hi there,

i'm trying to get my head around PAM here at the moment, but i'm not getting very far.

i'm trying to make my pop3 mail server authenticate against active directories so far i've got winbind working and i can get my read out of wbinfo -u and the way i've setup my pop3 pam module. you can login with either you unix password or windows domain password.

What i want is if there is a ADS user use it, if not check if there is a unix user and use it.

this is my pop pam module.

auth required /lib/security/pam_securetty.so
auth sufficient /lib/security/pam_winbind.so
auth sufficient /lib/security/pam_unix.so use_first_pass nullok
auth required /lib/security/pam_stack.so service=system-auth
auth required /lib/security/pam_nologin.so
acount required /lib/security/pam_stack.so service=system-auth
acount required /lib/security/pam_winbind.so

The way that I'm reading that, you're actually requiring the account in winbind. Why not just defer to the system-auth, provided that you have your system-auth configured to auth against AD as well?

i eventually figured out all i could with my OpenLDAP + LAM + Samba as a primary domain controllor and i posted it on my blog at my local tlug website if anyone is interested

http://tlug.dnho.net/?q=node/146#comment