My authentication is centralized in a LDAP. I've one login system who is working without any ldap so it's present in my /etc/passwd file. This my common-account file in pam.d directory.

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 10000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

I've no problem with this but I would like to know if this file is ordered well because on some documentation the pam_ldap.so configuration line is the first.

Thanks for answer.

1 Answer 1


Yes, it seems to be correct (except you should probably be using auth and not account). Let's take each line one by one:

auth     required      pam_unix.so

Here, you enter the chain through pam_unix (standard password authentication). This module is required which means that whatever happens, the chain will continue further down. However, if this module fails, the chain will be marked as failed, and the user is likely to be denied access eventually.

auth     sufficient    pam_succeed_if.so uid < 10000 quiet

This line checks the requested UID. If the module succeeds (the user ID is below 10000), the chain will stop because the module is sufficient. However, this does not change the mark set by the previous required module: if UNIX authentication had failed, the chain will end with a failure, even if pam_succeed_if is successful.

auth     [default=bad success=ok user_unknown=ignore] pam_ldap.so

If we are here, pam_succeed_if must have failed (because it did not put an end to the chain as a sufficient module). This means that we are above UID 10000 (which I believe is the threshold you set for LDAP users). The behaviour of this module is a bit more detailed:

  • If it succeeds, the chain is marked as successful (ok). This will counter the result of the UNIX module and bring the chain back into a successful state.
  • If the user is unknown to the LDAP server, the module will be ignored. Your chain's result will be that of pam_unix.
  • In all other cases (default), the module marks the chain as failed (bad), whether UNIX succeeded or not.

Finally, you have a dummy module:

auth     required      pam_permit.so

This module succeeds everytime. It is used to set the state of the chain to success if no module has acted upon it earlier. It is never your case though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .