3

Routers and switches with RADIUS authentication can be configured such that login is disabled for locally configured users as long as the RADIUS server is available. If the RADIUS server becomes unavailable, they fall back to allowing login as a locally configured user.

Is it possible to achieve the same effect with Linux machines using winbind to authenticate Active Directory users? I have a feeling it could be done with the right PAM configuration, but I'm not very far along on the PAM learning curve...

1 Answer 1

1

Yes, it is possible.

Basically you will need to make sure that you have pam_unix below pam_winbind in your pam config like in following example:

auth       required     /lib/security/pam_securetty.so
auth       sufficient   /lib/security/pam_winbind.so
auth       sufficient   /lib/security/pam_unix.so use_first_pass
auth       required     /lib/security/pam_stack.so service=system-auth
auth       required     /lib/security/pam_nologin.so
account    sufficient   /lib/security/pam_winbind.so
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_stack.so service=system-auth
session    optional     /lib/security/pam_console.so

You will also need to make sure nsswitch is configured to fall back to local ids:

passwd:     winbind files
shadow:     winbind files
group:      winbind files

There are detailed docs on samba website:

BUT: you may face some problems with long login times if you won't set up hard timeouts. I would also recommend to research for other alternatives that may work better in such cases.

2
  • I see, so this configuration would not allow login by an /etc/passwd user as long as the domain controller is available? I would have expected winbind would go "no such user, denied" and then PAM would go on to authenticate with pam_unix anyhow?
    – Salkin
    Jun 10, 2012 at 15:38
  • Hmm... I'm not so sure (need to refresh my mind), but with this configuration system will try to authenticate via winbind first, and if it's not succeeds (for whatever reason), it will try to authenticate via local files. It should be possible to modify this behavior to suit your needs by replacing sufficient with something like [success=ok ignore=ignore default=1]. Since this is security question I would recommend you to check the docs and test everything before going live.
    – rvs
    Jun 10, 2012 at 18:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .