I managed to install SSH + LDAP, moreover I authenticate users through pam_groupdn - if an user is in appropriate group, he is allowed to login to server.
This is part of my pam.d
account sufficient pam_ldap.so account sufficient pam_unix.so
Part of pam_ldap.conf
# Group to enforce membership of pam_groupdn cn=ldapclient,ou=group,dc=aaaa,dc=zzzz # Group member attribute pam_member_attribute memberUid
If I disable pam_unix.so everything is going ok. User is denied if he is not in the group. But I cannot have pam_unix.so disabled, because if LDAP server is offline I would have serious problems to log in, even locally.
If pam_unix.so is enabled:
gigi@0's password: You must be a memberUid of cn=ldapclient,ou=group,dc=aaaa,dc=zzzz to login. Linux testing 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686 ....
and the user is allowed to login , even though he is not in the group.
I found some solution with /etc/security/access.conf but I would like to avoid this. Any help ?
Thank you, Martin