On 06/02/2010, at 2:50 AM, Sean Carolan wrote: >> The problem is probably in pam. Lot s of internet docs have incorrect >> info advice and say. >> account required pam_nologin.so >> account sufficient pam_ldap.so >> >> When you do that you get the situation you have now. In some phases of >> login sufficient becomes required. >> >> Try this: > > Before I go changing system-auth by hand I would like to see if there > is some way to get it working with the authconfig tool. This makes it > easier for me to maintain consistency and configure multiple systems. > Here is what is in my system-auth file now, and this was generated > with the following command. Is the authconfig tool actually > generating a "bad" configuration file? If so should this be > considered a bug? > > #%PAM-1.0 > <snip> Sean, Your system-auth pam config looks correct to me, and as you said, authconfig shouldn't be generating 'bad' configs unless it contains a bug. Edward was suggesting a problem with the 'login' pam service, not system-auth, but I don't agree with his solution - I can't see how adding an explicit include of pam_ldap.so here for the account type is going to help, as by default this just defers to system-auth anyway. Edward, are you able to offer any more insight into how this can help? Regards, Tom
