<HTML><HEAD></HEAD>
<BODY>
<DIV id=idOWAReplyText73252 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=3>This works for my environment:</FONT></DIV>
<DIV dir=ltr><FONT face=Arial></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial>auth required pam_env.so<BR>auth sufficient pam_unix.so audit<BR>auth sufficient pam_ldap.so use_first_pass</FONT></DIV>
<DIV dir=ltr><FONT face=Arial># pam_ldap acct verifies host in ldap user's ACL and returns IGNORE if non-ldap.<BR># pam_unix acct succeeds w/o checking ACL if put 1st as pam_ldap auth would<BR># have already retrieved user's passwd and shadow info.<BR>account required pam_ldap.so ignore_unknown_user ignore_authinfo_unavail<BR>account required pam_tally.so deny=3 no_magic_root reset<BR>account sufficient pam_unix.so audit</FONT></DIV>
<DIV dir=ltr><FONT face=Arial>password requisite pam_cracklib.so retry=3 minlen=14 lcredit=-2 ocredit=-2 ucredit=-2 dcredit=-2<BR>password sufficient pam_ldap.so use_authtok<BR>password sufficient pam_unix.so use_authtok shadow md5 audit</FONT></DIV>
<DIV dir=ltr><FONT face=Arial># pam_ldap session, pam_sm_open_session(), closes any remaining ldap connection.<BR>session required pam_limits.so<BR>session required pam_mkhomedir.so skel=/etc/skel umask=0022<BR>session required pam_unix.so audit<BR>session required pam_ldap.so<BR></FONT></DIV></DIV>
<DIV dir=ltr>Kevin<BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Lynn York<BR><B>Sent:</B> Mon 9/22/2008 11:02 AM<BR><B>To:</B> Pluggable Authentication Modules<BR><B>Subject:</B> RE: Authentication problems with ldap<BR></FONT><BR></DIV>
<DIV><PRE style="WORD-WRAP: break-word">_______________________________________________
Pam-list mailing list
Pam-list@redhat.com
https://www.redhat.com/mailman/listinfo/pam-list</PRE></DIV></BODY></HTML>