Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some custom built instances running in AWS EC2 that are configured with ldap authentication. I have now brought up one of the AWS-provided EC2 AMIs, and am trying to configure it to work with pam authentication. This is a relatively straight forward configuration, but for some reason, pam / ldap is not working. Here's a quick summary of how I have configured the instance, anything obvious I am missing?

Installed software (yum / rpm, over and above default, relevant to this setup): pam_ldap nss-pam-ldapd

Configuration: /etc/ldap.conf - configured with a copy of an ldap.conf from my custom-built AMI - identical parameters. The following parameters are used (values omitted, only relevant config shown - excluding ssl / tls config stuff):

ldap_version 3


nss_base_passwd (x 2 of these)



passwd:     files ldap
shadow:     files ldap
group:      files ldap


URI ldap://my-ldap-server
BASE dc=organization,dc=com

/etc/pam_ldap.conf - this file is only on the AWS-provided AMI. I copied the config from /etc/ldap.conf to this file to try get things working

/etc/pam.d/system-auth (showing context of +1 and -1 lines. Added lines indicated with a "+"):

auth        sufficient    pam_unix.so nullok try_first_pass
+ auth        sufficient    pam_ldap.so use_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet

account     sufficient    pam_localuser.so
+ account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     sufficient    pam_succeed_if.so uid < 500 quiet

password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
+ password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     required      pam_limits.so
+ session     optional      pam_mkhomedir.so skel=/etc/skel umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
+ session     optional      pam_ldap.so

To test, I try getend passwd or getent group and don't see any of my ldap-based entries.

any ideas as to where I am going wrong? /var/log/messages and secure don't give any indication of errors.

share|improve this question
something in the pam config maybe? – Brett May 3 '13 at 8:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.