Hi all
president@irithm.com wrote:
Dear Dovecote devotees,
I have been going through dovecot configuration for the first time. I am not an experienced systems administrator so I had to do a left turn to read up about PAM while doing all the configuration for my new webmail service.
I found that the writing in the dovecot documentation about PAM to be rather misleading in at least one aspect. The documentation I am specifically referring to is at http://wiki.dovecot.org/Authentication?highlight=%28authentication%29 and in the comments found in the dovecot.conf file. In this documentation PAM is referred to as a password database. It appears that is not correct, rather PAM is something that uses a password database.
Strictly speaking, PAM is not something that uses a password database. It is an authentication system. Among other things, it checks if a given pair username/password is correct or no. Maybe trying an LDAP bind, but I'd not say that LDAP can be considered a 'password database'.
Since the default for "auth_passdb" given in dovecot.conf was "pam" I spent sometime trying to find a pam password database.
I agree with you that 'password database' is not the best term, but it is a minor issue. Any system administrator will understand what it refers to. Let me say that the separation between user lookup and authentication systems is one of the (many) good ideas in Dovecot. For example, it allows an administrator to access any account for solving problems without the need for the mechanism of 'master password'.
I eventually found out at an independent website that what pam uses is either /etc/passwd or /etc/shadow or /etc/samba/smbpasswd. It was a relief to find out pam uses one of these, since my system has one of them (/etc/shadow), but I was looking to find something quite different for pam since /etc/shadow is one of the listed alternative values for "auth_passdb".
I would have been spared a somewhat lengthy search to find out this information if the documentation was written rather more clearly. So, to help others, I suggest changing the following lines in dovecot.conf
# Where password database is kept: # passwd: /etc/passwd or similiar, using getpwnam() # shadow: /etc/shadow or similiar, using getspnam() # pam [<service> | *]: PAM authentication
to:
# Where password database is kept: # passwd: /etc/passwd or similiar, using getpwnam() # shadow: /etc/shadow or similiar, using getspnam() # pam [<service> | *]: /etc/shadow or similiar, using PAM authentication
Updating the documentation in http://wiki.dovecot.org/Authentication?highlight=%28authentication%29 to include a phrase that mentions that PAM authentication works from one of the standard password databases (i.e. /etc/passwd, /etc/shadow or /etc/samba/smbpasswd) would also be helpful.
I don't think that correction is necessary. Any system administrator must understand PAM not only for Dovecot, but for any service that requires authentication. The documentation of all those services cannot be a tutorial.
Best regards.
-- +----------------------------------------------^-----------------------+ | Luis Meléndez Aganzo ^ Email: luism@uco.es | | Servicio de Informática ^ Tlf: 34-(9)57-211022 | | Área de Sistemas ^ Fax: 34-(9)57-218116 | | Universidad de Córdoba (SPAIN) ^ http://www.uco.es | +----------------------------------------------^-----------------------+