Re: [Nss-mysql-users] nss-mysql-root.conf

[Jason Clifford]

On Wed, 19 Jun 2002, Jelmer Vernooij wrote:

> > How do you think a user can gain access if they have no access permissions 
> > on the database themselves?
> > 
> > The only thing a user can do is to query it via getpwent() which is the 
> > same access they had previously when using /etc/passwd.

> In which case the (encrypted) passwords would be in /etc/shadow; data that 
> was not available to the user via getpwent() then !

What makes you think that the same data (ie shadow entries) is available 
to anyone other than root using nss-mysql?

I can assure you that it is not. Only uid 0 processes can read the shadow 
entries.

Jason Clifford