Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I use puppet for managing our production servers. Under rhel5 the standard way of enabling ldap is to use the authconfig tool. Which works successfully, but isn't really capable with the puppet way of doing things. If I were to have puppet make the relevant edits to the authentication config files, which ones should I change ? Off the top of my head the files I know that need editing to enable ldap authentication are


But there may also be pam config files which I am not suer about

share|improve this question

7 Answers 7

up vote 3 down vote accepted

I typically edit:

/etc/openldap/ldap.conf (check for certs if necessary)

I think that covers the necessary evils. Might need /etc/sudoers as well.

share|improve this answer
/etc/ldap.secret too –  Jon Topper May 28 '09 at 14:30
Don't include ldap.secret if you don't want root on the clients gain access to your directory. Make sure you include all the SSL certs if you use any. ;) –  Lester Cheung Oct 2 '09 at 16:18

My preference is to manage /etc/sysconfig/authconfig (which contains a list of vars) then use authconfig --updateall, this lets me drop 1 file that controls everything.

share|improve this answer
For those who find this question via Google: note that in RHEL6, /etc/sysconfig/authconfig no longer works this way -- it is strictly a read-only file created by running the authconfig command. Changes made here will simply be overwritten by authconfig. See serverfault.com/questions/292406/…. –  larsks Jul 29 '11 at 1:36

I'm not sure about any RedHat specific configurations, but take a look at this LDAP configuration guide.

Basically, besides the files you mention, you should also configure PAM like so:

auth       required     pam_env.so
auth       sufficient   pam_unix.so likeauth nullok
auth       sufficient   pam_ldap.so use_first_pass
auth       required     pam_deny.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so
account    required     pam_ldap.so

password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3    
password   sufficient   pam_unix.so nullok md5 shadow use_authtok
password   sufficient   pam_ldap.so use_first_pass
password   required     pam_deny.so
share|improve this answer
According to tldp‌​, "Note that if you use nss_ldap, you don't strictly need to use pam_ldap." –  ILMostro_7 Jun 28 at 21:32

Our script to set up ldap auth (which invokes authconfig) modifies these files:

/etc/rc.d/init.d/iptables (rearrange the chkconfig priority)
share|improve this answer

Slightly off-topic, but something that can be helpful when setting up PAM for ldap auth is to automatically create user home directories when they log into a server for the first time.

If you are setting up ldap in system-auth file, then add the following to "session":

session          required        pam_mkhomedir.so skel=/etc/skel umask=0077

On a RHEL5 server, I have this after "session require pam_limits.so" (3rd "session" config param).

as per tucker's suggestion above, puppet is a great tool for managing configs across multiple servers.

share|improve this answer

If your kickstarting you can set this up as a kickstart option See:


share|improve this answer

Use authconfig-tui on one client to create the necessary files (ldap.conf, krb5.conf, pam.d/system-auth-ac etc), then copy those files into your puppet install and use puppet to push the files to all new and existing servers.

If you have a significant number of servers and you're not using puppet, you should consider it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.