Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a bit of an edge case here. My institution has a RHEL server where students can log in and do their work. Accounts are held in LDAP and the server uses PAM and LDAP to authenticate. At the end of the academic year I need to lock the student accounts on this server - i.e. preserve them intact, but prevent that user from logging in. I've tried passwd -l and usermod -L, but in both cases the user can still log in.

Is there a way of locking an account that will work with PAM LDAP?

share|improve this question
If i record correctly you can lock the account inside ldap (eg using gosa or phpldapadmin). – user130370 Oct 23 '12 at 12:00
Thanks Eric - but I need to lock just this server. Some students will stay on for other courses, so I can't modify their LDAP account. – Austin Oct 23 '12 at 12:35
up vote 5 down vote accepted

This can be accomplished by using group ACLs. Adding the following line to your common-auth file:

auth required

Will get it set up. You can then use a group (it can be LDAP) to set an explicit deny. Invert the meaning to get an explicit allow, which may be a better choice if you're not allowed to ever delete students.

-:ALL EXCEPT root grp-retired-students:ALL EXCEPT LOCAL
share|improve this answer
Thanks, this looks like the answer. Sorry for the basic question, but where does the second line go? – Austin Oct 23 '12 at 12:58
Ah, cancel that - it's in /etc/security/access.conf – Austin Oct 23 '12 at 13:29
Perfect! I cut down the second line to: -:grp-retired-students:ALL and it's doing the job. Thank you very much. – Austin Oct 23 '12 at 15:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.