| View previous topic :: View next topic |
| Author |
Message |
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
 Posted: Tue Aug 05, 2003 3:19 pm Post subject: Centralized user authentication with OpenLDAP and PAM |
 |
|
-IMPORTANT NOTICE-
This howto was written for an old version of OpenLDAP, DirectoryAdministrator and else. It's awfully deprecated and does not work as is. You should use the (current and maintained) Gentoo Guide to OpenLDAP Authentication instead. If you need help, you should post to the Networking forum. If you find a problem in that (official) doc, please file a Documentation bug. For those that choose to ignore that warning and use this howto, you might find this post interesting, as it details what user weyhan did to have it working.
-IMPORTANT NOTICE-
-----------------------------------------------------------------------------
This setup is useful if you manage multiple systems and want all of them to share the same user/passwords.
Server setup
Install openldap :
Look at what the hostname command returns on your server, and generate a LDAP root password under MD5 form, you will need them later for config files :
| Code: | # hostname
YourLdapServerHostname
# slappasswd -h {MD5} |
Replace /etc/openldap/slapd.conf with :
| Code: | include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
access to dn=".*,dc=yourcompany,dc=com" attr=userPassword
by dn="cn=root,dc=yourcompany,dc=com" write
by self write
by * auth
access to dn=".*,dc=yourcompany,dc=com"
by * read
TLSCertificateFile /etc/openldap/ssl/ldap.pem
TLSCertificateKeyFile /etc/openldap/ssl/ldap.pem
TLSCipherSuite HIGH:+MEDIUM:!LOW
TLSVerifyClient never
database ldbm
suffix "dc=yourcompany,dc=com"
rootdn "cn=root,dc=yourcompany,dc=com"
rootpw {MD5}PutSlapPasswdOutputHere
directory /var/lib/openldap-ldbm
index objectClass,uid,uidNumber,gidNumber eq
index cn,surname,givenname eq,subinitial |
Start OpenLDAP and add it to default runlevel :
| Code: | # /etc/init.d/slapd start
# rc-update add slapd default |
Create the /root/base.ldif file with :
| Code: | dn: dc=yourcompany,dc=com
dc: yourcompany
objectClass: top
objectClass: domain
dn: ou=People,dc=yourcompany,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=yourcompany,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit |
Import the /root/base.ldif file in the LDAP server :
| Code: | | # ldapadd -x -D "cn=root,dc=yourcompany,dc=com" -W -f /root/base.ldif |
That's it, your LDAP server is ready (but empty). We will now see how to populate the user base.
LDAP base setup
We will use directoryadministrator which provides an easy interface to create users and groups on the LDAP server. On the admin workstation (doesn't need to be the LDAP server or a client) :
| Code: | | # emerge directoryadministrator |
As of this writing, version 1.5.1 is in ~x86, so to get it :
| Code: | | # ACCEPT_KEYWORDS=~x86 emerge directoryadministrator |
Run directoryadministrator, and setup your profile :
- Check "Enable transport security"
- Search root : dc=yourcompany,dc=com
- DN/User ID : cn=root,dc=yourcompany,dc=com
Go to Preferences :
- Store passwords as an MD5 hash
- DO NOT check "Use the authPassword attribute"
Create a group called users with GID=100
Create users...
See the Notes chapter at the end of this post for advice on how to migrate an existing user base.
