Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I managed to set up my system to use either LDAP or the local password (by adding "password sufficient" to PAM and calling "" afterwards). However I would like to restrict a certain group of users to be able to only use LDAP and not have the fallback of Is there way of doing this?

share|improve this question

I don't think there is any point in having local accounts for users that are in LDAP, since all the needed information can be loaded from LDAP anyways. If you remove the local accounts for the users who should only log in through LDAP, then won't that fix this problem?

share|improve this answer
got an answer for this on serverstack (where I should probably have posted this question in the first place). The solution is to add a group of "ldaponly" users and then add "auth default=1 success=ignore] user notingroup ldaponly" before the line... LDAP is mostly used for email here, so we don't have all the information (e.g. login bash, home directory, etc) in it, but I like to use it for password verification (and only that). Thanks for he comment though. – Arun Oct 29 '10 at 21:09
up vote 0 down vote accepted

in case this is intersting for others, I found the answer here:

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .