I am trying to set up a Linux machine with LDAP authentication and root account enabled. There is no issue with the LDAP server and everything works fine.

I wanted to disable local users, so I tried editing PAM. I tried using pam-auth-update and unticking the "Unix authentication". Local users are successfully denied, but so is the root account.

I am now trying different things at the pam.d files, but it seems I screwed up multiple times and don't know what am I doing.

Editing the /etc/pam.d/common-auth file:

auth        sufficient  pam_rootok.so

After I added this line, there is no password prompt and it logs in directly.

auth     pam_succeed_if.so    uid = 0 quiet

I added this line and it does nothing. I am now reading the PAM configuration.  Could anyone help me understand and solve my problem?

  • Should that line have a sufficient in it?
    – muru
    Commented Mar 17, 2020 at 8:40

1 Answer 1


You can add something like this (at the beginning of the file) to prevent local users (except root) to login.

auth [success=1   default=ignore] pam_succeed_if.so uid = 0 quiet       
auth [success=die default=ignore] pam_localuser.so 

The first line skips the second line if root and the second prevents local users (in /etc/passwd) from login. Non-local users should not be affected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .