title: Bypass LDAP PAM authentication when ssh as local user
body: <p>I want to ssh into a host using a local user and want to know how to configure it the best way, preferably that requires only changes on that host and not on the LDAP backend.</p>
  
  <p>Currently I get this error and it appears that authentication for the local user is attempted via LDAP/PAM :
  debug1: PAM: password authentication failed for USER: Authentication failure</p>
  
  <p>Based on some directions I found already, I did these changes but that doesn't help:</p>
  
  <ol>
  <li>Added below line to /etc/security/access.conf:</li>
  </ol>
  
  <p>+ : USER_UNIX_GROUP : ALL</p>
  
  <ol start="2">
  <li>In /etc/pam.d/sshd, added the following line:</li>
  </ol>
  
  <p>auth  sufficient  pam_succeed_if.so user ingroup USER_UNIX_GROUP </p>
  
  <p>The above settings get to these state, but don't know how to get the user to be locally authenticated without having to disable PAM in ssh (which is not an option):</p>
  
  <p>Jun  2 15:54:04 HOST sshd[29907]: pam_succeed_if(sshd:auth): requirement "user ingroup demo" was met by user "USER"</p>
  
  <p>Jun  2 15:54:04 HOST sshd[29907]: Failed password for USER from SOURCE_IP port 42522 ssh2</p>