1

I have configured some SLED10SP1 (not allowed to update) machines to use LDAP for user authentication. Because SLED10 doesn't have official packages for pam_ccreds or sssd, I have to find a way to make offline login possible some other way. The work around we came up was to store few accounts both locally and in the directory.

Now the problem is to allow the use of the local account only if the LDAP-server cannot be reached. How do I make this work?

I configured pam_unix2 to use LDAP (in pam_unix2.conf) with account and password, but not auth. For auth I use pam_ldap.

common-auth:

auth    required        pam_env.so
auth    [default=ignore cred_insufficient=die success=done] pam_ldap.so
auth    required        pam_unix2.so

What am I missing?

2
  • It seems that adding auth_err=ok solves my problem, but I don't really understand why. Could someone who's familiar with PAM enlighten me?
    – Nipsu
    Oct 9, 2015 at 8:28
  • Your last comment actually suggests an authentication failure in LDAP. To understand this better we're going to need to see the log messages corresponding to the authentication attempts, both before and after your latest change.
    – Andrew B
    Oct 9, 2015 at 19:01

0

You must log in to answer this question.

Browse other questions tagged .