Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use puppet for managing our production servers. Under rhel5 the standard way of enabling ldap is to use the authconfig tool. Which works successfully, but isn't really capable with the puppet way of doing things. If I were to have puppet make the relevant edits to the authentication config files, which ones should I change ? Off the top of my head the files I know that need editing to enable ldap authentication are


But there may also be pam config files which I am not suer about

share|improve this question
up vote 3 down vote accepted

I typically edit:

/etc/openldap/ldap.conf (check for certs if necessary)

I think that covers the necessary evils. Might need /etc/sudoers as well.

share|improve this answer
/etc/ldap.secret too – Jon Topper May 28 '09 at 14:30
Don't include ldap.secret if you don't want root on the clients gain access to your directory. Make sure you include all the SSL certs if you use any. ;) – Lester Cheung Oct 2 '09 at 16:18

My preference is to manage /etc/sysconfig/authconfig (which contains a list of vars) then use authconfig --updateall, this lets me drop 1 file that controls everything.

share|improve this answer
For those who find this question via Google: note that in RHEL6, /etc/sysconfig/authconfig no longer works this way -- it is strictly a read-only file created by running the authconfig command. Changes made here will simply be overwritten by authconfig. See…. – larsks Jul 29 '11 at 1:36

I'm not sure about any RedHat specific configurations, but take a look at this LDAP configuration guide.

Basically, besides the files you mention, you should also configure PAM like so:

auth       required
auth       sufficient likeauth nullok
auth       sufficient use_first_pass
auth       required

account    sufficient
account    sufficient
account    required

password   required difok=2 minlen=8 dcredit=2 ocredit=2 retry=3    
password   sufficient nullok md5 shadow use_authtok
password   sufficient use_first_pass
password   required
share|improve this answer
According to tldp‌​, "Note that if you use nss_ldap, you don't strictly need to use pam_ldap." – ILMostro_7 Jun 28 '15 at 21:32

Our script to set up ldap auth (which invokes authconfig) modifies these files:

/etc/rc.d/init.d/iptables (rearrange the chkconfig priority)
share|improve this answer

Slightly off-topic, but something that can be helpful when setting up PAM for ldap auth is to automatically create user home directories when they log into a server for the first time.

If you are setting up ldap in system-auth file, then add the following to "session":

session          required skel=/etc/skel umask=0077

On a RHEL5 server, I have this after "session require" (3rd "session" config param).

as per tucker's suggestion above, puppet is a great tool for managing configs across multiple servers.

share|improve this answer

If your kickstarting you can set this up as a kickstart option See:

share|improve this answer

Use authconfig-tui on one client to create the necessary files (ldap.conf, krb5.conf, pam.d/system-auth-ac etc), then copy those files into your puppet install and use puppet to push the files to all new and existing servers.

If you have a significant number of servers and you're not using puppet, you should consider it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.