Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server database, there is no need to have local user.

I'm able to achieve this if I run NSLCD(/usr/sbin/nslcd).

Would like to know if we can do this with any configuration in /etc/pam.d/sshd or /etc/pam_ldap.conf without the use of running NSLCD.

Please let me know your suggestions

Thanks, Sravani

share|improve this question

2 Answers 2

No, it's not possible to do this with only PAM.

PAM is a library for authentication, authorization, and related accounting tasks. It's not a low level library; if a program does not include explicit calls to PAM, it sits around doing nothing.

Lookups of uid and gid are routed through a system called NSS (Name Service Switch). This is configured via /etc/nsswitch.conf. If you are not providing a library for NSS to talk to LDAP, the low level C libraries can't perform lookups against it.

It is possible to use a different NSS library for LDAP that doesn't rely on nslcd (this is how the old LDAP library supplied by PADL operated), but it's almost certainly a bad idea. Without a daemon running in the background, every call to NSS must open up a new connection to the LDAP server and immediately release it. This is extremely wasteful and makes it impossible for the libraries to track the state of the remote server, i.e. every NSS lookup must individually time out during a network outage.

share|improve this answer
    
Thanks for the info Andrew. All the cases of LDAP authentication works fine if there is local account with the same name, without the need of running NSLCD daemon. For the case of non-local user account, I had to run NSLCD, hence wanted to check if there is some configuration that can take care of this. As per your info, looks like its mandatory to run NSLCD, for this case. Am I right ? –  Sravani Jul 9 '13 at 5:47
    
@Sravani Correct. The main thing to take away is that PAM will let you perform authentication tasks, but to support a user that isn't local to the system, you need more than just PAM. (i.e. NSS) –  Andrew B Jul 9 '13 at 14:33
    
Thanks for the info Andrew –  Sravani Jul 11 '13 at 8:44

If you're using redhat or a derived distro just use the authconfig util.

Not sure if that is available under Debian/deb derived distros (I suspect not).

If you want more info you'll probably have to specify what distro you are using.

share|improve this answer
    
I'm using MCP Linux, where I don't have the authconfig util. –  Sravani Jul 8 '13 at 11:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.