Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

I am very fond of libpam-ldapd, have been using it for a year now in production on quite a few Ubuntu servers. I can recommend it over libpam-ldap.

The project is originally called nss-pam-ldapd and on its homepage you can find a list of its biggest advantages over the old libpam-ldap package.

Edit: In conjunction with libpam-ldapd on Ubuntu you should also look into the auth-client-config package to correctly configure PAM et al.

share|improve this answer

One reason we have been forced to convert to libpam-ldapd is that we use SSL for our LDAP servers. Thanks to libgcrypt "brokenness" (see Debian bug 566351 or Ubuntu bug 23252, both entertaining), this means that sudo stops working when libpam-ldap & libnss-ldap are used with LDAP/SSL.

Your options if you want to use SSL with LDAP (and why wouldn't you?) are to recompile libpam-ldap with OpenSSL or use libpam-ldapd.

share|improve this answer
    
Wow, that's a pretty crazy thread. But it looks like they're dropping libgcrypt in favor of nettle? –  jldugger Jul 25 '11 at 20:22
    
Hasn't happened yet. Anyhow, lipam-ldapd is probably "better" from an architectural purity and security point of view, but if nslcd ever crashes you might be SOL. –  Zanchey Jul 27 '11 at 14:02

While libnss-ldapd is better than libnss-ldap in practically every way, the libpam-ldapd has one major deficiency: it can't handle LDAP ppolicy, and I couldn't find any information about password change using LDAP Extended Operation (it may handle it transparently).

If you have a "shadow" free LDAP (if you use ppolicy you most certainly will if you use OpenLDAP as both ppolicy and smbk5pwd don't update the shadow password ageing information) you need libpam-ldap or users won't be notified that their password will expire soon.

Thankfully, you can mix and match them. I've been using libnss-ldapd together with libpam-ldap for over a year now without any problems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.