From owner-freebsd-current@FreeBSD.ORG  Thu May 22 16:45:49 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9A93E37B404
	for <freebsd-current@freebsd.org>;
	Thu, 22 May 2003 16:45:49 -0700 (PDT)
Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A93D043F75
	for <freebsd-current@freebsd.org>;
	Thu, 22 May 2003 16:45:48 -0700 (PDT)	(envelope-from des@ofug.org)
Received: by flood.ping.uio.no (Postfix, from userid 2602)
	id 9F6F2530E; Fri, 23 May 2003 01:45:45 +0200 (CEST)
X-URL: http://www.ofug.org/~des/
X-Disclaimer: The views expressed in this message do not necessarily
  coincide with those of any organisation or company with
  which I am or have been affiliated.
To: Gordon Tetlow <gordont@gnf.org>
References: <20030522184631.A23366@bart.esiee.fr>
	<xzp65o2zkhf.fsf@flood.ping.uio.no>
	<20030522224850.GK87863@roark.gnf.org>
From: Dag-Erling Smorgrav <des@ofug.org>
Date: Fri, 23 May 2003 01:45:44 +0200
In-Reply-To: <20030522224850.GK87863@roark.gnf.org> (Gordon Tetlow's message
 of "Thu, 22 May 2003 15:48:50 -0700")
Message-ID: <xzpof1uy28n.fsf@flood.ping.uio.no>
User-Agent: Gnus/5.1001 (Gnus v5.10.1) Emacs/21.3 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: freebsd-current@freebsd.org
cc: Frank Bonnet <bonnetf@bart.esiee.fr>
Subject: Re: 5.1 beta2 still in trouble with pam_ldap
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 22 May 2003 23:45:49 -0000

Gordon Tetlow <gordont@gnf.org> writes:
> Do you think it might be a good idea to turn all the pam configuration
> files to list actual providers at sufficient followed by a pam_deny:

No.  I'd rather replace "sufficient" with "binding" where appropriate.

> > Solaris introduced the "binding" flag to try to alleviate this
> > problem.  OpenPAM supports "binding", but does not document it
> > anywhere.
> I'm unfamiliar with this option. What's it do?

It behaves like "sufficient" should, i.e. failure is not ignored.  I'm
working on updating the documentation.

DES
-- 
Dag-Erling Smorgrav - des@ofug.org