Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I managed to set up my system to use either LDAP or the local password (by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards). However I would like to restrict a certain group of users to be able to only use LDAP and not have the fallback of pam_unix2.so. Is there way of doing this?

share|improve this question

2 Answers

up vote 0 down vote

I don't think there is any point in having local accounts for users that are in LDAP, since all the needed information can be loaded from LDAP anyways. If you remove the local accounts for the users who should only log in through LDAP, then won't that fix this problem?

share|improve this answer
got an answer for this on serverstack (where I should probably have posted this question in the first place). The solution is to add a group of "ldaponly" users and then add "auth default=1 success=ignore] pam_succeed_if.so user notingroup ldaponly" before the pam_unix2.so line... LDAP is mostly used for email here, so we don't have all the information (e.g. login bash, home directory, etc) in it, but I like to use it for password verification (and only that). Thanks for he comment though. – Arun Oct 29 '10 at 21:09
up vote 0 down vote accepted

in case this is intersting for others, I found the answer here:

http://serverfault.com/questions/196255/how-to-allow-a-certain-group-of-useres-to-only-login-via-ldap-while-others-can-us

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.