I have set up my system to allow either LDAP or the local password for login. I did this by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards.

However I would like to require a certain group of users to authenticate against LDAP only, disallowing the fallback of pam_unix2.so. Is there way of doing this?


Create a group called ldaponly and put all of your LDAP-only users into it. Then, in your PAM configuration, use the pam_succeed_if module to skip the pam_unix2 module when the user is in the ldaponly group.


umm... perhaps this is too simple, but put the users in LDAP & don't put them in your local password file?

In my environment only root and service/daemon accounts are in the local passwd file, and only user login accounts are in LDAP -- Works beautifully.

  • 1
    Our LDAP server has the whole company on it and I only want to restrict it to people who have an account, so that's where I use the local accounts... also if I remove them from passwd I would have to get the home directory, bash, etc from LDAP which doesn't have that information at the moment – Arun Persaud Oct 29 '10 at 21:02

I've run into this scenario before with an LDAP server I set up.

The best advice I can give is to offer what worked for me. That would be to use /etc/security/access.conf to allow only certain users and groups access.

E.g., here's an entry for access.conf to deny access to everyone except for root and users belonging to Group1 and Group2, when trying to login locally using the loopback interface:

- : ALL EXCEPT root Group1 Group2:

You might also need to enable the pam_access.so module in your PAM files.


The easiest way I can think of right now is to set the local passwords for the "LDAP only" users to something completely weird and not tell them. However, once they have logged in, they would be able to change it (if your PAM setup allows them to do so).

A much more sophisticated way would be to write your own PAM plugin (which is apparently not all that difficult to do) which could perform a lookup into a "LDAP only" list and then return either true or false. This could then be used in the PAM config files to decide the next step, i.e. allow login or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.