Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want local users to be able to log in to a Linux server using their Windows domain (AD) passwords. (All local accounts have a matching userid in AD).

I've installed libpam-krb5, and the main settings in /etc/krb5.conf seem ok:

default_realm = FOO.COMPANY.COM
kdc =

These settings work fine on another Linux box (Ubuntu); everything should be ok in the AD server.

As I don't know/remember, my question is, what else needs to be tweaked on the Linux server to get AD passwords to work when users try to log in?

The server is running Debian 5.0.3.

share|improve this question
up vote 3 down vote accepted

Right, got it working with some help from a colleague. The only additional configuration file that needed tweaking was /etc/pam.d/common-auth.

The original configuration was:

auth    required nullok_secure

We changed it to:

auth    [success=2 default=ignore] minimum_uid=1000
auth    [success=1 default=ignore] nullok_secure try_first_pass
auth    requisite             
auth    required              

AD passwords now work fine when logging on to the server.

share|improve this answer
This page looks like a useful resource btw:… (It also covers handling all account management in AD, unlike in our case.) – Jonik Dec 15 '09 at 12:54

use google

share|improve this answer
The point of ServerFault is to consolidate knowledge relevant to this field. Eventually "Use Google" should be replaced by "Use ServerFault." – sh-beta Dec 15 '09 at 12:20
@sh-beta: What about when google takes you to serverfault? – chris Dec 15 '09 at 13:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.