Ubuntu – libpam-ldap or libpam-ldapd

authenticationdebianldappamUbuntu

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?

Best Answer

I am very fond of libpam-ldapd, have been using it for a year now in production on quite a few Ubuntu servers. I can recommend it over libpam-ldap.

The project is originally called nss-pam-ldapd and on its homepage you can find a list of its biggest advantages over the old libpam-ldap package.

Edit: In conjunction with libpam-ldapd on Ubuntu you should also look into the auth-client-config package to correctly configure PAM et al.

Related Solutions

Linux – libpam-ldapd not looking for secondary groups

I believe the map group parameter needs to be associated with a corresponding filter group parameter. Here's how I use it connecting to Active Directory:

filter passwd (&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=Linux-SA,OU=Groups,DC=global,DC=example,DC=com)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
map    passwd uid              sAMAccountName
map    passwd homeDirectory    unixHomeDirectory
map    passwd gecos            displayName
map    passwd loginShell       "/bin/bash"
filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    shadow uid              sAMAccountName
map    shadow shadowLastChange pwdLastSet
filter group  (&(objectClass=group)(gidNumber=*))
map    group  uniqueMember        member

Linux – validate only one user with pam ldap and nslcd

You can control who logs into a server (regardless of the source of the user database) with the /etc/security/access.conf file. For this mechanism, you need to enable the pam_access module (generally for the account stage). Either in /etc/pam.d/common-account for all services, or something like /etc/pam.d/sshd to make it only effective to ssh connections.

Check the man pages for access.conf and pam_access for the details.

Best Answer

Related Solutions

Linux – libpam-ldapd not looking for secondary groups

Linux – validate only one user with pam ldap and nslcd

Related Topic