Приведенная последовательность действий является минимально необходимой, на правильность не претендует, т.к. недоработок достаточно. Но для первого старта сгодится. Она выполнялась на ALT Linux Master 2.2 + updates

Шаг 1: Установка сервера openldap (с помощью apt) и его настройка

Основной конфиг openldap - /etc/openldap/slapd.conf:

   include /etc/openldap/schema/core.schema
   include /etc/openldap/schema/cosine.schema
   include /etc/openldap/schema/inetorgperson.schema
   include /etc/openldap/schema/misc.schema
   include /etc/openldap/schema/nis.schema
   include /etc/openldap/schema/openldap.schema
   pidfile         /var/run/slapd.pid
   argsfile        /var/run/slapd.args
   TLSCertificateFile      /etc/openldap/ldap.pem
   TLSCertificateKeyFile   /etc/openldap/ldap.pem
   TLSCACertificateFile    /etc/openldap/ldap.pem
   database        ldbm
   suffix          "dc=myserver,dc=myprovider,dc=ru"
   rootdn          "cn=manager,dc=myserver,dc=myprovider,dc=ru"
   rootpw  secret
   directory       /var/lib/ldap/bases
   loglevel -1
   index objectClass,uid,uidNumber,gidNumber     eq
   index cn,mail,surname,givenname               eq,subinitial

Шаг 2: Добавление пользователей

• Файл users.ldif:

     dn: dc=myserver, dc=myprovider, dc=ru
     objectClass: top
  
     dn: cn=Users, dc=myserver, dc=myprovider, dc=ru
     objectClass: top
  
     dn: cn=vasya, cn=Users, dc=myserver, dc=myprovider, dc=ru
     objectClass: posixAccount
     objectClass: shadowAccount
     cn: vasya
     uid: vasya
     uidNumber: 1000
     gidNumber: 10
     homeDirectory: /home/vasya
     loginShell: /bin/bash
     userPassword: {md5}$1$ION4SIII$EYyGEeYt4g2hEe9tjICac.
  

• Добавляем пользователей командой:

     ldapadd -x -D "cn=manager,dc=myserver,dc=myprovider,dc=ru" -w "secret" -f users.ldif
  

• Смотрим, на месте ли они, командой:

     ldapsearch -LLL -H ldap://localhost
  

Шаг 3: Настройка авторизации

Устанавливаем пакеты pam_ldap и nss_ldap. Правим следующие файлы по образцу:

/etc/nsswitch.conf:

    passwd:     files ldap nisplus nis
    shadow:     tcb ldap files nisplus nis
    group:      files ldap nisplus nis
    hosts:      files nisplus nis dns
    ethers:     files
    netmasks:   files
    networks:   files
    protocols:  files
    rpc:        files
    services:   files
    bootparams: nisplus [NOTFOUND=return] files
    netgroup:   nisplus
    publickey:  nisplus
    automount:  files nisplus
    aliases:    files nisplus

/etc/ldap.conf:

    host 127.0.0.1
    base dc=myserver,dc=myprovider,dc=ru
    bindpw secret
    rootbinddn cn=manager,dc=myserver,dc=myprovider,dc=ru

/etc/ldap.secret:

    secret

/etc/pam.d/system-auth:

    auth            sufficient      /lib/security/pam_ldap.so
    auth            required        /lib/security/pam_tcb.so shadow fork prefix=$2a$ count=8 nullok use_first_pass
    account         sufficient      /lib/security/pam_ldap.so
    account         required        /lib/security/pam_tcb.so shadow fork
    password        sufficient      /lib/security/pam_ldap.so
    password        required        /lib/security/pam_passwdqc.so min=disabled,24,12,8,7 max=40 passphrase=3 match=4 similar=deny random=42 enforce=users retry=3
    password        required        /lib/security/pam_tcb.so use_authtok shadow fork prefix=$2a$ count=8 write_to=tcb
    session         required        /lib/security/pam_tcb.so
    session         required        /lib/security/pam_limits.so
    session         required        /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0077

/etc/pam.d/system-auth-use_first_pass:

    auth            sufficient      /lib/security/pam_ldap.so use_first_pass
    auth            required        /lib/security/pam_tcb.so shadow fork prefix=$2a$ count=8 nullok use_first_pass
    password        sufficient      /lib/security/pam_ldap.so
    password        required        /lib/security/pam_tcb.so use_authtok shadow fork prefix=$2a$ count=8 write_to=tcb

Шаг 3: Результаты

Смотрим, чего мы натворили:

    # id vasya
    uid=1000(vasya) gid=10(wheel) groups=10(wheel)

    # passwd vasya
    passwd: updating all authentication tokens for user vasya.
    New password:
    Re-enter new password:
    LDAP password information changed for vasya
    passwd: all authentication tokens updated successfully.

    $ su - vasya
    Password:
    Creating directory '/home/vasya'.
    Creating directory '/home/vasya/tmp'.
    Creating directory '/home/vasya/Documents'.
    Creating directory '/home/vasya/.mutt'.
    Creating directory '/home/vasya/.mutt/color.default'.
    Creating directory '/home/vasya/.xsession.d'.

    $ ssh vasya@localhost
    vasya@localhost's password:
    Last login: Tue Apr 20 10:38:21 2004 from localhost.localdomain
    $