Client setup
Install the PAM-LDAP and NSS-LDAP files :
| Code: | | # emerge pam_ldap nss_ldap |
Modify the following lines from /etc/nsswitch.conf to read :
| Code: | passwd: files ldap
shadow: files ldap
group: files ldap |
Replace your /etc/ldap.conf by the following :
| Code: | host YourLdapServerHostname
base dc=yourcompany,dc=com
scope 1
pam_filter objectclass=posixaccount
pam_login_attribute uid
pam_member_attribute gid
pam_password md5
ssl start_tls |
Replace the /etc/pam.d/system-auth file by the following :
| Code: | #%PAM-1.0
auth required /lib/security/pam_env.so
auth sufficient /lib/security/pam_unix.so likeauth nullok nodelay
auth sufficient /lib/security/pam_ldap.so use_first_pass
auth required /lib/security/pam_deny.so
account required /lib/security/pam_unix.so
account sufficient /lib/security/pam_ldap.so
password required /lib/security/pam_cracklib.so retry=3
password sufficient /lib/security/pam_unix.so nullok md5 shadow use_authtok
password sufficient /lib/security/pam_ldap.so use_authtok
password required /lib/security/pam_deny.so
session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022
session required /lib/security/pam_limits.so
session required /lib/security/pam_unix.so
session optional /lib/security/pam_ldap.so |
If you don't want strong password checks, you can use these password lines instead :
| Code: | password sufficient /lib/security/pam_unix.so nullok md5 shadow
password sufficient /lib/security/pam_ldap.so
password required /lib/security/pam_deny.so |
You should remove the "users" group from /etc/group, since it is already in the LDAP server. You can then test that everything is working correctly by retrieving passwd and group :
| Code: | # getent passwd
# getent group |
You should see the users group and the LDAP users. If everything is OK, repeat these steps on each client machine, and you're all done.
Notes
Migration of an existing user base
If you don't have too many users, it's simpler to create new LDAP users with same UID and name and remove existing users from /etc/passwd and /etc/shadow on the client machines.
If you have a big user base, you should use PADL migration tools (emerge migrationtools) and the migrate_group.pl and migrate_passwd.pl scripts. You might have to abandon MD5 passwords for Crypt passwords if you want to migrate the passwords also.
The system accounts and groups
You should not migrate system accounts (including the root account) and system groups in the LDAP server. You should keep them in the files, so that you can log in as root if the LDAP server is not working. root password should be different on each machine, anyway 
Hope this helps, WorkedForMe(TM)
- K
History:
* corrected rootpw and base.ldif thanks to snafoo remarks
* corrected the incomplete system-auth file
* added a note on the official Gentoo guide
* removed defaultaccess directive (deprecated as of OpenLDAP 2.1)
Last edited by Koon on Wed Jul 21, 2004 4:25 pm; edited 5 times in total |
|
| Back to top |
|
 |
prophetx2
n00b
Joined: 04 Jan 2003
Posts: 13
|
| Posted: Tue Aug 05, 2003 3:48 pm Post subject: |
|
|
| wow thanks for this, it's exactly what I'm looking for. I'm going to try this maybe next week when I get my new box =) |
|
| Back to top |
|
|
snafoo
n00b
Joined: 22 Jan 2003
Posts: 39
|
| Posted: Tue Aug 05, 2003 8:10 pm Post subject: notes |
|
|
some notes: i think the rootpw entry is incorrect, should use output from slappasswd and the base.ldif should contain:
dn: dc=a2t,dc=com
dc: a2t
objectClass: top
objectClass: domain
for your domain obviously 
hope this helps the readers
-snafoo |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Wed Aug 06, 2003 8:17 am Post subject: Re: notes |
|
|
| snafoo wrote: | | some notes: i think the rootpw entry is incorrect, should use output from slappasswd and the base.ldif should contain... |
Yes, the rootpw probably got caught in my "yourcompany" changes... and the base.ldif file was incomplete. Main post has been edited to correct this.
Thanks for your proofreading ! Yes, it will help
-K |
|
| Back to top |
|
|
El_Presidente_Pufferfish
Veteran
Joined: 11 Jul 2002
Posts: 1179
Location: Seattle
|
| Posted: Wed Aug 06, 2003 1:57 pm Post subject: |
|
|
Hrm...would this work on a laptop that leaves the network often?
or is this only for computers that are always on the same network? |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Wed Aug 06, 2003 2:09 pm Post subject: |
|
|
| El_Presidente_Pufferfish wrote: | Hrm...would this work on a laptop that leaves the network often?
or is this only for computers that are always on the same network? |
It would not work properly...
In fact, when you lose your network connnection to the LDAP server, the getent calls (which retrieve available users and groups) would no longer find the LDAP-defined users and groups, only the local ones (defined in the usual files).
