nerdexam
Linux_Foundation

LFCS · Question #128

After configuring PAM and NSS to integrate with OpenLDAP, the SSH server refuses to authenticate users who are only in LDAP. What is the first step you should follow to debug this problem?

The correct answer is B. Restart the sshd service. After modifying PAM/NSS for LDAP integration, restarting the sshd service is the first debugging step to ensure it loads the updated authentication configurations.

Submitted by javi_es· Apr 18, 2026Operation of Running Systems

Question

After configuring PAM and NSS to integrate with OpenLDAP, the SSH server refuses to authenticate users who are only in LDAP. What is the first step you should follow to debug this problem?

Options

  • ARestart the pamd service.
  • BRestart the sshd service.
  • CRestart the nssd service.
  • DAdd the Use_LDAP = yes parameter to sshd_config.

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    92% (24)
  • D
    4% (1)

Why each option

After modifying PAM/NSS for LDAP integration, restarting the `sshd` service is the first debugging step to ensure it loads the updated authentication configurations.

ARestart the pamd service.

`pamd` is not a service that can be restarted; PAM (Pluggable Authentication Modules) is a framework that services like `sshd` utilize, and changes to PAM configuration files are only effective for a service after that specific service is restarted.

BRestart the sshd service.Correct

When PAM and NSS configurations are modified to integrate with OpenLDAP, the `sshd` service needs to be restarted for it to reload the updated authentication and name service lookup configurations. Until `sshd` is restarted, it will continue to use the older PAM/NSS settings, leading to authentication failures for LDAP users.

CRestart the nssd service.

`nssd` is not a standard service related to NSS (Name Service Switch); while `nscd` (Name Service Cache Daemon) can be restarted, restarting `sshd` is the more direct and primary action to ensure new NSS configurations are applied to SSH.

DAdd the Use_LDAP = yes parameter to sshd_config.

The `sshd_config` file does not have a `Use_LDAP = yes` parameter for direct LDAP integration; SSH delegates user authentication to PAM, which then handles the integration with LDAP through its modules.

Concept tested: SSH/PAM/NSS/LDAP debugging

Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_authentication_and_authorization/configuring-ldap-authentication_managing-authentication-and-authorization

Topics

#PAM#NSS#SSH#Service Troubleshooting

Community Discussion

No community discussion yet for this question.

Full LFCS Practice