12

Background:
I'm not too familiar with the ins and outs of pam and LDAP authentication on a configuration side. I've used systems that use pam but I've only worked on applications, not systems themselves.

Questions:
Using pam to control authentication via LDAP, does this mean that a home directory will not be created on the system?

If not, would I create users on the server or somehow push users to the system from an LDAP source?

Nicholas Anderson
  • 233
  • 1
  • 2
  • 6

3 Answers3

14

This is exactly what pam_mkhomedir was made for.
The pam_mkhomedir module can create the user's home directory upon login if that directory does not exist.

How to install it depends upon your distribution. But you would need to put it in one or more files in /etc/pam.d.
For example, on my system I have /etc/pam.d/system-login which is included by all other services which perform login (ssh, gdm, etc).
I would put pam_mkhomedir.so in the session stack, such as:

session     optional    pam_loginuid.so
session     required    pam_env.so 
session     optional    pam_lastlog.so 
session     include     system-auth
session     optional    pam_mkhomedir.so # <<< right here
session     optional    pam_ck_connector.so nox11
session     optional    pam_gnome_keyring.so auto_start
session     optional    pam_motd.so motd=/etc/motd

Where you put it is entirely dependent upon what else is in the stack. But you should put it before anything else which might need the home directory.

See man 8 pam_mkhomedir for the options it supports.

phemmer
  • 70,657
  • 19
  • 188
  • 223
  • Awesome. Thanks for the answer. Our users currently don't log into the system, they log into a web application that is hosted on the system. Is there a trigger that can create their home directory upon an initial log in of the web app? – Nicholas Anderson May 20 '14 at 21:26
  • 1
    If the web application uses the pam stack, then it would work (though you might have to put it in the `auth` stack instead of `session`). If the app does not use the pam stack, then you would have to build something into the application itself. – phemmer May 20 '14 at 21:31
  • It looks like only the session module is provided, I have tried and, in fact, pam_mkhomedir is not working with the auth module. I have the same problem as Nicholas Anderson, I have a web application. Is there any way to solve this issue in the auth module? – Fabiano Tarlao Apr 16 '19 at 09:15
6

In Ubuntu 14.04 system-login is not present, but another file named as common-session is present.

I went there and put:

root@GW:~# vim /etc/pam.d/common-session

#
session optional        pam_systemd.so skel=/etc/skel/ umask=0077

This will create home directory if no exist also set the permission to 700

techraf
  • 5,831
  • 10
  • 33
  • 51
Mansur Ul Hasan
  • 277
  • 3
  • 4
  • The umask suggested by https://help.ubuntu.com/community/LDAPClientAuthentication is `umask=0022`. I believe yours removes ALL capabilities including `read` which may prevent some key based authentication/trust mechanisms from working in a multi-user system or other cases. – dragon788 Jul 12 '17 at 18:52
1

I'd recommend using oddjob-mkhomedir:

For Centos 7 this works:

yum install oddjob-mkhomedir

Append this to /etc/pam.d/system-auth and /etc/pam.d/password-auth:

session     optional      pam_oddjob_mkhomedir.so skel=/etc/skel

And finally:

systemctl enable oddjob; systemctl start oddjob

This was posted originally here: https://www.centos.org/forums/viewtopic.php?t=48631

Note: If you just mounted your /home partition, don't forget to do restorecon /home

mejem
  • 100
  • 6
  • Thanks! Your `restorecon /home` note has just saved me after many hours of futile searching – Energya Dec 01 '20 at 00:04
  • I'm running rasbian buster and there is no `/etc/pam.d/system-auth` or `/etc/pam.d/password-auth`. Could you possibly suggest where I might put the configuration line? – crobar Feb 01 '21 at 11:14