What you can do is have local users (defined in the files) and global users (defined in LDAP). Use local users when disconnected, global users when connected. They can even share the same uid/name... you should have "ldap files" rather than "files ldap" in nsswitch.conf so that it finds LDAP users first when connected.
Never tried it though. Centralized user repositories do not play to well with roaming users (password sync can be a problem, I think).
-K |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Thu Aug 07, 2003 3:00 pm Post subject: |
|
|
The system-auth file in the original post was incomplete (missing the auth, session and account sections).
This has been corrected in the original post.
-K |
|
| Back to top |
|
|
StrCrssd
n00b
Joined: 17 Apr 2002
Posts: 68
Location: McAllen, TX USA
|
| Posted: Fri Aug 08, 2003 6:19 am Post subject: user ldif |
|
|
Can you please post an example ldif? directoryadministrator keeps crashing on me, and I don't know exactly what fields to include in my user ldif files.
_________________
StrCrssd
Give a man enough rope, he'll hang himself. Teach a man to make rope, he'll hang other people. |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Fri Aug 08, 2003 7:37 am Post subject: Re: user ldif |
|
|
| StrCrssd wrote: | | Can you please post an example ldif? directoryadministrator keeps crashing on me, and I don't know exactly what fields to include in my user ldif files. |
A user entry looks like this :
| Code: | dn: uid=thehulk,ou=People,dc=yourcompany,dc=com
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: account
objectClass: top
objectClass: posixAccount
objectClass: shadowAccount
host: *
uid: thehulk
uidNumber: 1000
gidNumber: 100
givenName: The
sn: Hulk
cn: The Hulk
homeDirectory: /home/thehulk
loginShell: /bin/bash
gecos: The Hulk
userPassword: {MD5}HULKPASSWORD |
while a group entry looks like this :
| Code: | dn: cn=vmadmin,ou=Group,dc=yourcompany,dc=com
objectClass: top
objectClass: posixGroup
objectClass: groupOfNames
cn: vmadmin
gidNumber: 2002
memberUid: thehulk
member: uid=thehulk,ou=People,dc=yourcompany,dc=com |
You can also look at the PADL migration tools results, they produce LDIF files from your existing system files.
Maybe there exists a better set of LDAP/PAM related tools out there, but DirectoryAdministrator works fine for me...
-K |
|
| Back to top |
|
|
StrCrssd
n00b
Joined: 17 Apr 2002
Posts: 68
Location: McAllen, TX USA
|
| Posted: Fri Aug 08, 2003 6:56 pm Post subject: Thanks |
|
|
Wonderful.
I appreciate your help.
_________________
StrCrssd
Give a man enough rope, he'll hang himself. Teach a man to make rope, he'll hang other people. |
|
| Back to top |
|
|
Sasun
n00b
Joined: 07 May 2002
Posts: 15
|
|
| Back to top |
|
|
Shizatoga
n00b
Joined: 19 Jul 2002
Posts: 16
|
| Posted: Tue Aug 26, 2003 2:27 am Post subject: |
|
|
First I'd like to thank Koon for this great, bumpable, howto.
To consoladate this information I'll ask my question here. Does anyone know how to set up /etc/pam.d/passwd to change user's passwords in ldap? I've looked around and all the examples I've found don't work, all I get is some form of error complaining about tokens. |
|
| Back to top |
|
|
Shizatoga
n00b
Joined: 19 Jul 2002
Posts: 16
|
| Posted: Tue Aug 26, 2003 6:03 pm Post subject: |
|
|
| Apparently upgrading to openldap 2.1 fixed this, go figure. |
|
| Back to top |
|
|
adamtheo
Tux's lil' helper
Joined: 03 Sep 2002
Posts: 123
Location: Tallahassee, Florida USA
|
| Posted: Wed Aug 27, 2003 5:52 am Post subject: "database bdb" |
|
|
I'm reading in the OpenLDAP config file docs that the following is an acceptable option, and supposedly means a Berkeley DB backend for storing the directory info:
| Code: |
database bdb
directory /usr/local/var/openldap-data
|
But the OpenLDAP 2.0.27 documentation only allows "ldbm", "shell", and "passwd" types. I've tried using the "bdb" option in my conf file, and slapd says it cannot find the bdb type. Was wondering if this is a deprecated type, and i should just use ldbm?
