4

I've successfully configured LDAP and SSH. Also I've added a requirement that user should be in a group called admin. That works.

/etc/ldap.conf

...
pam_groupdn cn=admin,ou=Groups,dc=example,dc=com
...

/etc/pam.d/sshd

...default ubuntu values here...
...
auth     required pam_ldap.so
account  required pam_ldap.so
password required pam_ldap.so
session  required pam_ldap.so

BUT I would like to add an exception for local backup user in emergency case when LDAP is not reachable. This user has sudo and authorized_keys. How can I achieve that?

Right now I can see only this error message:

sshd[12345]: fatal: Access denied for user backup by PAM account configuration [preauth]
1

Thanks for our German friends from https://forum.ubuntuusers.de/topic/pam-so-konfigurieren-dass-lokale-user-nicht-am/. The solution is:

# Allow local user or LDAP user from admin group
account sufficient pam_localuser.so
account required   pam_ldap.so
  • 3
    Can you be more specific? Which file should this be in? – Ev. Oct 27 '17 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.