Practical UNIX and Internet Security, 3rd Edition

Network Account and Authorization Systems

These days, many organizations have moved away from large time-sharing computers and invested in large client/server networks containing many servers and dozens or hundreds of workstations. These systems are usually set up so that any user can make use of any workstation in a group or in the entire organization. When these systems are in use, every user effectively has an account on every workstation. These systems provide for automatic account creation and password synchronization between some or many computer systems.

When you are working with a large, distributed system, it is not practical to ensure that every computer has the same /etc/passwd file. For this reason, there are now several different commercial systems available that make the information traditionally stored in the /etc/passwd file available over a network.

Using Network Authorization Systems

Five network authorization systems in use today are:

• Sun Microsystems’ Network Information System (NIS) and NIS+.

• MIT Kerberos, which is now part of the OSF Distributed Computing Environment (DCE) and Microsoft’s Windows XP. Kerberos clients are also included with Solaris, Linux, and several other Unix versions.

• NetInfo, originally developed by NeXT Computer, now part of Mac OS X.

• RADIUS, the Remote Authentication Dial-In User Service. Traditionally, RADIUS has been used by many ISPs to provide for authentication of dialup users. It has been extended to provide authentication ...