Hi,

Can anyone explain to me the differences or relationship between PAM and nsswitch.conf? PAM provide a way to tell the services to authenticate the users against sth, database or flat file...., and so nsswitch.conf does, it is just from my understanding. When a user log in via a service, smtp or pop or sshd or ftp, how can I know the nsswitch.conf or PAM is used. I see sshd in /etc/pam.d/ and when I log in via ssh I see a log entry in /var/log/messages, does it mean ssh is using PAM to authenticate user? If so, what about nsswitch.conf?
Thanks,

Stand

Well, I too have been looking for an answer over the net but didn't get anything.
I am not able to understand the order in which the files are referred.
Say for example ldap, if nsswitch.conf is not having ldap for password and group and shadow, ldap server is not even contacted.
But if the entry is there, the system requires LDAP server to be up and responding(if bind_policy hard) even for local users.
Also, if the pam modules in system-auth have pam_unix.so as sufficient even before pam_ldap.so , still LDAP is contacted ??
Any help would be much appreciated

The one diffrence i noticed is
PAM tell about which and how module get used while nsswitch.conf don't tell anything about which module for example pam_ldap.so to be used.
Thanks

PAM, or Pluggable Authentication Modules, frees applications from the requirement of dealing with authentication by providing an API that allows them to pass authentication requirements off to the library. The main advantage of this is it is easy to configure applications to use different authentication modules by simply modifying the configuration files. See pam(8) and associated man pages for more information.

Name Service Switch (or NSS) is used by various functions in the C library to control where information was looked for. GNU's C library 2.x (or glibc), which is used in Linux, is modelled after Sun's C library from Solaris 2. The configuration file, /etc/nsswitch.conf, specifies the sources for the ``databases'' and their lookup order.

So i think the order should be pam then nss.
First pass pam authentication certified, then looking for password database.