PAM vs GSSAPI?

[Ashwin Ganti]

Hi ,

We are implementing a new security mechanism (similar to kerberos) and
want to integrate it with apps like nfs, ssh etc..

What I am wondering here is whether to have a PAM module that
implements the security mechanism ( similar to pam_krb5) or to provide
a GSSAPI implementation.

For example I have checked code for openSSH only to see that it seems
to have both PAM support and GSSAPI usage too. I am not sure which one
is being used for kerberos now.

I am a newbie in all this and am confused as to how to go about with this.

What I am thinking is to provide the GSSAPI implementation for our
security mechanism and write a PAM module ( say pam_gss) to
authenticate using GSSAPI. I dont know if this would work.

I am not sure as to how kerberos handles all this ( we need to more or
less follow on similar lines and it would be very useful to know in
what way kerberos is being used by these apps)

Basically I need the new security mechanism to be used by all the
applications ( NFS, ssh etc.) and am not sure as to how to go about
providing that.

Any help or info regarding this would be greatly appreciated. Also
please let me know if this is not the right forum to post this or if
there is anyother place.

Thanks,
Ashwin.