And also, why do you use the MD5 method for encrypting passwords rather than SHA or SSHA? Personal preference? Have any reasons for choosing that one?
Thanks.
_________________
* Theoretic Solutions "The Internet's Open Think-Tank" - http://www.theoretic.com |
|
| Back to top |
|
|
adamtheo
Tux's lil' helper
Joined: 03 Sep 2002
Posts: 123
Location: Tallahassee, Florida USA
|
| Posted: Wed Aug 27, 2003 7:41 am Post subject: Failing to import ldif file |
|
|
Nevermind, I found out the solution to the below problem was to chown the database directory to the ldap user. Thanks anyway.
I have successfully installed and started OpenLDAP so far, but when I get to importing the "/root/base.ldif" file, I get this error:
| Code: |
theoretic root # ldapadd -x -D "cn=root,dc=theoretic,dc=com" -W -f /root/base.ldif
Enter LDAP Password:
adding new entry "ou=users,dc=theoretic,dc=com"
ldap_add: Operations error
ldif_record() = 1
|
Here is an excerpt from my "/etc/openldap/slapd.conf" file:
| Code: |
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules:
# modulepath /usr/lib/openldap/openldap
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la
access to dn=".*,dc=yourcompany,dc=com" attr=userPassword
by dn="cn=root,dc=yourcompany,dc=com" write
by self write
by * auth
access to dn=".*,dc=yourcompany,dc=com"
by * read
defaultaccess none
#TLSCertificateFile /etc/openldap/ssl/ldap.pem
#TLSCertificateKeyFile /etc/openldap/ssl/ldap.pem
#TLSCipherSuite HIGH:+MEDIUM:!LOW
#TLSVerifyClient never
#########################################
# Theoretic Users in BerkleyDB format
# Is used by Apache, TWiki, and Jabberd.
#########################################
database ldbm
suffix "dc=theoretic,dc=com"
rootdn "cn=root,dc=theoretic,dc=com"
rootpw {MD5}*******************
directory /var/lib/openldap-users
index objectClass,uid,uidNumber,gidNumber eq
index cn,surname,givenname eq,subinitial
|
I have the TLS section commented out because my server is not yet using the FQDN that I am configuring the LDAP and SSL functionalities for (this server will replace one that is currently "theoretic.com"). I am not connecting remotely to the LDAP directory, I am performing all operations over a SSH connection.
And here is the "/root/base.ldif" file:
| Code: |
dn: dc=theoretic,dc=com
dc: theoretic
objectClass: top
objectClass: domain
dn: ou=users,dc=theoretic,dc=com
ou: users
objectClass: top
objectClass: organizationalUnit
description: Group for Users
dn: ou=members,dc=theoretic,dc=com
ou: members
objectClass: top
objectClass: organizationalUnit
description: Group for Members
dn: ou=admins,dc=theoretic,dc=com
ou: admins
objectClass: top
objectClass: organizationalUnit
description: Group for Administrators
|
Any help would be appreciated. Thanks.
_________________
* Theoretic Solutions "The Internet's Open Think-Tank" - http://www.theoretic.com |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Fri Aug 29, 2003 3:50 pm Post subject: Re: "database bdb" |
|
|
| adamtheo wrote: | | And also, why do you use the MD5 method for encrypting passwords rather than SHA or SSHA? Personal preference? Have any reasons for choosing that one? |
Personal preference. SHA1 is better in terms of security (size of digest), but I have a few software that does only support MD5 or CRYPT
-K |
|
| Back to top |
|
|
erebus
n00b
Joined: 17 May 2002
Posts: 49
Location: United Kingdom
|
| Posted: Sat Sep 20, 2003 2:35 am Post subject: |
|
|
Hi ya... I've spent the last few hours trying to implement ldap on my new system and have found your guide very helpful..
