Re: [gentoo-server] Pam, Kerberos, SASL, LDAP... which one to use?

[Wes Kurdziolek]

Kerberos only provides an authentication mechanism, not UNIX user and 
group services ie. UIDs, GIDs, home directories, etc. LDAP can provide 
both. If you were to use Kerberos, you'd have to still maintain your 
LDAP + SSL setup so that UNIX user and group services continue to work.

Jose Gonzalez Gomez wrote:

>
>    Hi there,
>
>    I'm about to create a central directory service for users in my
> company, I've been reading a lot and right now I think I have a real
> acronym soup headache. My main requirement is to be able to have a
> central repository of users, so if I want to create a new user, I only
> do it in just a place. Creating a new user means giving that user
> rights to use several services (login, mail, proxy,...), so I don't
> have to create a user in /etc/passwd, then create a user in the mail
> server, ... Other requirements include the possibility of using the
> user information as an address book (this is easy as long as the
> information is stored in LDAP).
>
>    Right now I'm using the following (only login and mail tested):
>
>    * PAM + LDAP. Users may login once I have created an entry for that
>      user in the LDAP directory.
>    * Postfix + SSL + SASL + saslauthd/ldap. Users outside my local
>      network are able to send mails to the world once they have
>      authenticated. Postfix also uses the information stored in LDAP to
>      accept incoming mail.
>    * Courier-IMAP + SSL + LDAP authentication. Users are able to access
>      their IMAP mailboxes after they have authenticated using the
>      information stored in the LDAP server. I'm thinking about
>      migrating this to Cyrus IMAP + SSL + SASL + saslauthd/ldap to
>      mimic the postfix setup.
>
>    I then found information about kerberos, so I don't know if I
> should go that way, or stay with this setup (this is the time to
> experiment, once this is put into production I won't have the
> possibility to change it easily). Are there any advantages of using
> kerberos over using just SSL + LDAP? In case I use kerberos, would I
> have duplicate information in the kerberos database and in LDAP? May I
> use LDAP as a backend for the kerberos password database? I don't know
> that much about kerberos, so forgive me if I'm making any stupid
> question.
>
>    Thanks in advance, regards
>    Jose
>