Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running ubuntu 10.10 and trying to setup pam with pam_ldap.

The guide at: http://wiki.debian.org/LDAP/PAM says, among other things:

In order to globally enable LDAP authentication through PAM, configure /etc/pam_ldap.conf accordingly and edit the /etc/pam.d/common-* files so that they contain something like this:

/etc/pam.d/common-account:

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

Now, taking this one file as an example, I see:

# here are the per-package modules (the "Primary" block)
account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
# here's the fallback if no module succeeds
account requisite                       pam_deny.so

My question is, do I remove the things currently in that file, replacing them with the ones from the guide - or so I append the things from the guide to the end of the file?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The second file you copied should already permit access via LDAP.

The first rule will attempt to authenticate through the standard unix mechanism ( passwd/shadow ). If that fails, then the second rule get's called and attempts to authenticate with pam_ldap. If that then fails, login is denied.

On a side note, when implementing PAM, don't forget to test things step by step.

Ensure that you can search via ldapsearch to verify that your /etc/pam_ldap and/or /etc/nss_ldap are configured correctly.

Also ensure that getent passwd / getent group returns both Unix and Ldap accounts to verify that your /etc/nsswitch.conf is configured correctly.

share|improve this answer
    
Thanks for the tips on the testing. Indeed you are correct. Can't tell if something just got broken if you don't know if it ever worked. To clarify, do I remove the things currently in that file, replacing them with the ones from the guide - or so I append the things from the guide to the end of the file? –  NinjaCat Jan 21 '11 at 10:32
1  
NinjaCat : I would not modify that PAM file at all. I believe the guide you are looking at is out of date, or at least doesn't take into account the modifications that Ubuntu has made to the files. As I'd mentioned, your PAM files already seem to hook into LDAP authentication. –  delerious010 Jan 21 '11 at 15:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.