How to secure PAM?

[David LePage]

I know others have run into this scenario, and I'm curious how it has been
resolved. 

I have users that may be in two different databases - either a remote
database that utilizes RADIUS (pam_radius_auth.so), or a database that
uses ldap (pam_ldap.so). 

On Linux, my pam.d/sshd looks like:

auth   sufficient   /lib/security/pam_radius_auth.so
auth   required     /lib/security/pam_ldap.so

My problem is as follows... I have some users that should only
authenticate to pam_ldap.so, and others that I want to enforce
authentication at pam_radius_auth.so. 

How do I do it without allowing the users defined on the system, AND in
ldap, to bypass the first module?

What seems to make sense, is that the pam_radius_auth.so module has a flag
to reject authentication IF the user exists on the local system, when the
LDAP user accounts are stored remotely. It would have to check for the
users existance, and not proceed to the next module. Setting this module
to required doesnt work because some users only reside in LDAP and need to
bounce down to the next module.. Any ideas?
D


		
__________________________________ 
Discover Yahoo! 
Have fun online with music videos, cool games, IM and more. Check it out! 
http://discover.yahoo.com/online.html