I am trying to setup a Linux machine with LDAP authentication and root account enabled. There is no issue with the LDAP server and everything works fine.

I wanted to disable local users so I tried editing PAM. I tried using pam-auth-update and untick the "Unix authentication". Local user successfully denied but so do root account.

I am now trying different things at the pam.d files but it seems I screw up multiple times and don't know what am I doing.

Editing the /etc/pam.d/common-auth file

auth sufficient pam_rootok.so

I added this line, then there is no password prompt and it login directly

auth pam_succeed_if.so uid = 0 quiet

I added this line and it does nothing I am now reading the pam configuration so anyone could help me understand and solve my problem?

| improve this question | | | | |
  • Should that line have a sufficient in it? – muru Mar 17 at 8:40

You can add something like this (at the beginning of the file) to prevent local users (except root) to login.

auth [success=1   default=ignore] pam_succeed_if.so uid = 0 quiet       
auth [success=die default=ignore] pam_localuser.so 

The first line skips the second line if root and the second prevents local users (in /etc/passwd) from login. Non-local users should not be affected.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.