SSH + LDAP + pam_groupdn problem

Question

I managed to install SSH + LDAP, moreover I authenticate users through pam_groupdn - if an user is in appropriate group, he is allowed to login to server.

This is part of my pam.d

account sufficient      pam_ldap.so
account sufficient      pam_unix.so

Part of pam_ldap.conf

# Group to enforce membership of
pam_groupdn cn=ldapclient,ou=group,dc=aaaa,dc=zzzz

# Group member attribute
pam_member_attribute memberUid

If I disable pam_unix.so everything is going ok. User is denied if he is not in the group. But I cannot have pam_unix.so disabled, because if LDAP server is offline I would have serious problems to log in, even locally.

If pam_unix.so is enabled:

gigi@0's password: 
You must be a memberUid of cn=ldapclient,ou=group,dc=aaaa,dc=zzzz to login.
Linux testing 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686
....

and the user is allowed to login , even though he is not in the group.

I found some solution with /etc/security/access.conf but I would like to avoid this. Any help ?

Thank you, Martin

Answer 1

I resolved it. The problem caused the f*cking nscd caching daemon !!!! I highly recommend to uninstall it while testing.

Answer 2

I was with the same problem. I resolved adding "shadowAccount" value on the "objectClass" attribute.

Now the users have in the objectClass these values: inetOrgPerson, posixAccount, shadowAccount

I left my commom_account like this:

account sufficient pam_ldap.so account required pam_unix.so

and everything goes ok!

Danilo.