The PWDB Library Guide: Supported modules

Next Previous Contents

## 4. Supported modules

PLEASE NOTE. Currently few group functions have been implemented.

## 4.1 UNIX module

This section documents the current state of the UNIX module. From the point of view of the application, it is named "unix" and has the `pwdb_type` `PWDB_UNIX`.

Entries supported by the "user" class of the UNIX module are as follows:

`user`

  - username

`uid`

  - user-id

`gid`

  - group-id

`passwd`

  - encrypted password

`defer_pass`

  - "U" unless set by other database

`gecos`

  - user information

`dir`

  - home directory

`shell`

  - shell executable

Entries supported by the "group" class of the UNIX module are as follows:

`group`

  - username

`gid`

  - group-id

`passwd`

  - encrypted password

`users`

  - text list of user names separated by commas

The `pwdb_request()` function call is only supported for the "group" class. The two entries that may be requested are:

`groups`

  - text list of group names separated by commas

`groupids`

  - array of `gid_t` values that contain the numerical form of the "groups" entry.

Note, for such requests to be honored the name of the user should be contained in the `pwdb **` argument prior to the `pwdb_request()` call.

## 4.2 Shadow module

This section documents the current implementation of the shadow database module.

The shadow module does not make any use of the `id` parameter. Since the shadow database does not contain such an entry, the only way of identifying a user is with a `name` argument. However, an `id` based lookup is possible, if the `shadow` database is searched after a database that contains a user-uid mapping. In this case the ```user`'' entry in the partially built `pwdb` structure is used to locate the appropriate entry in the shadow file.

The shadow module is designed to work in conjunction with a database that provides the standard `user-uid` mapping. It should be noted that it does not provide sufficient information to support a user login session.

Entries supported by the "user" class of the shadow module are:

`user`

  - username

`passwd`

  - encrypted password

`last_change`

  - date password was last changed

`min_change`

  - minimum period before password can be changed

`max_change`

  - lifetime of current password

`warn_change`

  - number of days prior to expiry that the user should be warned

`defer_change`

  - grace period before password is finally invalid

`expire`

  - date account expires

Entries supported by the "group" class of the shadow module are:

`group`

  - groupname

`passwd`

  - encrypted group password

`users`

  - text list of user names separated by commas (members of the group)

`admins`

  - text list of user names separated by commas (administrators of the group)

## 4.3 NIS module

- user removal is not possible. (lack of documentation)
- user creation is not possible (lack of documentation)

## 4.4 DECNIS module

The decnis module allows use of some extensions to the basic NIS maps. The two current extensions supported are the Solaris passwd.adjunct and the Digital Equipment Corp prpasswd maps. Both of these are shadow password schemes for basic (non-secure) NIS. The solaris support is untested. This option encompasses the NIS option, and the decnis option should replace the standard nis option in the pwdb.conf file. In the event of a user not having a shadow NIS password entry, the result should be identical to that returned by the NIS module above.

Warning1 Support for many of the extensions (password expiry, life time, account locking etc..) is not present in this version. Just raw authentication.

Warning2 Clustering your Linux boxes with this software will reduce the security level of your NIS server/cluster. Users may have access to encrypted passwords of other users.

- user removal is not possible. (lack of documentation)
- user creation is not possible (lack of documentation)

## 4.5 RADIUS module

The RADIUS module is acting just as a user validation mechanism. The official Livingston radiusd 2.0 is supported, but in order to take advantage of the all information and auth tokens the radius server can provide, a session PAM module should be written, and be stacked over pam_unix.

The following should be taken into consideration when writing applications to authenticate to a radius server:

- the pwdb group functions are not supported (RADIUS does not have this concept)
- Other than checking for username/password pairs, the radius module can not be used alone with the stock radiusd server to handle the user login without a suitable RADIUS client (for example there is no way to get an UID for a user).

  However, with few hacks to the radius server and proper modification of the `/etc/raddb/dictionary` file this module uses, a NIS-like environment could be achieved. Full documentation on how to achieve this will be added later.

