我已经使用ldap身份验证设置了一台具有以下配置的linux机器（debian 6.0.7）：
的/etc/nsswitch.conf
passwd: compat ldap [NOTFOUND=return UNAVAIL=continue] db
group: compat ldap [NOTFOUND=return UNAVAIL=continue] db
shadow: compat ldap
将/etc/pam.d/common-account
# here are the per-package modules (the "Primary" block)
account [user_unknown=ignore authinfo_unavail=ignore default=ok] pam_unix.so
account [success=ok user_unknown=ignore authinfo_unavail=ignore default=ignore] pam_succeed_if.so uid < 1000 debug
account [success=done default=ignore authinfo_unavail=1] pam_ldap.so debug
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
将/etc/pam.d/common-auth
# here are the per-package modules (the "Primary" block)
auth [success=done default=ignore] pam_unix.so nullok_secure
auth requisite pam_succeed_if.so uid >= 1000 quiet
auth requisite pam_succeed_if.so gid >= 1000 quiet
auth requisite pam_succeed_if.so user notingroup root
auth requisite pam_succeed_if.so user notingroup wheel
auth [success=3 default=2 authinfo_unavail=ignore] pam_ldap.so use_first_pass
auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 action=validate use_first_pass
auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_ccreds.so minimum_uid=1000 action=store
# end of pam-auth-update config
/etc/pam.d/common-password
# here are the per-package modules (the "Primary" block)
password [success=2 default=ignore] pam_unix.so obscure sha512
password [success=1 user_unknown=ignore default=die authinfo_unavail=ignore] pam_ldap.so try_first_pass
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
# and here are more per-package modules (the "Additional" block)
password optional pam_gnome_keyring.so
# end of pam-auth-update config
/etc/pam.d/common-session
# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel umask=0022
session optional pam_ldap.so
# end of pam-auth-update config
在普通帐户中，如果ldap服务器不可用，我必须跳转到pam_permit，否则具有缓存凭据的用户无法进行身份验证，但我认为这不是一个好主意。
我也在运行nss_updatedb ldap来缓存passwd和groups。
一切正常，甚至脱机身份验证。问题是我在ldap上禁用用户（将shadowexpire设置为1）。当计算机处于联机状态时，身份验证系统会通知该帐户已被禁用，但当计算机处于脱机状态时，已禁用的用户可以使用缓存凭据进我相信这是因为影子信息没有被缓存。
是否可以缓存有关已禁用用户的影子信息，以便即使机器处于脱机状态也无法登录？
答案 0 :(得分：0)
pam_ccreds README表示目前不支持此功能。您可以重置用户的密码，而不是使用shadowexpire。
答案 1 :(得分：0)
感谢您分享您的配置！我从
更改了/etc/pam.d/common-account
account [user_unknown=ignore authinfo_unavail=ignore default=ok] pam_unix.so
到
account [success=done user_unknown=ignore authinfo_unavail=ignore default=ok] pam_unix.so
问题在于，当LDAP服务器不可用时，即使密码正确，本地用户也会被拒绝。 success = done 一旦pam_unix.so表示没问题就会终止链接。