Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can get the password and group from the LDAP client getent passwd getent group work sucessfully But when I try 'su USERNAME' the name from the LDAP server or 'ssh USERNAME@localhost' it prompt me a user password, I typed exactly the USERNAME password but it return "su : Authentication Failure" or "Permission denied, Please try again". I don't know why? it only work when I was at root at the client and "su USERNAME"

share|improve this question

Check your pam settings for ssh and su.

For example for ssh:

auth    sufficient
account sufficient

also make sure that you can login via password in *sshd_config*

PasswordAuthentication yes

Also check your logs: /var/log/auth.log

share|improve this answer
thanks for your answer rkthkr, my LDAP use PAM authentication, can I change the directive "UsePam Yes" in the /etc/ssh/sshd_config, by the way, when I use su command, it first ask for user password, second it also ask me the LDAP password...So what can I configure to by pass the LDAP password – billyduc Dec 12 '09 at 2:06
put the ldap password in /etc/pam_ldap.secret(nothing else but the password) and make it only root readable – artifex Jan 11 '10 at 11:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.