But I've run into a few problems. I've created a user in ldap called andrew and a group called users and this seems to work fine. But when I try to modify this use using the standard linux commands, say usermod to add a group.. e.g.;
| Code: | | usermod -G users,wheel andrew |
I get this error,
| Code: | | usermod: andrew not found in /etc/passwd |
Am I missing something simple here?
And if I can't change users like this.. how can I go about adding a user to a group that exists in the group file rather than in the ldap database? |
|
| Back to top |
|
|
erebus
n00b
Joined: 17 May 2002
Posts: 49
Location: United Kingdom
|
| Posted: Sun Sep 21, 2003 2:04 pm Post subject: |
|
|
Ahh well I've managed to get things sorted regards the group front (you mearly add all the users you want in a particular group to the group data rather than adding the group to the user data)..
But if anyone else is having difficultly.. I can recommend emerging migrationtools.. its a set of perl scripts to automatically convert over you local file groups, passwd, hosts and a load of other things.. Worked like charm for me. |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Mon Sep 22, 2003 7:52 am Post subject: |
|
|
Yes, usermod is used to manipulate the standard Unix files (like useradd and others). You have to use an LDAP-specific solution to manage your LDAP-defined users & groups. I recommend directoryadminsitrator (it's not perfect, but better than nothing).
-K |
|
| Back to top |
|
|
adamtheo
Tux's lil' helper
Joined: 03 Sep 2002
Posts: 123
Location: Tallahassee, Florida USA
|
| Posted: Mon Sep 22, 2003 9:44 pm Post subject: Connection closed by... |
|
|
RESOLVED: It seems I had an error in my /etc/hosts file, which was causing all local LDAP clients to hang when looking up the LDAP hostname. The error was having the wrong LAN IP address (192.168....) point to the domain name.
I had this setup working before, but decided to uninstall and try something different.
I have now set up my slapd.conf file as so:
| Code: |
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
TLSCertificateFile /opt/theoretic/ssl/key.pem
TLSCertificateKeyFile /opt/theoretic/ssl/key.pem
TLSCipherSuite HIGH:+MEDIUM:!LOW
TLSVerifyClient never
database ldbm
suffix "dc=theoretic,dc=com"
rootdn "cn=root,dc=theoretic,dc=com"
rootpw {SSHA}FJJDcr+fOQjnLkwaMxWhzMzI8yBqUGVD
directory /opt/theoretic/ldap
index objectClass,uid,uidNumber,gidNumber eq
index cn,surname,givenname eq,subinitial
access to dn=".*,dc=theoretic,dc=com" attr=userPassword
by dn="cn=root,dc=theoretic,dc=com" write
by self write
by * auth
access to dn=".*,dc=theoretic,dc=com" attr=mail
by dn="cn=root,dc=theoretic,dc=com" write
by self write
by * read
access to dn=".*,ou=Users,dc=theoretic,dc=com"
by * read
access to dn=".*,dc=theoretic,dc=com"
by self write
by * read
|
And I had added a user under a group in the directory, using GQ. I have given thios user a SSHA password. But when I try to log into the server, hoping to authenticate against LDAP, my password is continually refused. It seems that the server is not checking against the LDAP directory for users. How do I verify and debug this? Thanks
EDIT/UPDATE: I just did a "getent passwd" and "getent group", and do not see the users or groups that are in the LDAP directory.[/b]
_________________
* Theoretic Solutions "The Internet's Open Think-Tank" - http://www.theoretic.com |
|
| Back to top |
|
|
adamtheo
Tux's lil' helper
Joined: 03 Sep 2002
Posts: 123
Location: Tallahassee, Florida USA
|
| Posted: Tue Sep 23, 2003 6:08 pm Post subject: Accessing slapd, but not correct password |
|
|
Hello, again. It seems that getting past that last hurdle only got me into another one. Now I have the local LDAP clients accessing the LDAP directory. I have put slapd in debug mode, and watch as I try to log in with a regular user, or run the getent command. I see activity, but in the case of logging in, the password is rejected. And in the case of getent, the users and groups in the LDAP directory are not displayed.
