[CentOS] Auth pam ldap and fail2ban

Jimmy Morin wrote:
>
> Fail2ban is logging false positive with authentication using pam ldap.
>
> What happen is a user login using his ldap password cause pam_unix to
> fail then pam_ldap log the user in.
>
> sshd filter for fail2ban read /var/log/secure see the pam_unix error,
> flag it even if the next line in the log says the login is successful.
>
> CentOS 7 with fail2ban 0.9.7 from EPEL.
>
> Any idea how to fix this?

My first thought would be to redo pam system-auth for login such that
pam_ldap *precedes* pam_unix.

Question: is pam_unix sufficient, or required?

      mark