Using AD to Authenticate UNIX Users

Users in a Windows and UNIX-based heterogeneous network often maintain several UNIX accounts to access UNIX systems and applications and an Active Directory (AD) domain account to access Windows resources. This setup has long been an administrative and security concern because users can easily forget passwords if they have many accounts or if they don't use the accounts frequently. As a result, users might write down passwords on paper and leave the paper on the desk if they have to remember many passwords. To help secure these environments, some organizations use UNIX's Network Information Service (NIS) to maintain a central user account database for multiple UNIX systems so that a user can use the same account to log on to different UNIX systems. As security becomes more important, however, many organizations want to have a strong password policy on both Windows and UNIX platforms to better secure their information systems.

A strong password policy in AD must include password aging and locking, in addition to password complexity and history. AD's password complexity requires that a password contain three of the four available character types: lowercase letters, uppercase letters, numbers, and symbols, with a minimum password length of six characters. AD's password history requires that users don't reuse a password for an administrator-set number of passwords (e.g., the past 10 passwords). Unfortunately, most UNIX and Linux OSs and NIS don't natively support AD's level of password complexity and history, although they support the password complexity of at least two lowercase or uppercase letters and at least one number or symbol. They also require that the password history of the new password differ from the old one by at least three characters. Some third-party user authentication and account management products can implement a strong password policy across multiple platforms, but they're expensive and complicated to implement. Microsoft Windows Services for UNIX (SFU) supports implementing NIS on AD domain controllers (DCs) and using the AD user object to store the user's UNIX user properties and credentials, but the user's UNIX password is still separate from the AD password. . . .