2

This is an example of the /etc/pam.d/sshd configuration file on a FreeBSD 11.0 freshly-installed system:

#
# $FreeBSD: releng/11.0/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $
#
# PAM configuration for the "sshd" service
#

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
#auth           sufficient      pam_krb5.so             no_warn try_first_pass
#auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            required        pam_unix.so             no_warn try_first_pass

# account
account         required        pam_nologin.so
#account        required        pam_krb5.so
account         required        pam_login_access.so
account         required        pam_unix.so

# session
#session        optional        pam_ssh.so              want_agent
session         required        pam_permit.so

# password
#password       sufficient      pam_krb5.so             no_warn try_first_pass
password        required        pam_unix.so             no_warn try_first_pass

I would like to configure this file in an OpenLDAP client, which should use LDAP in order to let remote users login. This guide says to put somewhere the line

auth  sufficient  /usr/local/lib/pam_ldap.so  no_warn

I've read this document and this one; I tried to put this line before the pam_unix.so line in the auth section, but my client doesn't work and I don't know PAM very well.

1) Is that line correct? Where should that line be put in the auth section?

2) Should that line be put also in one or more other sections?

1 Answer 1

2

The way PAM works is that it follows every line until the end (or until it short-circuits with a particular failure). Each of those keywords says how the authentication step is treated.

What you want is to tell it that LDAP authentication is acceptable for authentication. So you need to put your pam_ldap.so line PRIOR to that final line. That says that LDAP authentication is sufficient for authentication.

auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
#auth           sufficient      pam_krb5.so             no_warn try_first_pass
#auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            sufficient  /usr/local/lib/pam_ldap.so  no_warn
auth            required        pam_unix.so             no_warn try_first_pass

If you want more details, the best place to look is the manual page for pam.d or pam.conf in section 5 of the manual:

% man 5 pam.d

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .