pam_unix succeeds unexpectedly with libnss-ldapd

[Christopher Price <Christopher.Price [at] esentire.com>]

I am attempting to replace libnss-ldap with libnss-ldapd. I am running Ubuntu 16.04 and controlling LDAP access via the pam_listfile module in /etc/pam.d/common-account.

/etc/pam.d/common-auth

auth    required     pam_env.so envfile=/etc/default/locale
auth    sufficient      pam_unix.so nullok_secure
auth    required        pam_ldap.so use_first_pass

/etc/pam.d/common-account

account sufficient pam_unix.so

account required pam_listfile.so _onerr_=fail item=group sense=allow file=/etc/login.group.allowed

account required pam_ldap.so

This works fine with libnss-ldap. When I switch to libnss-ldapd, LDAP users who are not part of a group listed in login.group.allowed are able to login via SSH. I have narrowed the problem down to specifically the pam_unix module in common-account. Note that the pam_unix in common-auth does NOT succeed.

What am I doing wrong here?

-- 
To unsubscribe send an email to
nss-pam-ldapd-users-unsubscribe@lists.arthurdejong.org or see
https://lists.arthurdejong.org/nss-pam-ldapd-users/