Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working for an university. I can access the University LDAP server but can't modify anything (it's readonly to me). I have several Linux machines, I want to config all the machines to authenticate via the university LDAP. (that's pretty easy, right?). Problems are:

Only a subset of LDAP users are allow to log in to the machine, (I know it can be done via LDAP group or additional LDAP attribute, but I can't modify anything in the university LDAP) Some users may not be in the LDAP but have accounts on the machine My thought is: use the /etc/passwd as the user-list: if (a user is NOT in the list) { he can't log in, } else { if(he is in LDAP) { check his password again the university LDAP } else { check his password againt /etc/shadow } }

Is there any solution? Any help appreciated.

share|improve this question
up vote 0 down vote accepted

For allowing only a subset of LDAP users to login:

  1. If you have a way to filter them without modifying the LDAP server, then you can add the filter to your /etc/nslcd.conf file, e.g.:

    filter passwd (objectClass=localAccount)
  2. Otherwise, you'll have to allow all LDAP users as local users and grant permissions just to the ones that you want, e.g., by changing /etc/security/access.conf and/or /etc/ssh/sshd_config.

For having additional local users, on top of those from the LDAP server, you'll need your /etc/nsswitch.conf file to contain something like:

passwd: files [unavail=return] ldap
group:  files [unavail=return] ldap
shadow: files ldap

I hope I'm not forgetting something...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.