From owner-freebsd-security@FreeBSD.ORG Tue May 27 12:21:37 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7280337B401 for ; Tue, 27 May 2003 12:21:37 -0700 (PDT) Received: from otter3.centtech.com (moat3.centtech.com [207.200.51.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id D08A843F3F for ; Tue, 27 May 2003 12:21:36 -0700 (PDT) (envelope-from anderson@centtech.com) Received: from centtech.com (dhcp-218.centtech.com [204.177.173.218]) by otter3.centtech.com (8.12.3/8.12.3) with ESMTP id h4RJLa56063283; Tue, 27 May 2003 14:21:36 -0500 (CDT) (envelope-from anderson@centtech.com) Message-ID: <3ED3BA9B.5020008@centtech.com> Date: Tue, 27 May 2003 14:20:59 -0500 From: Eric Anderson User-Agent: Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Andy Harrison References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: FreeBSD Security Subject: Re: multihost master.passwd sync X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2003 19:21:37 -0000 Andy Harrison wrote: >>Why not just preconfigure SSH keys between the boxes and scp the file across? >>Seems like a lot of extra work to bring PGP into the mix. > > > Because we don't allow root login remotely, mandated from above. so you scp the file to a directory owned by a user designated to only do this function.. then have a cron job that fires up every so often that snags that file and updates the running master.passwd file.. >>Personally, I'm real curious about utilizing an LDAP backend to replace NIS. >>Read a bit about it, but haven't had a chance to play with it just yet. It >>sounds like a far more elegant solution for what you're looking to do as >>well. Assuming it all works as advertised that is. > > > The problem is that while it allows authentication, it doesn't integrate > seamlessly allowing you to own files as a user that only exists in the ldap. Huh? Explain more please.. Eric -- ------------------------------------------------------------------ Eric Anderson Systems Administrator Centaur Technology Attitudes are contagious, is yours worth catching? ------------------------------------------------------------------