auth.log error with nss-pam-ldapd in LDAP client
- Reply: Souji Thenria : "Re: auth.log error with nss-pam-ldapd in LDAP client"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 08 Jan 2024 12:49:59 UTC
Hello!
I am trying to configure the package nss-pam-ldapd in FreeBSD
14.0-RELEASE to have an LDAP client and LDAP authentication on a host
examplehost. The same host is also the LDAP server and it is running
openldap26-server-2.6.6. I followed all the steps related to FreeBSD
in the package author's documentation:
<https://arthurdejong.org/nss-pam-ldapd/setup>
(or at least I hope so!). If I run:
$ ldapsearch -x -b 'dc=examplehost,dc=domain' '(objectclass=*)'
I obtain some of the items stored in the LDAP database (even if not all
of them: is this normal?). So, the client somehow seems to work.
But there are two oddities.
1) In the output of `getent passwd' the LDAP users are listed, but this
is a local user entry:
localuser:*:1001:1001:Local User:/home/localuser:/bin/csh
while this is an LDAP user entry:
ldapuser:x:10001:10001:LDAP User:/home/ldapuser/:/usr/bin/csh
The second field is a `*' in the first case, while it is `x' in the
second case. Is this relevant?
Users are stored in the LDAP database as
objectClass: posixAccount
objectClass: shadowAccount
and their passwords are stored in the user entry as
userPassword: {SSHA}<some_string>
2) I tried to configure /etc/pam.d/sshd for LDAP authentication as
follows:
auth sufficient /usr/local/lib/pam_ldap.so minimum_uid=10000 use_first_pass
auth required pam_unix.so no_warn try_first_pass
account required pam_nologin.so
account required pam_login_access.so
account sufficient /usr/local/lib/pam_ldap.so minimum_uid=10000
account required pam_unix.so
session required /usr/local/lib/pam_mkhomedir.so
session required pam_permit.so
password required pam_unix.so no_warn try_first_pass
Despite this, if I try to log into the system remotely as an LDAP user,
$ ssh ldapuser@examplehost
(ldapuser@examplehost) Password for ldapuser@examplehost:
even before typing the password, in /var/log/auth.log of examplehost
this line appears:
Jan 8 13:30:45 examplehost sshd[34445]: failed to get password: Authentication error
How is it possible? What is wrong with this configuration? With
openldap24-client this /etc/pam.d/sshd worked.
Bye!
Rocky