I am responsible for a couple of servers at my university. All of these machines are configured to talk to the LDAP server of my departement to allow centralised user logins. On this LDAP server there is a user named root:# getent passwd | grep rootroot:x:0:0:root:/root:/bin/bashroot:x:0:0:Netbios Domain Administrator:/home/root:/bin/falseRecently, I ran into issues with the root account on one of the servers I am responsible for: My SSH connection attempt was successfully authenticated against the local root user, but the home directory was taken from the LDAP as /home/root. In addition I found out that one can authenticate as root with the LDAP's root credentials on any server, i.e., if authentication against the local root fails, the LDAP root is tried and, given the password is correct, the user is logged in as superuser. I believe this is not very secure and the ambiguity of the two root accounts should be removed. However, according to our IT department, the LDAP root is necessary. How can I filter out the root account from LDAP to disallow authentication with it? I am using pam_ldap.so and also some ldap directives in /etc/nsswitch.conf.
How to disallow usage of an LDAP root account
authentication;pam;ldap
There are many ways, here are a couple of easy ones:in /etc/ssh/sshd_config change PermitRootLogin to no (this is usually a good idea, then rely on su/sudo for administration). This affects SSH only of course.in the various PAM configuration files use the pam_listfile module to explicitly allow or deny certain accounts (needs to be done for each service)in the various PAM configuration files configure the pam_ldap module pam_min_uid to 1 (or higher) so that root cannot log in (needs to be done for each service)amend the PAM LDAP search filter (pam_filter) to either exclude users (e.g. pam_filter (uidNumber>=1), or you may be able to amend the base/scopeEither of the last two might be the best fit for you. You may also need to make some adjustments to the local PAM configuration so that a local root account via pam_unix  can succeed if pam_ldap fails it (e.g. ordering and required/requisite/sufficient).