13

Background:
I'm not too familiar with the ins and outs of pam and LDAP authentication on a configuration side. I've used systems that use pam but I've only worked on applications, not systems themselves.

Questions:
Using pam to control authentication via LDAP, does this mean that a home directory will not be created on the system?

If not, would I create users on the server or somehow push users to the system from an LDAP source?

1

3 Answers 3

14

This is exactly what pam_mkhomedir was made for.
The pam_mkhomedir module can create the user's home directory upon login if that directory does not exist.

How to install it depends upon your distribution. But you would need to put it in one or more files in /etc/pam.d.
For example, on my system I have /etc/pam.d/system-login which is included by all other services which perform login (ssh, gdm, etc).
I would put pam_mkhomedir.so in the session stack, such as:

session     optional    pam_loginuid.so
session     required    pam_env.so 
session     optional    pam_lastlog.so 
session     include     system-auth
session     optional    pam_mkhomedir.so # <<< right here
session     optional    pam_ck_connector.so nox11
session     optional    pam_gnome_keyring.so auto_start
session     optional    pam_motd.so motd=/etc/motd

Where you put it is entirely dependent upon what else is in the stack. But you should put it before anything else which might need the home directory.

See man 8 pam_mkhomedir for the options it supports.

3
  • Awesome. Thanks for the answer. Our users currently don't log into the system, they log into a web application that is hosted on the system. Is there a trigger that can create their home directory upon an initial log in of the web app? May 20, 2014 at 21:26
  • 1
    If the web application uses the pam stack, then it would work (though you might have to put it in the auth stack instead of session). If the app does not use the pam stack, then you would have to build something into the application itself.
    – phemmer
    May 20, 2014 at 21:31
  • It looks like only the session module is provided, I have tried and, in fact, pam_mkhomedir is not working with the auth module. I have the same problem as Nicholas Anderson, I have a web application. Is there any way to solve this issue in the auth module? Apr 16, 2019 at 9:15
6

In Ubuntu 14.04 system-login is not present, but another file named as common-session is present.

I went there and put:

root@GW:~# vim /etc/pam.d/common-session

#
session optional        pam_systemd.so skel=/etc/skel/ umask=0077

This will create home directory if no exist also set the permission to 700

1
  • The umask suggested by help.ubuntu.com/community/LDAPClientAuthentication is umask=0022. I believe yours removes ALL capabilities including read which may prevent some key based authentication/trust mechanisms from working in a multi-user system or other cases.
    – dragon788
    Jul 12, 2017 at 18:52
1

I'd recommend using oddjob-mkhomedir:

For Centos 7 this works:

yum install oddjob-mkhomedir

Append this to /etc/pam.d/system-auth and /etc/pam.d/password-auth:

session     optional      pam_oddjob_mkhomedir.so skel=/etc/skel

And finally:

systemctl enable oddjob; systemctl start oddjob

This was posted originally here: https://www.centos.org/forums/viewtopic.php?t=48631

Note: If you just mounted your /home partition, don't forget to do restorecon /home

2
  • Thanks! Your restorecon /home note has just saved me after many hours of futile searching
    – Energya
    Dec 1, 2020 at 0:04
  • I'm running rasbian buster and there is no /etc/pam.d/system-auth or /etc/pam.d/password-auth. Could you possibly suggest where I might put the configuration line?
    – crobar
    Feb 1, 2021 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .