Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running OpenLDAP. When I start a ssh-session I can log in without problems, but an error appears in the logs. This only happens when I log in with a LDAP account (so not with a system account such as root). Any help to eliminate these errors would be much appreciated.

The relevant piece from /var/log/auth.log

sshd[6235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser=  user=peter
sshd[6235]: Accepted password for peter from port 2441 ssh2
sshd[6235]: pam_unix(sshd:session): session opened for user peter by (uid=0)

pam common-session

session [default=1]           
session required
session optional              
session     required skel=/etc/skel umask=0022
session     required
session     required
session     optional

pam common-auth

auth    [success=1 default=ignore]
auth    required               nullok_secure use_first_pass
auth    required              
session     required skel=/etc/skel umask=0022 silent
auth    sufficient nullok_secure use_first_pass
auth    requisite uid >= 1000 quiet
auth    sufficient use_first_pass
auth    required

pam common-account

account [success=2 new_authtok_reqd=done default=ignore]
account [success=1 default=ignore]
account     required
account     sufficient uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore]
account     required
account sufficient
account sufficient
share|improve this question
Post the relevant portion of the log file from the directory server. – Terry Gardner Sep 30 '11 at 14:49

This error occurs because the pam_unix module is asked to check the password of an LDAP user, and of course fails. This failure is then ignored by your PAM config, but the module logs it anyway (and this can't be disabled).

However, your config looks quite strange to me. You are using each of pam_unix and pam_ldap twice, and I suggest you to clean this up. If you use only their first occurrences, the error message should go away (because pam_unix will be skipped for successfully authenticated LDAP users). However, I'm not sure what you wanted to achieve with the double checks and the pam_succeed_if line, so please be sure you know what you do when changing this config.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.