Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a CentOS 5.4 system successfully bound to Active Directory. "net ads testjoin" says it's OK. I can run "id username" for AD users and see their accounts. However, I cannot log in remotely via SSH. /var/log/secure says the password is incorrect, but I know it's correct.

I suspect my /etc/pam.d/sshd is incorrect. What should it look like?

Does anything in /etc/security need to be changed?

share|improve this question

3 Answers 3

I believe this depends on how you connect to the domain (winbind or ldap). Given the "net ads testjoin" I'm going to assume that you're using winbind. In that case you would want

auth    sufficient

in your /etc/pam.d/sshd.

You also need

passwd:         files winbind
group:          files winbind

in /etc/nsswitch.conf

Can you logon locally with Domain Accounts?

share|improve this answer
...also check your /etc/security/pam_winbind.conf to ensure the settings are right for your domain (Kerberos, etc.). That config also includes a handy debug statement to get nerdy. – troyengel Dec 16 '09 at 1:06

Can I throw in $0.02 for Likewise Open? It's available for free at and since I've implemented it, I swear, it has saved me more time than anything I've ever used. I can't tell enough people about it.

You basically download the package, install it, and then run the command

domainjoin-cli join adminusername 

You can edit the configuration in /etc/likewise-open/ and setup things like "use default domain", and change the home directory and default shell to whatever you want at your site, and it's over. All authentication works perfectly. PAM works fine. Samba and Apache auth are both easy. It's really like butter.

If you're having problems getting your Linux machines on the domain, I can't recommend this highly enough.

share|improve this answer

Does getent passwd return a listing of AD accounts?

Check your /etc/pam.d/system-auth:

auth        required
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        sufficient use_first_pass
auth        required

account     required
account     sufficient
account     sufficient uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore]
account     required

password    requisite try_first_pass retry=3
password    sufficient md5 shadow nullok try_first_pass use_authtok
password    sufficient use_authtok
password    required

session     required      /lib/security/$ISA/ skel=/etc/skel umask=0077
session     optional revoke
session     required
session     [success=1 default=ignore] service in crond quiet use_uid
session     required

Also verify that winbind is added to passwd, shadow, and group in /etc/nsswitch.conf.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.