Yes, it seems to be correct (except you should probably be using
auth and not
account). Let's take each line one by one:
auth required pam_unix.so
Here, you enter the chain through
pam_unix (standard password authentication). This module is
required which means that whatever happens, the chain will continue further down. However, if this module fails, the chain will be marked as failed, and the user is likely to be denied access eventually.
auth sufficient pam_succeed_if.so uid < 10000 quiet
This line checks the requested UID. If the module succeeds (the user ID is below 10000), the chain will stop because the module is
sufficient. However, this does not change the mark set by the previous
required module: if UNIX authentication had failed, the chain will end with a failure, even if
pam_succeed_if is successful.
auth [default=bad success=ok user_unknown=ignore] pam_ldap.so
If we are here,
pam_succeed_if must have failed (because it did not put an end to the chain as a
sufficient module). This means that we are above UID 10000 (which I believe is the threshold you set for LDAP users). The behaviour of this module is a bit more detailed:
- If it succeeds, the chain is marked as successful (
ok). This will counter the result of the UNIX module and bring the chain back into a successful state.
- If the user is unknown to the LDAP server, the module will be ignored. Your chain's result will be that of
- In all other cases (
default), the module marks the chain as failed (
bad), whether UNIX succeeded or not.
Finally, you have a dummy module:
auth required pam_permit.so
This module succeeds everytime. It is used to set the state of the chain to success if no module has acted upon it earlier. It is never your case though.