This article will guide you through the process of troubleshooting a common issue with Alpine Linux when using LDAP and PAM for authenticating user accounts, specifically when a user cannot use the SUDO command. We'll cover key concepts, provide detailed context, and offer solutions to help you resolve this problem.
Prerequisites
You have already installed the nss-pam-ldapd package on your Alpine Linux server, edited the /etc/nslcd.conf file to point to your LDAP server running elsewhere, and added "UsePAM yes" to your /etc/ssh/sshd_config file.
Issue: Can't SUDO Login with LDAP/PAM Accounts
In Alpine Linux, using SUDO with LDAP/PAM accounts can sometimes fail due to configuration errors or permission issues. This article focuses on resolving such problems.
1. Verify LDAP and PAM Configuration
Ensure that your LDAP and PAM configurations are correctly set up. Check that the nslcd.conf file points to your LDAP server, and that the sshd_config file contains "UsePAM yes":
/etc/nslcd.conf/etc/ssh/sshd_config
[dnslcd]
uri ldap://your_ldap_server
base dc=your_domain,dc=com
# Other settings for your LDAP server
2. Check the SUDOERS File
The SUDOERS file is located at /etc/sudoers. Use the visudo command to edit it. Verify that there's a line specifying the LDAP group or specific LDAP users who can use SUDO:
# Add a line like this, replacing 'ldap_group' with an actual group name
%ldap_group ALL=(ALL) ALL
3. Verify PAM Configuration for SUDO
The PAM configuration for SUDO is located at /etc/pam.d/sudo. Make sure it has the following lines:
# Add these lines if they're missing
auth sufficient pam_ldap.so
account sufficient pam_ldap.so
4. Confirm LDAP User Mapping
Check if LDAP users are properly mapped in the system. You can list all LDAP users using this command:
getent passwd | grep ldap
Solution: Reconfigure PAM for SUDO
Sometimes, the PAM configuration for SUDO might not properly load the LDAP module. In such cases, you need to reconfigure PAM for SUDO.
apk add pam_ldap
# Backup the current file
cp /etc/pam.d/sudo /etc/pam.d/sudo.backup
# Create a new file and use the following content
cat > /etc/pam.d/sudo <
- Verify LDAP and PAM configurations.
- Check the SUDOERS file.
- Confirm PAM configuration for SUDO.
- Ensure that LDAP users are properly mapped.
- Reconfigure PAM for SUDO if required.
References
-
Alpine Linux Package Database - pam_ldap
https://pkgs.alpinelinux.org/package/v3.16/community/x86/pam_ldap
-
Manpage - nslcd.conf
https://man.openbsd.org/nslcd.conf
-
Manpage - sudoers
https://man.openbsd.org/sudoers.5