0

I created a normal linux user (on Raspbian Buster). Now I have set up an LDAP directory and would like this user to instead authenticate using LDAP. I added a user to the directory with the same user name, thinking LDAP would then take precedence, however, it does not seem to be the case and the local account is taking precedence.

I can successfully log in as another LDAP user which was never a local user.

How can I convert this user to an LDAP user without deleting all the user's data?

2
  • Do you only use pam_unix for login or do you also have some ldap module for PAM configured?
    – stefan0xC
    Mar 11 at 13:19
  • I have an ldap module for PAM I think, I used the default setup
    – crobar
    Mar 11 at 13:48
1

If you don't need the local user, you can run userdel user to remove the local user. If you don't specify the -r or -f flags the users home directory should be left intact. (You can also manually remove the user from /etc/passwd).

After the deletion you can run getent passwd user to check if the entry from LDAP is returned. (Note: As far as I know userdel will not delete the LDAP entry but to be safe you can disable the LDAP service in /etc/nsswitch.conf before running userdel.)

Lastly you should probably run chown -R user:user /home/user to set the correct uid/gid of the LDAP user (if they differ).

The precedence is defined by the order in /etc/nsswitch.conf.

I think, it's also possible to authenticate a LDAP user via PAM which also has a local /etc/passwd entry and define the precedence of the authentication in PAM but I am not sure if I would recommend this.

3
  • Thanks I will try this later, will this delete a user's crontab?
    – crobar
    Mar 11 at 13:47
  • No. But if you have a crontab file for the user, you should probably also chown user:crontab /var/spool/cron/crontabs/user.
    – stefan0xC
    Mar 11 at 16:15
  • Finally tried this and it worked thanks.
    – crobar
    Mar 19 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.