Re: [RFC] Remove supoort for NIS(+) from PAM
On ke, 06 loka 2021, Björn 'besser82' Esser wrote:
Am Freitag, dem 01.10.2021 um 09:31 -0400 schrieb Stephen John
Smoogen:
> On Fri, 1 Oct 2021 at 06:14, Björn 'besser82' Esser
> <besser82(a)fedoraproject.org> wrote:
> >
> > Hello,
> >
> > I'm currently doing some experiments with replacing the - upstream
> > mostly unmaintained - pam_unix module (authentication with user
> > passwd)
> > with something using less bloated and cleaner code. This topic is
> > currently also discussed with the upstream maintainer of pam_unix.
> >
> > Replacing parts of a software for the sake of less complexity
> > usually
> > comes with a cut-down of features; in this particular case it would
> > be
> > dropping support for NIS(+), which has already been abandoned by its
> > initial developer SUN / Oracle for about 10 years [1].
> >
> > Before starting some more concrete plans, I'd like to get some
> > feedback
> > from the Fedora community how they feel about removing NIS(+)
> > support in
> > PAM. Is it even still actively used anywhere and/or by anyone in
> > the
> > Fedora universe?
> >
>
> The places I have seen it still being used are in Universities run by
> people who learned sysadmin in the 1990's and early 2000's. It is a
> light weight system which is simple to set up and tends to be the
> goto-stick for a lot of 'we put this together in 1999 with RHL6 and
> upgraded ever since' places.
>
> That said, NIS in most setups causes all kinds of security problems
> and audit failures that those areas are probably rapidly going away.
> [And the ones I know have been moving to Debian because it keeps
> various other technologies we jettisoned long ago.]
>
> If we drop this from pam_unix, should we look to dropping ypbind and
> similar tools?
Yes, finally dropping the ypbind, yp-tools, and ypserv packages seems to
make sense in this context, as from my understanding they won't be of
any practical use anymore.
Maybe libnsl, libnsl2, nss_nis, and slapi-nis can be evaluated to be
dropped also.
slapi-nis implements two separate plugins, one of which provides NIS
support. It is going to be supported in RHEL 9 and I'd like to keep NIS
part supported in Fedora as well for some time. This only requires
existence of libnsl2.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland