Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I managed to install SSH + LDAP, moreover I authenticate users through pam_groupdn - if an user is in appropriate group, he is allowed to login to server.

This is part of my pam.d

account sufficient
account sufficient

Part of pam_ldap.conf

# Group to enforce membership of
pam_groupdn cn=ldapclient,ou=group,dc=aaaa,dc=zzzz

# Group member attribute
pam_member_attribute memberUid

If I disable everything is going ok. User is denied if he is not in the group. But I cannot have disabled, because if LDAP server is offline I would have serious problems to log in, even locally.

If is enabled:

gigi@0's password: 
You must be a memberUid of cn=ldapclient,ou=group,dc=aaaa,dc=zzzz to login.
Linux testing 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686

and the user is allowed to login , even though he is not in the group.

I found some solution with /etc/security/access.conf but I would like to avoid this. Any help ?

Thank you, Martin

share|improve this question

I resolved it. The problem caused the f*cking nscd caching daemon !!!! I highly recommend to uninstall it while testing.

share|improve this answer
nscd is all kinds of evil - Unless you have a sufficient volume of requests that it really helps performance to cache the results I suggest doing away with it entirely :-) – voretaq7 Sep 21 '10 at 19:59

I was with the same problem. I resolved adding "shadowAccount" value on the "objectClass" attribute.

Now the users have in the objectClass these values: inetOrgPerson, posixAccount, shadowAccount

I left my commom_account like this:

account sufficient account required

and everything goes ok!


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.