SkyLeach
Apprentice
Joined: 05 Nov 2002
Posts: 177
Location: Knoxville, TN
|
 Posted: Mon Aug 15, 2005 8:32 pm Post subject: Trouble with pam_ldap and sshd (fixed but still have quest) |
 |
|
I've pseudo-followed the ldap gentoo authentication guide (http://www.gentoo.org/doc/en/ldap-howto.xml) to get my users and groups moved into ldap for my home network configuration. Everything appears to be correct in my various files and I can log in from tty0-5 but not via the ptys (sshd)
/etc/pam.d/system-auth
| Code: | #%PAM-1.0
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok shadow
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_ldap.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 ret
ry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0
session optional pam_ldap.so
|
My nonroot user for this example is skyleach. The user is in ldap and configured properly. I can log in on tty0-5 but not via sshd:
| Code: |
goliath ~ # getent passwd | grep skyleach
skyleach:x:1000:100:skyleach:/home/skyleach:
goliath ~ # grep skyleach /etc/passwd
goliath ~ #
goliath ~ # ldapsearch -x -W -D uid=skyleach,ou=People,dc=gregory,dc=home "(uid=skyleach)" dn
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <> with scope sub
# filter: (uid=skyleach)
# requesting: dn
#
# skyleach, People, gregory.home
dn: uid=skyleach,ou=People,dc=gregory,dc=home
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
|
So my question is, why can't I log in via ssh? I checked the pam sshd config:
/etc/pam.d/sshd
| Code: |
#%PAM-1.0
auth required pam_stack.so service=system-auth
auth required pam_shells.so
auth required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
|
and as you can see, it's using pam_stack to system-auth so it should be pulling in my ldap settings.
==== UPDATE ====
I used getent passwd | grep skyleach >> /etc/passwd to add my user information to passwd and then set my shell to /bin/bash
| Code: |
goliath ~ # getent passwd | grep skyleach >> /etc/passwd
|
and it fixed the problem. But I don't want to have to add all my users to passwd to manage them. I want my users to be managed via ldap. Am I missing something here? I thought this was supposed to solve this problem.
_________________
-SL
http://www.skyleach.org |
|
Networking & Security
