New answers tagged

2

A combination of success=1 and pam_rootok.so should work: auth [success=1,default=ignore] pam_rootok.so auth optional MODULE From man 5 pam.conf: For the more complicated syntax valid control values have the following form: [value1=action1 value2=action2 ...] Where valueN corresponds to the return code from the function invoked in the ...


1

Using access.conf to prevent ssh, and only ssh, logins does not work. However, it can be accomplished by using pam_access with another config file. Firstly, PAM must be configured to use pam_access. It might not be by default. There should be a line with account required pam_access.so in the sshd PAM config, likely via the password-auth configuration file,...


2

The way PAM works is that it follows every line until the end (or until it short-circuits with a particular failure). Each of those keywords says how the authentication step is treated. What you want is to tell it that LDAP authentication is acceptable for authentication. So you need to put your pam_ldap.so line PRIOR to that final line. That says that ...


0

With sshd you need to explicitly configure it to use PAM UsePAM Enables the Pluggable Authentication Module interface. If set to yes this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types. ...


1

At the end of your /etc/pam.d/common-session, there seems to be a (partial?) copy of /etc/nsswitch.conf: # end of pam-auth-update config passwd: compat systemd nis <-- group: compat systemd nis <-- These lines definitely shadow: compat nis <-- don't belong here! gshadow: files <-- ...


Top 50 recent answers are included