// Tutorial //

How To Authenticate Client Computers Using LDAP on an Ubuntu 12.04 VPS

Published on October 2, 2013
Default avatar
By Justin Ellingwood
Developer and author at DigitalOcean.
How To Authenticate Client Computers Using LDAP on an Ubuntu 12.04 VPS

Status: Deprecated

This article covers a version of Ubuntu that is no longer supported. If you are currently operate a server running Ubuntu 12.04, we highly recommend upgrading or migrating to a supported version of Ubuntu:

Reason: Ubuntu 12.04 reached end of life (EOL) on April 28, 2017 and no longer receives security patches or updates. This guide is no longer maintained.

See Instead: This guide might still be useful as a reference, but may not work on other Ubuntu releases. If available, we strongly recommend using a guide written for the version of Ubuntu you are using. You can use the search functionality at the top of the page to find a more recent version.


LDAP, or Lightweight Directory Access Protocol, is one way of keeping authentication information in a single centralized location. In a previous article, we discussed how to set up an LDAP server on an Ubuntu 12.04 VPS. This explained the actual server configuration.

In this article, we will discuss how to configure a client machine to remotely authenticate with that server for various services.

To complete this project, you will need an Ubuntu 12.04 server configured as the LDAP server. Look at the link to the previous guide if you haven’t done so already. You will also need another Ubuntu 12.04 droplet to act as the client machine.

Install Client Packages

On the client machine, you will needs to install a few packages to make authentication function correctly with an LDAP server.

You can install them from the default Ubuntu repositories with the following commands:

sudo apt-get update
sudo apt-get install libpam-ldap nscd

You will be asked a variety of questions similar to the those asked when you were installing the server components.

  • LDAP server Uniform Resource Identifier: ldap://LDAP-server-IP-Address

    • Change the initial string from “ldapi:///” to “ldap://” before inputing your server’s information
  • Distinguished name of the search base:

    • This should match the value you put in your LDAP server’s /etc/phpldapadmin/config.php file.

    • Search for: " ‘server’,‘base’,array " within the file.

    • Our example was “dc=test,dc=com

  • LDAP version to use: 3

  • Make local root Database admin: Yes

  • Does the LDAP database require login? No

  • LDAP account for root:

    • This should also match the value in your /etc/phpldapadmin/config.php.

    • Search for: " ‘login’,‘bind_id’ " within the file

    • Our example was “cn=admin,dc=test,dc=com

  • LDAP root account password: Your-LDAP-root-password

If you make a mistake and need to change a value, you can go through the menu again by issuing this command:

sudo dpkg-reconfigure ldap-auth-config

Configure Client Software

We have to adjust a few files to tell our authentication files that they can look to our LDAP server for authentication information.

First, edit the /etc/nsswitch.conf file. This will allow us to specify that the LDAP credentials should be modified when users issue authentication change commands.

sudo nano /etc/nsswitch.conf

The three lines we are interested in are the “passwd”, “group”, and “shadow” definitions. Modify them to look like this:

<pre> passwd: <span class=“highlight”>ldap</span> compat group: <span class=“highlight”>ldap</span> compat shadow: <span class=“highlight”>ldap</span> compat </pre>

Next, we will add a value to our PAM configuration.

PAM, or Pluggable Authentication Modules, is a system that connects applications that can provide authentication to applications that require authentication.

PAM is already implemented on most computers, and works behind the scenes without needing user interaction. When we installed and configured our LDAP PAM module, most of the needed information was added to the configuration files.

Edit the /etc/pam.d/common-session file:

sudo nano /etc/pam.d/common-session

Add a line to the bottom of the configuration that reads:

session required	pam_mkhomedir.so skel=/etc/skel umask=0022

This will create a home directory on the client machine when an LDAP user logs in who does not have a home directory.

We have to restart a service for these changes to be implemented:

sudo /etc/init.d/nscd restart


During the LDAP server configuration, we created a group called “admin”. This was not chosen at random. It coincides with the “admin” group that is created by default on Ubuntu machines.

The LDAP users that you added to the “admin” group will have access to the sudo command.

This is because we have a line that gives members of the “admin” group sudo access within the /etc/sudoers file. Edit the file by issuing this command:

sudo visudo

There is a line that reads:

%admin ALL=(ALL) ALL

Entries that begin with a percentage sign (%) specify a group instead of a user. If you wish to disable this functionality, or only grant specific users this functionality, comment out this line:

#%admin ALL=(ALL) ALL

Log In as an LDAP User

We have now configured our client machine enough to be able to log in as one of our LDAP users. This user does not have to exist on the client machine.

In a new terminal window (it is best to keep your original terminal window logged in, in case of a configuration mistake), ssh into the client machine using an LDAP user’s credentials:

<pre> ssh <span class=“highlight”>LDAP_user</span>@<span class=“highlight”>LDAP_client_IP_Address</span> </pre>

You should be able to log in as if your user had been created locally. Issue the print working directory command:


You should see that the home directory you selected for your user on the LDAP server is being used on this machine. It has been created on-demand to serve the LDAP user.

