2

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server database, there is no need to have local user.

I'm able to achieve this if I run NSLCD(/usr/sbin/nslcd).

Would like to know if we can do this with any configuration in /etc/pam.d/sshd or /etc/pam_ldap.conf without the use of running NSLCD.

Please let me know your suggestions

Thanks, Sravani

2 Answers 2

1

No, it's not possible to do this with only PAM.

PAM is a library for authentication, authorization, and related accounting tasks. It's not a low level library; if a program does not include explicit calls to PAM, it sits around doing nothing.

Lookups of uid and gid are routed through a system called NSS (Name Service Switch). This is configured via /etc/nsswitch.conf. If you are not providing a library for NSS to talk to LDAP, the low level C libraries can't perform lookups against it.

It is possible to use a different NSS library for LDAP that doesn't rely on nslcd (this is how the old LDAP library supplied by PADL operated), but it's almost certainly a bad idea. Without a daemon running in the background, every call to NSS must open up a new connection to the LDAP server and immediately release it. This is extremely wasteful and makes it impossible for the libraries to track the state of the remote server, i.e. every NSS lookup must individually time out during a network outage.

2
  • Thanks for the info Andrew. All the cases of LDAP authentication works fine if there is local account with the same name, without the need of running NSLCD daemon. For the case of non-local user account, I had to run NSLCD, hence wanted to check if there is some configuration that can take care of this. As per your info, looks like its mandatory to run NSLCD, for this case. Am I right ?
    – Sravani
    Jul 9, 2013 at 5:47
  • @Sravani Correct. The main thing to take away is that PAM will let you perform authentication tasks, but to support a user that isn't local to the system, you need more than just PAM. (i.e. NSS)
    – Andrew B
    Jul 9, 2013 at 14:33
-1

If you're using redhat or a derived distro just use the authconfig util.

Not sure if that is available under Debian/deb derived distros (I suspect not).

If you want more info you'll probably have to specify what distro you are using.

1
  • I'm using MCP Linux, where I don't have the authconfig util.
    – Sravani
    Jul 8, 2013 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .