I have configured some SLED10SP1 (not allowed to update) machines to use LDAP for user authentication. Because SLED10 doesn't have official packages for pam_ccreds or sssd, I have to find a way to make offline login possible some other way. The work around we came up was to store few accounts both locally and in the directory.
Now the problem is to allow the use of the local account only if the LDAP-server cannot be reached. How do I make this work?
I configured pam_unix2 to use LDAP (in pam_unix2.conf) with account and password, but not auth. For auth I use pam_ldap.
common-auth:
auth required pam_env.so
auth [default=ignore cred_insufficient=die success=done] pam_ldap.so
auth required pam_unix2.so
What am I missing?