I am responsible for a couple of servers at my university. All of these machines are configured to talk to the LDAP server of my departement to allow centralised user logins. On this LDAP server there is a user named
# getent passwd | grep root root:x:0:0:root:/root:/bin/bash root:x:0:0:Netbios Domain Administrator:/home/root:/bin/false
Recently, I ran into issues with the
root account on one of the servers I am responsible for: My SSH connection attempt was successfully authenticated against the local
root user, but the home directory was taken from the LDAP as
/home/root. In addition I found out that one can authenticate as root with the LDAP's
root credentials on any server, i.e., if authentication against the local
root fails, the LDAP
root is tried and, given the password is correct, the user is logged in as superuser.
I believe this is not very secure and the ambiguity of the two
root accounts should be removed. However, according to our IT department, the LDAP
root is necessary.
How can I filter out the
root account from LDAP to disallow authentication with it? I am using
pam_ldap.so and also some ldap directives in