If you log out and log in with a different LDAP user, you can see that there will be two home directory entries:

ls /home

user1  user2

If your user is part of the “admin” group and you didn’t disable the ability in the previous section, you will have normal sudo access, otherwise, you will not.

If you issue the passwd command to change your password, you can see that it will be modifying your LDAP credentials:


Enter login(LDAP) password:

Restricting Access by Group

If you only want members of certain groups to be able to log into this specific machine, you can configure that restriction within the PAM files.

Edit the following file with root privileges:

sudo nano /etc/pam.d/common-auth

At the bottom, we will specify that PAM should look at the security access file to see how to restrict user logins. Add this to the bottom:

auth	required	pam_access.so

Save and close the file.

The file that PAM references for security information when that setting is configured is at /etc/security/access.conf. Open this file now, with root privileges:

sudo nano /etc/security/access.conf

We need to add a rule to the end of the file.

The dash (-) at the beginning of the line means this is a restriction. From the first colon (:) to the next colon, we specify who this rule applies to.

We specify that this applies to all users except root and the group “admin”. Groups are given within parentheses.

From the second colon to the end of the line, we will specify under which circumstances the rule should apply. In our case, the restriction will apply in all circumstances but local logins.

<pre> -:ALL EXCEPT root (admin):ALL EXCEPT LOCAL </pre>

This will allow us to restrict logins to the “admin” group. We can add other groups or change the group.

This will also allow us to log in through the “console access” button on the DigitalOcean console if we somehow lock ourselves out of SSH.

Keep in mind that this will apply to all users, not just LDAP users. So any users you create on the client machine will need to be a member of one of the specified groups.


You should now be able to authenticate multiple computers using a centralized LDAP server. Your LDAP users will be allowed to use any of the machines you configure in this way, as long as they have the appropriate login credentials.

This can prevent your user information from becoming dispersed, duplicated, and unmanageable. When the number of users accessing your servers or projects is increasing, and the number of machines is also growing, LDAP authentication can be a huge help.

<div class=“author”>By Justin Ellingwood</div>

If you’ve enjoyed this tutorial and our broader community, consider checking out our DigitalOcean products which can also help you achieve your development goals.

Learn more here

About the authors
Default avatar
Developer and author at DigitalOcean.

Still looking for an answer?

Was this helpful?

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Dears, I know it is deprecated but why i have to use : “LDAP account for root” in config of the client ? Why user password and login is insufficient ?

– washide

For those who are having issues with your system not rebooting after doing this tutorial, the problem is from setting up nscd the way this article tells you to. for Ubuntu 14.04 anyways.

in /etc/nsswitch.conf

compat has to come before ldap


passwd: compat ldap group: compat ldap shadow: compat ldap

Once you set it up this way, your system will reboot.

For those of you interested in why this makes a difference:

Most of the boot sequence runs as the root user.

It doesn’t require authentication, but it does require that the root user exists and has a home dir and such.

If ldap is not started yet, then the nsswitch won’t be able to see the root user, and it gets stuck.

Having ldap first in the nsswitch.conf makes the user lookup try to connect to and search ldap first before consulting the local /etc/passwrd at which point, boot up will choke.


Master can you help me for simultaneous-use Ldap-freeradius Login config?

I still can’t login using ssh. I followed the solution provided by Ork1983. Please help

If you want this functionality but don’t want the hassle of running an LDAP server, check out my service Foxpass (https://www.foxpass.com).

Could not get this working until I changed /etc/ldap.conf on the client. I commented out socket: #uri ldapi://ldap.test.local/ and inserted host: uri ldap://ldap.test.local/

Note there is no “i” in the protocol of second uri.


Great guide!

Note to Ubuntu 14.04 users: DO NOT USE THIS GUIDE, IT WILL BRICK YOUR INSTALLATION! Follow this one instead

Hi great tutorial it works for me. I have a question, I have been digging for the solution that ssh key based authentication with LDAP but i did not find way to make it ? Is there any way for ssh-key based authentication of client using LDAP in ubuntu.

hey i followed this guide but successfully authenticated users from the ldap server. but as i reboot the machine it did not start … i am using ubuntu 14.04. tried to debug the problem. found this . https://bugs.launchpad.net/ubuntu/+source/libnss-ldap/+bug/1024475

Thank you for the helping guides. I don’t know what am doing wrong but I have tried to follow the two guides on creating the ldap server and the client side. But I have failed to authenticate on the client machine with the ldap account. I have tried to restart the client machine but it has also failed to come up… stoping at some level with a word keys; and nothing else. I am using Ubuntu 12.04.3 and the client machines is Mint 17. Is there any thing I might be doing wrong? Thank you