Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I managed to install SSH + LDAP, moreover I authenticate users through pam_groupdn - if an user is in appropriate group, he is allowed to login to server.

This is part of my pam.d

account sufficient      pam_ldap.so
account sufficient      pam_unix.so

Part of pam_ldap.conf

# Group to enforce membership of
pam_groupdn cn=ldapclient,ou=group,dc=aaaa,dc=zzzz

# Group member attribute
pam_member_attribute memberUid

If I disable pam_unix.so everything is going ok. User is denied if he is not in the group. But I cannot have pam_unix.so disabled, because if LDAP server is offline I would have serious problems to log in, even locally.

If pam_unix.so is enabled:

gigi@0's password: 
You must be a memberUid of cn=ldapclient,ou=group,dc=aaaa,dc=zzzz to login.
Linux testing 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686
....

and the user is allowed to login , even though he is not in the group.

I found some solution with /etc/security/access.conf but I would like to avoid this. Any help ?

Thank you, Martin

share|improve this question

2 Answers 2

I resolved it. The problem caused the f*cking nscd caching daemon !!!! I highly recommend to uninstall it while testing.

share|improve this answer
    
nscd is all kinds of evil - Unless you have a sufficient volume of requests that it really helps performance to cache the results I suggest doing away with it entirely :-) –  voretaq7 Sep 21 '10 at 19:59

I was with the same problem. I resolved adding "shadowAccount" value on the "objectClass" attribute.

Now the users have in the objectClass these values: inetOrgPerson, posixAccount, shadowAccount

I left my commom_account like this:

account sufficient pam_ldap.so account required pam_unix.so

and everything goes ok!

Danilo.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.