Using LDAP-UX together with remsh - is it possible?

[David Sickmiller]

I doing research to convert many HP-UX systems to authenticate to Active Directory using LDAP and Kerberos.

At this point, I have telnet/ftp working and have started removing local account from /etc/passwd. However, remsh fails with "Account is disabled" when a user's entry is removed from /etc/passwd.

** My question: Has anyone used remsh (utilizing .rhosts) successfully with an account stored in LDAP?


What I know:
* I am running HP-UX 11.0. I have a applied the patch that is supposed to "PAM-ize" remshd.

* The man page for remshd (on HP-UX 11.0 and even 11.22) says remshd checks for the username in the password file.

* HP says "In Release 11i, PAM processing was extended to the remote login and execution daemons, rexecd and remshd. See rexecd(1M) and remshd(1M)"

* With Linux and Solaris, it appears that a separate PAM module, pam_rhosts_auth handles .rhosts lookups. I have not seen an HP-UX version of this module.


Thanks for any help,
David

[Steven E. Protter]

HP's statement makes it clear that it is possible and they went to some effort to make LDAP and PAM work with the Berkeley protocols.

That does not change the the fact that these protocols are inherently unsafe. There are few reasons to use them that can't be replicated with a little work with Secure Shell.

I find it amazing that HP expended the effort, but obviously enough customers wanted it to justify the work.

SEP