Chapter 9. Authentication in ThinLinc
In this chapter we will describe how authentication of users is performed in ThinLinc
9.1. Pluggable Authentication Modules
Authentication of users in ThinLinc is performed using the Pluggable Authentication Modules (PAM).
This means ThinLinc can authenticate users using any system for which there is a PAM module.
Examples of PAM modules are pam_ldap for accessing LDAP directories (including Novell
NDS/eDirectory) and pam_winbind for authenticating against a Windows Domain. Of course,
authentication using the standard plaintext password files of Linux is also possible using the PAM
module pam_unix.
If ThinLinc should authenticate against the passwd database on the local host, no configuration at all is
needed, since this is how most distributions are configured at installation. However, at many sites there is
already some type of existing user database. In this chapter we’ll go into detail on how to authenticate
ThinLinc users against Windows domains and LDAP databases.
An user connecting to ThinLinc needs executable access to the ThinLinc login shell thinlinc-login and if
you don’t have any intentions to allow a regular shell access to the server you should set default login
shell for the users to /usr/bin/thinlinc-login.
9.1.1. Configuration files for PAM
PAM is configured by editing the files located in the directory /etc/pam.d/ (at least in the distributions
we’ve tested ThinLinc on).
Different Linux distributions have slightly different ways of configuring PAM. The ThinLinc installation
program will setup ThinLinc to authenticate using the same PAM setup as the Secure Shell Daemon, by
creating a symbolic link from /etc/pam.d/thinlinc to either /etc/pam.d/sshd or
/etc/pam.d/ssh, depending on which of the latter files that exists at installation. This seems to work
on most distributions. Be aware that the PAM settings for the Secure Shell Daemon might really be
somewhere else. For example, on Red Hat distributions, the file /etc/pam.d/system-auth is included
by all other pam-files, so in most cases, that is the file that should be modified instead of the file used by
sshd.
9.2. Limitations
Some PAM modules and authentication mechanisms are case sensitive, while others are not. Usernames
in the ThinLinc client are case sensitive by default, however this behaviour can be changed. See
LOWERCASE_LOGIN_NAME in Section 7.7 for details.
91
Comentarios a estos manuales