pam_tcb

If you're tired of using shadow as your password shadowing scheme, you may want to check out pam_tcb. This alternative incorporates the tcb package, which has the core components of our tcb suite. The good news is that you can use it even if you're not an Owl user - it's made available for other distributions as well.

Before you can compile and use pam_tcb, though, you need to have the password hashing framework that crypt_blowfish has introduced, patched into your glibc. Once you've got that covered, you're ready to use the three components of the package: pam_tcb, libnss_tcb, and libtcb.

Let's start with pam_tcb, a PAM module which can replace your use of pam_unix. Aside from implementing the tcb password shadowing scheme, it allows many core system utilities to work with very little privilege. This can be a big boon in keeping your overall system security tight.

Next up, libnss_tcb is the NSS module that complements pam_tcb. The final component, libtcb, is code that is shared by both the PAM and NSS modules. It is also used by user management tools on Owl, which benefits from our shadow suite patches. If you're thinking of trying out a different password shadowing scheme, pam_tcb is worth a look.