Linux with winbind, disable local users while AD is available

active-directorypamwinbind

Routers and switches with RADIUS authentication can be configured such that login is disabled for locally configured users as long as the RADIUS server is available. If the RADIUS server becomes unavailable, they fall back to allowing login as a locally configured user.

Is it possible to achieve the same effect with Linux machines using winbind to authenticate Active Directory users? I have a feeling it could be done with the right PAM configuration, but I'm not very far along on the PAM learning curve…

Best Answer

Yes, it is possible.

Basically you will need to make sure that you have pam_unix below pam_winbind in your pam config like in following example:

auth       required     /lib/security/pam_securetty.so
auth       sufficient   /lib/security/pam_winbind.so
auth       sufficient   /lib/security/pam_unix.so use_first_pass
auth       required     /lib/security/pam_stack.so service=system-auth
auth       required     /lib/security/pam_nologin.so
account    sufficient   /lib/security/pam_winbind.so
account    required     /lib/security/pam_stack.so service=system-auth
password   required     /lib/security/pam_stack.so service=system-auth
session    required     /lib/security/pam_stack.so service=system-auth
session    optional     /lib/security/pam_console.so

You will also need to make sure nsswitch is configured to fall back to local ids:

passwd:     winbind files
shadow:     winbind files
group:      winbind files

There are detailed docs on samba website:

BUT: you may face some problems with long login times if you won't set up hard timeouts. I would also recommend to research for other alternatives that may work better in such cases.

Related Topic