On Thu, 23 Aug 2007, Michelizza Arnauld wrote:
>By looking at the code, I saw that PAM_RUSER is not set by sshd.
>Is there a reason why ?
>If I write a patch to add that feature, is there a chance for it to be
>included in the main distrib ?
speaking for myself - PAM_RUSER is rsh/rlogin stuff and should not
be used for other apps since its value is not trusted; it's useless for
audit logs, for example. Aside from hostbased auth (and gss-api maybe, I'm
not sure now), you can use anything as a value for the remote user client
field and it can't be verified. For example, Solaris uses PAM_AUSER (audited
user) for hostbased and for this one auth method a remote user can log in
directly to a role because as far as the remote host is trusted, the
information on remote client username is trusted. J.
--
Jan Pechanec