Hello, Since you only care about username, uid, gid, and loginshell (management CLI), If you only have one appliance, then just use the /etc/passwd file with pam_unix. If you have multiple appliances, then considering centralized authentication and authorization like ldap with pam_sss. James -----Original Message----- From: Pam-list <pam-list-bounces@xxxxxxxxxx> On Behalf Of Philip Prindeville Sent: Wednesday, October 18, 2023 1:04 PM To: pam-list@xxxxxxxxxx Subject: Best practices for "pure" remote accounts Hi, I was wondering what the conventional wisdom is in the following scenario... I'm working on a downstream distro that uses Debian/Ubuntu bases, and we allow users to log into an appliance (or "server", if you prefer, but not really). For now we have to go ahead and create a placekeeper account with no password for each user for LDAP or Radius authentication to work, but I saw some articles on stackoverflow and elsewhere talking about "authconfig" and "nslcd", etc. Our requirements are such that having a "seed" user that everyone gets cloned as is fine, so they can inherit that uid, gid, and (nonexistent) home directory as they won't be dropping into a shell but into a management CLI instead. We just need to be able to tell them apart by username. And we can block access to scp/sftp if needed for that uid/gid so we don't have to worry about them creating files since they don't have a home directory of their own. How is this typically solved in the most lightweight way possible? Thanks, -Philip _______________________________________________ Pam-list mailing list Pam-list@xxxxxxxxxx https://listman.redhat.com/mailman/listinfo/pam-list _______________________________________________ Pam-list mailing list Pam-list@xxxxxxxxxx https://listman.redhat.com/mailman/listinfo/pam-list