_________________
* Theoretic Solutions "The Internet's Open Think-Tank" - http://www.theoretic.com |
|
| Back to top |
|
|
Koon
Retired Dev
Joined: 10 Dec 2002
Posts: 518
|
| Posted: Wed Sep 24, 2003 7:48 am Post subject: Re: Accessing slapd, but not correct password |
|
|
| adamtheo wrote: | | I have put slapd in debug mode, and watch as I try to log in with a regular user, or run the getent command. I see activity, but in the case of logging in, the password is rejected. And in the case of getent, the users and groups in the LDAP directory are not displayed. |
Something must be wrong in the LDAP query. Could you post what the slapd debug traces show (debug level 768 might help) to see where it's stopped at ?
-K |
|
| Back to top |
|
|
bueno
Tux's lil' helper
Joined: 08 Jun 2003
Posts: 94
Location: cannes-nice
|
| Posted: Wed Sep 24, 2003 3:26 pm Post subject: |
|
|
hello,
i've a prbl
i've emerge openldap and i've tupe hostname...I obtain "sqall.maryblue.homeip.net"
I've type this to create the root pass :
| Code: | | # slappasswd -h {MD5} |
so I put this in my /etc/oenldap/slapd.conf
| Code: |
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
access to dn=".*,dc=maryblue.homeip,dc=net" attr=userPassword
by dn="cn=root,dc=maryblue.homeip,dc=net" write
by self write
by * auth
access to dn=".*,dc=maryblue.homeip,dc=net"
by * read
defaultaccess none
TLSCertificateFile /etc/openldap/ssl/ldap.pem
TLSCertificateKeyFile /etc/openldap/ssl/ldap.pem
TLSCipherSuite HIGH:+MEDIUM:!LOW
TLSVerifyClient never
database ldbm
suffix "dc=maryblue.homeip,dc=net"
suffix "o=SPACEONE,c=FR"
rootdn "cn=root,dc=maryblue.homeip,dc=net"
rootpw {MD5}ZKZ99fgVxoVG5CznpIa7fA==
directory /var/lib/openldap-ldbm
index objectClass,uid,uidNumber,gidNumber eq
index cn,surname,givenname eq,subinitial
|
and when I type this I've a prbl (I'm in root)
| Code: |
/etc/init.d/slapd start
* Starting ldap-server...
/etc/openldap/slapd.conf: Permission denied [ !! ]
|
Can you help me please ?
bueno  |
|
| Back to top |
|
|
Carlo
Developer
Joined: 12 Aug 2002
Posts: 3356
|
| Posted: Wed Sep 24, 2003 6:44 pm Post subject: |
|
|
bueno: Comment out the TLS lines, to ensure that this isn't your problem.
Carlo
_________________
Please make sure that you have searched for an answer to a question after reading all the relevant docs. |
|
| Back to top |
|
|
adamtheo
Tux's lil' helper
Joined: 03 Sep 2002
Posts: 123
Location: Tallahassee, Florida USA
|
| Posted: Wed Sep 24, 2003 9:52 pm Post subject: |
|
|
RESOLVED!!! See next post by me. Thanks Koon and all for the help!
