1

I have configured LDAP and it works incredibly fine. However if the network is down, there is no one to use a machine, even if a local user is registered. Is it possible to allow local users to login when LDAP is not reachable? Or allow both LDAP and local authentication?

/var/log/auth.log has this:

Oct 27 11:30:36 trento lightdm: PAM adding faulty module: pam_kwallet5.so
Oct 27 11:30:36 trento lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "localadmin"
Oct 27 11:30:39 trento lightdm: PAM unable to dlopen(pam_kwallet.so): /lib/security/pam_kwallet.so: cannot open shared object file: No such file or directory
Oct 27 11:30:39 trento lightdm: PAM adding faulty module: pam_kwallet.so
Oct 27 11:30:39 trento lightdm: PAM unable to dlopen(pam_kwallet5.so): /lib/security/pam_kwallet5.so: cannot open shared object file: No such file or directory
Oct 27 11:30:39 trento lightdm: PAM adding faulty module: pam_kwallet5.so
Oct 27 11:30:39 trento lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "ldapuser"
Oct 27 11:30:41 trento lightdm: pam_unix(lightdm:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost=  user=ldapuser
Oct 27 11:30:41 trento lightdm: pam_unix(lightdm-greeter:session): session closed for user lightdm
Oct 27 11:30:45 trento systemd-logind[857]: Removed session c20.
2

Yes it is possible and is the default for Ubuntu. Did you configure PAM by hand? Here is what Ubuntu uses in /etc/pam.d/common-auth:

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

The first line allows local authentication.

  • Yeah, the file is like that. After entering the credentials for the local user the screen gets black and returns to the login page. I thought it was an authentication error but it must be something else then. Any ideas? – Ev. Oct 30 '17 at 12:06
  • The user doesn't have a home directory either, that must be the issue, but I can't create one either. Probably because LDAP is remotely mounting it? But would that make the whole /home unwritable? – Ev. Oct 30 '17 at 12:18
0

you should take a look at sssd, it allows caching login information for road warriors for instance.

You need to have at least two ldap servers as well for redundancy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.