Currently, I am configuring LDAP client for user authentication on the server. Only SSH key authentication is allowed (Password authentication is not allowed).

My SSH configurtion (/etc/ssh/sshd_config)

PermitRootLogin no
AuthorizedKeysCommand /path/to/getsshkey.sh
AuthorizedKeysCommandUser root
PasswordAuthentication no

My other config files:

I have added following line in /etc/pam.d/common-auth

auth    required    pam_access.so

I have added the following line in /etc/pam.d/sshd

account required pam_access.so

I have added the following line in /etc/security/access.conf

-: ALL EXCEPT root (group1) (group2): ALL except LOCAL

I have also configured all these files (/etc/ldap.conf, /etc/nsswitch.conf, /etc/pam.d/common-session)

For an example username1 belong to group1

when I execute this command

ssh -i private.pem username1@ip_address

I get below error in auth.log on the server

Access denied for user username1 by PAM account configuration [preauth]

Why is access denied?

Please help me

  • 1
    ALL except LOCAL denies all logins except local ones. SSH is not local login.
    – Jakuje
    Mar 20, 2016 at 9:38
  • but when add user instead of group name then it works eg -: ALL EXCEPT root username1: ALL except LOCAL Mar 22, 2016 at 14:44

2 Answers 2


change the DNS NAME or set DNS NAME in customization.login the client machine change the Host-name hostnamectl set-hostname.


personally I would use the nss_base_<map> directives as they are a bit more flexible and work with pam filters. however, since you are this far down the road, here is a good way to pinpoint your issue:

1st verify your LDAP information using the following commands

$ id
$ id YOURUSERNAME (will not show additional groups)

$ getent passwd
$ getent shadow
$ getent group

next check your pam filter configurations in /etc/ldap.conf and make sure the hostnames match

see the LDAP docs for more information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.