product (also available on that site)

[Victor BERRIDGE]

Could you consider using NIS or NIS+?
This would solve your unix part problem

Just thoughts...
Best regards
Victor

[Frode Vold]

Hi
To Victor: As far as i know NIS does not support sync. over WAN ??

[Ralph Grothe]

As far as I have heard, are the algorithms that do the cryptography on Unix an Win32 disparate. :-(

The only way out I could think of would be to write one's own wrapper script/prog that reads plaintext passwords from user input and does the encryption for each system separately.

You could probably use Perl to do this.
The encryption for the Unix part is straight forward with Perl's standard crypt function.
Consult the example in the POD ("perldoc -f crypt").
For the Windoze part there are Win32 modules in the CPAN that give you a handle.
Have a look at the POD of Win32::NetAdmin or alternatevly Win32::Lanman.

HTH

[Alan Riggs]

re: NIS

You can certainly have a domain that spans a WAN, but you do require a slave server in each subnet.

[Victor BERRIDGE]

Here we have a dept that has different networks (subnets) in geagraphicaly different sites that use NIS with 2 nis servers...

[MARTINACHE]

If you have 10.20 and 11.00 servers, you can only install NIS.
NIS+ is only supported on HPUX 11.00

Good luck,
Patrice.

[Rick Garland]

NIS and SAMBA (CIFS/9000) are valid options.

[Rick Garland]

NIS and SAMBA (CIFS/9000) are valid options.

[John Eaton]

The reply regarding PAM on 11.0 only is correct, as is 11.00 only for NIS+, and if by chance your using TCB on 10.20, NIS does not work. Does not leave much to work with.
We reviewed a number of 3rd party software packages, and found 1 that looks like a solution for us... MC/SG on 10.20 using TCB, Novell, and NT 4.0. The package is Blockade Password Sync. Real simple to implement and use. Supports password changes in any direction. Company is Blockade Systems, Inc., phone 631-499-0543.

[jeffrey groff]

I'm facing exactly the same problem and I've been doing a bit of research and found Windows Services for Unix on the Microsoft website (http://www.microsoft.com/windows2000/sfu/psync.asp). I've read the documentation and it seems like this would be a good solution. However, I have yet to obtain and test the software.

[Barry O Flanagan]

Have you considered using LDAP? LDAP-UX might be what you're looking for.