How to allow Linux PAM Authentication for non-Local users

Linux PAM authentication for non-local users is configured by enabling the pam_ldap.so or pam_sss.so modules in the /etc/pam.d/common-auth file. This allows remote systems to validate credentials against an LDAP directory or Active Directory without storing passwords locally on the Ubuntu server.

Understanding PAM and Non-Local Authentication

The Pluggable Authentication Modules (PAM) framework in Linux provides a flexible way to handle user authentication. By default, most Ubuntu servers rely on local password files stored in /etc/shadow. However, in enterprise environments, it is common to centralize identity management using Lightweight Directory Access Protocol (LDAP) or System Security Services Daemon (SSSD).

When you need to allow non-local users to authenticate, you are essentially telling the system to check with an external source before granting access. This is critical for scenarios where you have hundreds of users managed centrally, and you do not want to create individual local accounts for each one. The configuration involves modifying specific PAM stack files that dictate how authentication requests are processed.

Choosing Between LDAP and SSSD

Historically, direct LDAP integration via pam_ldap was the standard approach. However, modern Ubuntu distributions often prefer SSSD due to its robust caching capabilities and better handling of network interruptions. If your environment uses Active Directory, SSSD is generally the recommended path. For pure LDAP directories, both methods work, but pam_sss is increasingly becoming the default choice in newer releases because it integrates seamlessly with systemd and provides offline login support if configured correctly.

Before proceeding, ensure your network interfaces are properly configured to reach the authentication server. You can verify connectivity and interface status by reviewing guides on Ubuntu Server Network Interfaces. Without stable network access, PAM authentication will fail or hang indefinitely, causing login timeouts.

Installing Required Packages

To begin, you must install the necessary packages that provide the PAM modules. For LDAP-based authentication, the package is typically libpam-ldapd which includes the nss-ldapd components for name service switching. If you are using SSSD, you will need sssd and libnss-sss.

sudo apt update
sudo apt install libpam-ldapd nss-ldapd
# OR for SSSD:
sudo apt install sssd libnss-sss libpam-sss

During installation, you may be prompted to configure basic settings such as the URI of your LDAP server and the base DN. Follow the prompts carefully to ensure the initial configuration is correct. Incorrect URIs here will prevent any subsequent PAM changes from working.

Configuring PAM Stacks

The core of this setup lies in editing the PAM configuration files located in /etc/pam.d/. There are two main files to consider: common-auth and common-session. The common-auth file controls the actual verification of passwords, while common-session manages resource allocation upon successful login.

Edit the common-auth file using a text editor like nano or vim:

sudo nano /etc/pam.d/common-auth

You need to add a line that instructs PAM to use the LDAP or SSSD module. For LDAP, the line typically looks like this:

auth sufficient pam_ldap.so try_first_pass

For SSSD, it would be:

auth sufficient pam_sss.so try_first_pass

The keyword sufficient is important. It means that if this module succeeds, no further authentication checks are needed. If it fails, the system falls back to other methods, such as local password verification. Place this line near the top of the file, but below the standard pam_unix module if you want to prioritize local users, or above it if you want to prioritize remote users. A common practice is to place it after pam_unix so that local root users can still log in even if the LDAP server is down, preventing lockouts.

Similarly, edit /etc/pam.d/common-session to include session management for these users:

session required pam_mkhomedir.so umask=0022 skel=/etc/skel

This optional step ensures that home directories are created automatically when a non-local user logs in for the first time. Without this, users might not have a writable home directory, leading to permission errors.

Verifying Configuration and Testing

After saving the changes, test the configuration immediately. Do not close your current terminal session until you have verified that a new SSH connection works. Opening a second terminal window is highly recommended as a safety net.

Try logging in with a non-local user account:

ssh username@your-server-ip

If the login fails, check the system logs for detailed error messages. The primary log file for PAM events is /var/log/auth.log. Look for entries related to pam_ldap or pam_sss to identify whether the issue is a network timeout, a credential mismatch, or a misconfiguration in the PAM stack.

Note that restarting the SSH daemon (sshd) is generally unnecessary for PAM configuration changes. PAM is loaded dynamically by services at runtime. Restarting services can sometimes cause brief disruptions and is not required for the changes in /etc/pam.d/ to take effect. Instead, simply testing a new connection is sufficient to apply the new rules.

Troubleshooting Common Issues

If you encounter issues, ensure that the LDAP server is reachable and that the firewall allows traffic on port 389 (LDAP) or 636 (LDAPS). Also, verify that the nsswitch.conf file is configured to use LDAP or SSSD for group and password lookups. If you are experiencing dependency errors during installation, refer to resources on installing missing libraries on Ubuntu, as outdated SSL libraries can sometimes interfere with secure LDAP connections.

Frequently Asked Questions

Can I use both local and LDAP authentication?

Yes, by configuring the PAM stack with multiple modules, you can allow both local and remote users. Using the sufficient flag for the LDAP module ensures that if LDAP authentication succeeds, the process stops, but if it fails, it falls back to local authentication.

Why are my home directories not created automatically?

PAM does not create home directories by default. You must explicitly add the pam_mkhomedir.so module to the common-session file. Ensure the module is present and that the target filesystem has sufficient permissions for the creation process.

Does changing PAM configurations require a reboot?

No, a reboot is not required. PAM modules are loaded into memory by the services that use them, such as SSH or Login. Changes take effect immediately for new sessions. Always test with a new SSH connection rather than relying on your existing session.

What is the difference between pam_ldap and pam_sss?

pam_ldap connects directly to an LDAP server for every authentication request. pam_sss communicates with the SSSD daemon, which caches credentials and user information. SSSD is preferred in modern setups because it handles network failures more gracefully and supports offline logins.

How do I debug PAM authentication failures?

Check the /var/log/auth.log file for detailed error messages. Enable verbose logging in your PAM configuration if necessary, but usually, the standard logs provide enough information to identify network issues, syntax errors, or credential mismatches.