- All radius module functions that access the remote server require the presence of the "pass_phrase" pwdb entry which contains the user password in clear text. The radius module will destroy this information as soon as it can dispose of it, so an application can assume that after a call to a function in the radius module which returned with `PWDB_SUCCESS`, the pass_phrase entry is wiped out.
- When updating a RADIUS user password, one should supply both `pass_phrase` and `passwd` entries in clear text. By convention, the `pass_phrase` contains the old password (which is required by the RADIUS server to authenticate the user) and the `passwd` entry contains the new password. One should be very careful about this issue, as some other modules used before RADIUS authentication may set the value of `passwd` entry, and the application should make sure that the clear text password is passed to the RADIUS module for changing password. The RADIUS module will wipe out both `pass_phrase` and `password` entries - thus the application can not rely on validity of any of those entries in the pwdb structure after a call to the update function of the RADIUS module.

  Note that the RADIUS server must permit changing of the passwords user passwords. IF the RADIUS does not accept changing the user passwords, a PWDB_TIMEOUT will occur.

- The password update is the only function supported by the RADIUS update function.

Entries supported by this database are set according to the definitions from `/etc/raddb/dictionary` file. Three entries have a special meaning when calling the RADIUS functions: `user`, `passwd` and `pass_phrase`. The `passwd` and `pass_phrase` will be wiped out by the RADIUS functions as soon as the module can dispose them. The reponse from the RADIUS server is processed and entries are set in the `pwdb` structure according to the names from the dictionary file.

A sample `RADIUS dictionary` entry list is provided here - valid for Livingston RADIUSD 2.0:

> `

>     #---------------------------------------------------------------------------
>     #
>     # @(#)dictionary        1.3 10/1/96  Copyright 1991 Livingston Enterprises Inc
>     #
>     #---------------------------------------------------------------------------
>     #
>     #       This file contains dictionary translations for parsing
>     #       requests and generating responses.  All transactions are
>     #       composed of Attribute/Value Pairs.  The value of each attribute
>     #       is specified as one of 4 data types.  Valid data types are:
>     #
>     #       string - 0-253 octets
>     #       ipaddr - 4 octets in network byte order
>     #       integer - 32 bit value in big endian order (high byte first)
>     #       date - 32 bit value in big endian order - seconds since
>     #                                       00:00:00 GMT,  Jan.  1,  1970
>     #

>     ATTRIBUTE       User-Name               1       string
>     ATTRIBUTE       Password                2       string
>     ATTRIBUTE       CHAP-Password           3       string
>     ATTRIBUTE       NAS-IP-Address          4       ipaddr
>     ATTRIBUTE       NAS-Port                5       integer
>     ATTRIBUTE       Service-Type            6       integer
>     ATTRIBUTE       Framed-Protocol         7       integer
>     ATTRIBUTE       Framed-IP-Address       8       ipaddr
>     ATTRIBUTE       Framed-IP-Netmask       9       ipaddr
>     ATTRIBUTE       Framed-Routing          10      integer
>     ATTRIBUTE       Filter-Id               11      string
>     ATTRIBUTE       Framed-MTU              12      integer
>     ATTRIBUTE       Framed-Compression      13      integer
>     ATTRIBUTE       Login-IP-Host           14      ipaddr
>     ATTRIBUTE       Login-Service           15      integer
>     ATTRIBUTE       Login-TCP-Port          16      integer
>     ATTRIBUTE       Reply-Message           18      string
>     ATTRIBUTE       Callback-Number         19      string
>     ATTRIBUTE       Callback-Id             20      string
>     ATTRIBUTE       Framed-Route            22      string
>     ATTRIBUTE       Framed-IPX-Network      23      ipaddr
>     ATTRIBUTE       State                   24      string
>     ATTRIBUTE       Session-Timeout         27      integer
>     ATTRIBUTE       Idle-Timeout            28      integer
>     ATTRIBUTE       Termination-Action      29      integer
>     ATTRIBUTE       Called-Station-Id       30      string
>     ATTRIBUTE       Calling-Station-Id      31      string
>     ATTRIBUTE       Acct-Status-Type        40      integer
>     ATTRIBUTE       Acct-Delay-Time         41      integer
>     ATTRIBUTE       Acct-Input-Octets       42      integer
>     ATTRIBUTE       Acct-Output-Octets      43      integer
>     ATTRIBUTE       Acct-Session-Id         44      string
>     ATTRIBUTE       Acct-Authentic          45      integer
>     ATTRIBUTE       Acct-Session-Time       46      integer
>     ATTRIBUTE       Acct-Terminate-Cause    49      integer
>     ATTRIBUTE       NAS-Port-Type           61      integer
>     ATTRIBUTE       Port-Limit              62      integer

> `

Next Previous Contents