Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I managed to set up my system to use either LDAP or the local password (by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards). However I would like to restrict a certain group of users to be able to only use LDAP and not have the fallback of pam_unix2.so. Is there way of doing this?

share|improve this question
add comment

4 Answers

up vote 2 down vote accepted

Create a group called ldaponly and put all of your LDAP-only users into it. Then, in your PAM configuration, use the pam_succeed_if module to skip the pam_unix2 module when the user is in the ldaponly group.

share|improve this answer
Thanks that's exactly what I was looking for! –  Arun Persaud Oct 29 '10 at 21:01
add comment

umm... perhaps this is too simple, but put the users in LDAP & don't put them in your local password file?

In my environment only root and service/daemon accounts are in the local passwd file, and only user login accounts are in LDAP -- Works beautifully.

share|improve this answer
Our LDAP server has the whole company on it and I only want to restrict it to people who have an account, so that's where I use the local accounts... also if I remove them from passwd I would have to get the home directory, bash, etc from LDAP which doesn't have that information at the moment –  Arun Persaud Oct 29 '10 at 21:02
add comment

The easiest way I can think of right now is to set the local passwords for the "LDAP only" users to something completely weird and not tell them. However, once they have logged in, they would be able to change it (if your PAM setup allows them to do so).

A much more sophisticated way would be to write your own PAM plugin (which is apparently not all that difficult to do) which could perform a lookup into a "LDAP only" list and then return either true or false. This could then be used in the PAM config files to decide the next step, i.e. allow login or not.

share|improve this answer
add comment

Iv ran into this Situation Before with an ldap server i had setup.The best way i can advice(which worked for me)would be to use the /etc/security/access.conf and allowing certain users and groups access. eg.

- : ALL EXCEPT root Group1 Group2:

This Will Deny Everyone access except for root and Everyone who belongs to Group1 and Group2 trying to login localy/using interface.

you might need to enable pam_access.so module in ur pam files.

Hope this Works for you.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.