Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are getting ready to add Winbind/Samba to some CentOS servers. Identity Management for UNIX is running on our DC, and it's testing well so far. There is one scenario I'm having trouble with, and I'm pretty sure it's solved inside of /etc/pam.d/system-auth with UID ranges. I can't zero in on the specific lines needed. Here is the scenario:

  • We deploy three local users via Puppet; they must be able to login when the DC is down. They need to be purely local users.
  • The local usernames for these users is identical to their AD counterparts (e.g., jsmith is the name of the CentOS local user, and jsmith is also that same user's AD username)
  • When jsmith logs in, it needs to look for that user locally first.
  • Local users are typically > UID 500, and our AD/Winbind users are > UID 10000.
share|improve this question

You may be able to solve this problem by caching winbind credentials. In other words, you have only the AD UID, but its credentials are cached so that he can still log in even when AD is unavailable.

See for more information.

share|improve this answer

I've got a /etc/pam.d/system-auth that was setup with local users to authenticate first, and then fall back to kerberos ( I'll provide it here with replaced with to give you something to start with. This was cobbled together a couple years ago, and as I recall took a bit of refining to get it to work right for us.

account     required broken_shadow
account     sufficient
account     sufficient uid < 500 quiet
account     [authinfo_unavail=ignore default=bad success=ok user_unknown=ignore]
account     required

password    requisite try_first_pass retry=3
password    sufficient md5 shadow nullok try_first_pass use_authtok
password    sufficient use_authtok
password    required

session     optional revoke
session     required
session     optional umask=0077
session     [success=1 default=ignore] service in crond quiet use_uid
session     required
session     optional
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.