The PAM/NSS LDAP packages available on Red Hat systems have the fundamental restriction that they do not support Kerberos binds to the directory. The work around for this problem is to install a local LDAP server that is used as a proxy to the central Stanford LDAP service. The proxy makes a Kerberos bind to the directory, accepts anonymous binds from clients on the host, and PAM/NSS is configured