Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have PAM+LDAP SSL running on Debian Lenny, it works well. I always want to restrict who's able to connect, in the past I used pam_groupdn for that but I recently got a situation where I has to accept 2 different groups. So I used pam_filter like this :

pam_filter |(groupattribute=server)(groupattribute=restricted_server)

The problem is that with this statement, passwd doesn't work anymore with LDAP accounts.

Any idea why ?

Please find hereby some links to my config files :
Since only allow me to post 1 link, please find hereunder the link to other conf files :

Many thanks in advance :)

share|improve this question

I have not used pam_filter, but the usual LDAP query would in my opinion be

pam_filter (|(groupattribute=server)(groupattribute=restricted_server))

instead of

pam_filter |(groupattribute=server)(groupattribute=restricted_server)

you posted. Notice the extra parenthesis.

share|improve this answer
That doesn't change anything, thanks for the help. – Henry-Nicolas Tourneur Aug 4 '10 at 7:52
No idea, anyobody ? – Henry-Nicolas Tourneur Aug 4 '10 at 10:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.