I've found that I need to set:
shadow: files ldap group: files ldap
in my /etc/nsswitch.conf to get this to work (Redhat ES2.1). However, I don't want shell logins on the system to be authenticated through LDAP. That is, while I want to accept LDAP users for httpd authentication, I don't want to accept such users for login to the system (Web authors are a small subset of those who authenticate through httpd).
What I find is that if I leave my nsswitch.conf as:
passwd: files
then users that are not in my /etc/passwd file can't authenticate through httpd (/etc/pam.d/httpd:
_____________________________
#%PAM-1.0
auth sufficient /lib/security/pam_ldap.so auth required /lib/security/pam_deny.so _____________________________
). The error I see is:
[Wed Sep 29 18:06:27 2004] [error] (2)No such file or directory: access to /projects/www-test/group-staff/ failed for 128.55.16.133, reason: User not known to the underlying authentication module
Not surprisingly I also see:
Sep 28 16:14:29 rohanb httpd(pam_unix)[20895]: could not identify user (from getpwnam(jed))
in /var/log/messages. If I call getpwnam then I don't see a passwd entry. This is as I expect
and want as I don't want users from LDAP logging into the system. However, I do want to be
able to have users coming in through Apache to authenticate.
If I authenticate a user that is in my /etc/passwd file then the authentication works - with the password stored in the LDAP server.
If I change my nsswitch.conf to include:
passwd: files ldap
then httpd authentication works through LDAP, but LDAP users also are able to login to my Web server -
which is not what I want.
I wondered if anybody might have any thoughts on how I can get PAM to do what I need. At this point I'm
stuck and considering switching to mod_auth_ldap. I would prefer staying with PAM because of its greater
flexibility, but if I can't get it to do what I need then of course I need to do something else. Perhaps somebody
might be able to point me to a discussion of the binding between PAM and nsswitch? Is this a case
where I'm trying to do something that isn't possible? Ideally I would like to be able to accept LDAP
passwords for users that are in my /etc/passwd file for logins.
--Jed http://www.nersc.gov/~jed/
_______________________________________________ Pam-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/pam-list
