On (18/03/14 17:42), kevin sullivan wrote:
Lukas,
Thank you for your quick response.
>You can use authconfig to configure pam-stack and nsswitch on CentOS/Fedora
>
>This is part of my /etc/pam.d/password-auth
>----------------------------------------------------------------------
>auth required pam_env.so
>auth sufficient pam_unix.so try_first_pass nullok
>auth requisite pam_succeed_if.so uid >= 1000 quiet_success
>auth sufficient pam_sss.so use_first_pass
>auth required pam_deny.so
You wrote in the 1st mail:
I only want to use the local Unix accounts (/etc/passwd and
/etc/shadow)
if my LDAP server is offline.
Do users from /etc/passwd have the same uid/name as
user from LDAP?
Won't this allow local accounts before network accounts? I only
want to
revert to local accounts if my ldap server is down.
Yes, local accounts have higher priority with this pam configuration.
I do not really understand what do you mean by "revert to local accounts if my
ldap server is down."
SSSD caches all information about authenticated users.
It will be possible to authenticate even if LDAP server is down.
LS