Bug 27994

Summary: FreeBSD should have really functioning nsswitch
Product: Base System Reporter: gyori <gyori>
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 4.1.1-STABLE   
Hardware: Any   
OS: Any   

Description gyori 2001-06-09 21:20:02 UTC
	FreeBSD 4.x has no support to nsswitch, and even the -CURRENT
supports only very few, predefined methods such as files, nis, nisplus for
user authentication in nsswitch.conf. Dynamical modules can't be used, for
example nss_ldap for authentication via LDAP. There are patches to solve
this problem at http://www.nectar.com/freebsd/nsswitch, but only a part of
them was built in to -CURRENT (the statical part). Why?? This is a serious
deficiency of FreeBSD which has been solved on Linux for ages. Is there any
security or other reason not to implement a fully functional nsswitch
feature on FreeBSD?
Comment 1 Doug Barton freebsd_committer freebsd_triage 2001-06-09 21:41:17 UTC
State Changed
From-To: open->closed


This is not the right forum for this discussion. The problems associated 
are more complicated than applying a few patches.
Comment 2 peter 2001-06-09 23:35:23 UTC
gyori@szit.bme.hu wrote:

> >Description:
> 
> 	FreeBSD 4.x has no support to nsswitch, and even the -CURRENT
> supports only very few, predefined methods such as files, nis, nisplus for
> user authentication in nsswitch.conf. Dynamical modules can't be used, for
> example nss_ldap for authentication via LDAP. There are patches to solve
> this problem at http://www.nectar.com/freebsd/nsswitch, but only a part of
> them was built in to -CURRENT (the statical part). Why?? This is a serious
> deficiency of FreeBSD which has been solved on Linux for ages. Is there any
> security or other reason not to implement a fully functional nsswitch
> feature on FreeBSD?

The basic problem is that it requires *everything* to be dynamically
linked, even the root filesystem (/bin, /sbin etc) and splitting the
libraries between /lib and /usr/lib.  Various people do not want this.

There are other possibilities, such as using proxy nsswitch servers or
something, but that will likely look quite different to normal nsswitch.

Cheers,
-Peter
--
Peter Wemm - peter@FreeBSD.org; peter@yahoo-inc.com; peter@netplex.com.au
"All of this is for nothing if we don't go to the stars" - JMS/B5