I have two Debian VMs. one is running an LDAP server and I'm trying to get the other to use libpam_ldap.

The client machine is able to get users from LDAP for the GUI login screen, but I can't ssh into the VM with users that are only in LDAP. I also can't su from the root user (local) to an LDAP user, but I assume it's the same problem.

On the client machine, I can use ldapsearch to look up the user I want...

ldapsearch  -x -D "cn=admin,dc=mydomain,dc=com" -W -b "uid=testuser,ou=People,dc=mydomain,dc=com"

This prompts me for the admin LDAP password, and returns my user record:

dn: uid=testuser,ou=People,dc=mydomain,dc=com
uid: testuser
cn: Test User
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: [removed for stackexchange posting ]
shadowLastChange: 17543
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1001
gidNumber: 1001
homeDirectory: /home/dwill
gecos: Test User,,,

(note, my domain isn't acutually "mydomain.com". I edited it for this posting)

But when I do getent passwd testuser, it doesn't return anything.

the /etc/nsswitch.conf has these lines

passwd:         files ldap
group:          files ldap
shadow:         files ldap

It used to have compat ldap for those but I tried changing it files because that's what one of the guides I found had. It didn't work either way.

The /etc/ssh/sshd_config has UsePAM yes set.

I have followed all the guides I can find via Google and I still can't get this working.

Any suggestions?

  • Does getent passwd return the full user list? Are you using the libpam-ldapd package (recommended over libpam-ldap)? Commented Jan 13, 2018 at 20:47

2 Answers 2


I found the problem. One of the guides I found on Google instructed me to do

apt-get libnss-ldap libpam-ldap nslcd

I also later found an article that said that libpam-ldapd is newer than libpam-ldap and installed that instead.

libnss-ldap prompts you for some configuration and creates a /etc/libnss-ldap.conf file. Then libpam-ldap uninstalls libnss-ldap but leaves its config file behind. Apparently that config file is still meaningful because that's the one it's using and I had an error in the binddn in that file. After fixing the binddn, it worked.

I really don't know why you'd install both of those ldap modules. After getting the first client VM working, I setup another client VM using just libpam-ldapd and nslcd and it worked first time.


Ensure you have a /etc/pam.d/sshd with the following content:

auth    sufficient      pam_ldap.so
account sufficient      pam_permit.so

Then, run sudo /usr/sbin/pam-auth-update and you restart the sshd service.

  • It includes the common-auth and common-account files which both are configured to have those. I tried putting them in /etc/pam.d/sshd also anyway but it didn't help. Also, the LDAP users don't show up when you do getent passwd either.
    – dwilliss
    Commented Jan 14, 2018 at 0:39
  • Also, the LDAP users don't show up when you do getent passwd either. <---- this means your LDAP config is incorrect!
    – thecarpy
    Commented Jan 14, 2018 at 9:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .