Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to create a configuration, where users in specified AD groups can log in. I'm having trouble stopping every AD user from logging in. I've been doing this though /etc/pam.d/sshd/ but is such a setup possible through /etc/pam.d/login? Wouldn't that be a safer option? I also really dislike winbind, and prefer the Kerberos+LDAP method, but unfortunately I'm not able to switch at this moment. I appreciate any help, as I've been reading for a while and have not found solid direction.

These are the current pam.d configuration files,


# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_winbind.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so


auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    optional     pam_keyinit.so force revoke
session    required     pam_loginuid.so
session    include      system-auth
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open


auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
account    sufficient   pam_succeed_if.so user ingroup DOMAIN\Group_1
account    sufficient   pam_succeed_if.so user ingroup DOMAIN\Group_2
account    sufficient   pam_succeed_if.so user ingroup DOMAIN\Group_3
password   include      system-auth
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    required     pam_loginuid.so
share|improve this question
up vote 0 down vote accepted

PAM Winbind, is configured from this file, /etc/security/pam_winbind.conf.

To restrict access to uers in specified groups, add this line require_membership_of = [SID],[SID],[SID]

Replace the [SID] with the proper AD User, or Group, SID. You can find out what users/groups are assigned which SIDs, with this command. wbinfo -n [NAME]

Replace [NAME] with the specified AD User, or Group, name.

However this entire winbind situation should not exist, as you should normally opt for the traditional Kerberos+LDAP method.

share|improve this answer

This might be an alternative, but on your Windows DC, you can install the Identity Management for Unix. Then for each user, you can right click > go to Unix attributes, and set whether they can login or not by setting the login shell from /bin/shell or /bin/bash to /bin/false

You will also need to add a line to the /etc/samba/smb.conf file:

winbind nss info = rfc2307

Hope someone will find this useful!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.