I did set up a PAM authentication towards LDAP. It's all working correctly but I have an issue when I have both a local user and an ldap user with the same name but different UID.
I'm working on RH6 and currently my
password-auth are configured in this way:
session required pam_mkhomedir.so skel=/etc/skel umask=0002
ssosers user exists on
[root@localhost pam.d]# getent -s ldap passwd ssosers ssosers:x:20100:1000:ssosers:/home/ssosers:/usr/bin/sh
[root@localhost pam.d]# cat /etc/passwd | grep ssosers ssosers:x:50025:50025::/home/ssosers:/bin/bash
ssosers can login with both local passwod and ldap password. Please consider that they have different UID. The problem is when I delete the local user to force the authentication against ldap, the next time
ssosers will log in, the
pam_mkhomedir.so fails because the
/home/ssosers already exists and the user can't join to his home due to lack of permissions:
Last login: Mon Feb 19 17:01:00 2018 from 10.212.148.18 Could not chdir to home directory /home/ssosers: Permission denied -sh: /home/ssosers/.profile: Permission denied -sh-4.1$
Is there a way to change the permissions of the home directory of the
$PAM_USER if the pam_mkhomedir fails? I would like him to join his old home dir.
I came up with an easy solution. Basically run this script in order to look for the user over the LDAP, if I find it I delete the user and renew the UID of the home folder, if I don't find it I delete both the user and the home directory.
#!/bin/bash getent -s ldap passwd $1 > /dev/null if [ $? -eq 0 ]; then userdel $1 chown -R $1 /home/$1 else userdel -r $1 fi
But how can I add in the positive case a find based on the OLD UID (looking for other files with the OLD uid)?
By the time I do
userdel $1 the local UID (the old one) is no more resolved. This is the permission of the home directory of
ssosers's user after the delete:
drwx------ 3 50025 oinstall 1024 Feb 19 18:30 ssosers
That's why I have to renew the permission of the home with a chown, since the
passwd in the
nsswitch points first to
files and then to