LDAP authentication on Debian

This article tries to sum up what is needed to use LDAP to authenticate users in your network. (If you want to switch from NIS to LDAP then purge the 'nis' package before going on.) Although the principle is simple there are a number of caveats.

Server

You need a database that you can query through LDAP. Let's use OpenLDAP for it:

aptitude install openldap

Clients

Install at least 'libnss-ldap':

aptitude install libnss-ldap

'NSS' means name server switch

Only root will have access to shadow passwords via NSS. The ldap PAM module will only be used for passwd, chfn, and chsh updating of LDAP contents. All posix passwords shall use md5 hashing.

Sources

Since there was apparently no document in english describing this setup properly (although there are virtually dozens of web pages trying to deal with this issue) I had to copy together a few sources and play around until everything worked. These are some URLs I read:

Also kudos to http://www.padl.com/ who wrote and published PAM-LDAP and NSS-LDAP unter the GPL.


WorkaroundOrg: LdapAuthenticationOnDebian (last edited 2007-05-04 17:29:49 by ChristophHaas)