Hot answers tagged

3

You keep UsePAM as yes because when PasswordAuthentication is set to no PAM does not call the 'auth' section of the PAM service: UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session ...


1

I found out that whenever I set UsePAM to yes, the password authentication fails. Not sure why? UsePAM option makes the authentication method password use the same PAM module as you want to use for second factor. This is why it rejects your password. This is answer to your question, explaining "why", but not complete solution "how to make it better". ...


1

Original Suggestion: I'd suggest using the nss-pam-ldapd package and use an nslcd mapping to provide default values for user accounts when no value comes from ldap. According to the documentation for nslcd.conf the uid/gid can be derived too: The uidNumber and gidNumber attributes in the passwd and group maps may be mapped to the objectSid followed by ...



Only top voted, non community-wiki answers of a minimum length are eligible