Koon:
Hereis the output of slapd when started in debug mode 768 and running "getent passwd":
| Quote: |
daemon: conn=5 fd=10 connection from IP=66.13.154.254:32959 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 10
conn=5 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 10
conn=5 op=1 RESULT tag=97 err=0 text=
conn=5 op=2 SRCH base="dc=theoretic,dc=com" scope=1 filter="(objectClass=posixAccount)"
ber_flush: 14 bytes to sd 10
conn=5 op=2 SEARCH RESULT tag=101 err=0 text=
conn=-1 fd=10 closed
|
Here is the output when running "getent group":
| Quote: |
daemon: conn=6 fd=10 connection from IP=66.13.154.254:32960 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 10
conn=6 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 10
conn=6 op=1 RESULT tag=97 err=0 text=
conn=6 op=2 SRCH base="dc=theoretic,dc=com" scope=1 filter="(&(objectClass=posixGroup))"
ber_flush: 14 bytes to sd 10
conn=6 op=2 SEARCH RESULT tag=101 err=0 text=
conn=-1 fd=10 closed
|
And here is the output when trying to log into a user account that is listed in LDAP:
| Quote: |
daemon: conn=7 fd=10 connection from IP=66.13.154.254:32961 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 10
conn=7 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 10
conn=7 op=1 RESULT tag=97 err=0 text=
conn=7 op=2 SRCH base="dc=theoretic,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=adamtheo))"
ber_flush: 14 bytes to sd 10
conn=7 op=2 SEARCH RESULT tag=101 err=0 text=
conn=-1 fd=10 closed
daemon: conn=8 fd=10 connection from IP=66.13.154.254:32962 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 10
conn=8 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 10
conn=8 op=1 RESULT tag=97 err=0 text=
conn=8 op=2 SRCH base="dc=theoretic,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=adamtheo))"
ber_flush: 14 bytes to sd 10
conn=8 op=2 SEARCH RESULT tag=101 err=0 text=
conn=-1 fd=10 closed
daemon: conn=9 fd=10 connection from IP=66.13.154.254:32963 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 10
conn=9 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 10
conn=9 op=1 RESULT tag=97 err=0 text=
conn=9 op=2 SRCH base="dc=theoretic,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=adamtheo))"
ber_flush: 14 bytes to sd 10
conn=9 op=2 SEARCH RESULT tag=101 err=0 text=
|
And here is the output when I try to "su" into the user account:
| Quote: |
daemon: conn=12 fd=10 connection from IP=66.13.154.254:32966 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 10
conn=12 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 10
conn=12 op=1 RESULT tag=97 err=0 text=
conn=12 op=2 SRCH base="dc=theoretic,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=adamtheo))"
ber_flush: 14 bytes to sd 10
conn=12 op=2 SEARCH RESULT tag=101 err=0 text=
conn=-1 fd=10 closed
|
Also, when I try to do an "ldapsearch -LL -ZZ -H ldap://new.theoretic.com -b "dc=theoretic,dc=com" -x "(uid=adamtheo)"" command from the same server, I get the following:
| Quote: |
daemon: conn=7 fd=9 connection from IP=66.13.154.254:32996 (IP=:: 389) accepted.
ber_flush: 14 bytes to sd 9
conn=7 op=1 BIND dn="" method=128
ber_flush: 14 bytes to sd 9
conn=7 op=1 RESULT tag=97 err=0 text=
conn=7 op=2 SRCH base="dc=theoretic,dc=com" scope=2 filter="(uid=adamtheo)"
ber_flush: 14 bytes to sd 9
conn=7 op=2 SEARCH RESULT tag=101 err=0 text=
conn=7 op=3 UNBIND
conn=-1 fd=9 closed
|
Also, what's funny is that I have installed GQ on my desktop at home, and I can run it, and get the proper information queried from the LDAP directory. I can see and modify the users, their passwords, groups, etc. Here is the slapd debug from when I access a particular user's account:
| Quote: |
conn=8 op=18 SRCH base="uid=reatmon,ou=Users,dc=theoretic,dc=com" scope=0 filter="(objectClass=*)"
ber_flush: 340 bytes to sd 9
conn=8 op=18 ENTRY dn="uid=reatmon,ou=Users,dc=theoretic,dc=com"
ber_flush: 14 bytes to sd 9
conn=8 op=18 SEARCH RESULT tag=101 err=0 text=
|
To my untrained eye it is now looking like the GQ queries are succeeding where the PAM/NSS queries are not is because GQ is looking in "ou=Users,dc=theoretic,dc=com", whereas PAM/NSS is just looking in "dc=theoretic,dc=com" for the posixAccount user. If this is the case, how do I get PAM/NSS to query the right 'ou'? Is that in '/etc/ldap.conf'?
Thanks.
_________________
* Theoretic Solutions "The Internet's Open Think-Tank" - http://www.theoretic.com
Last edited by adamtheo on Thu Sep 25, 2003 2:35 am; edited 1 time in total |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
