You probably also want a line in the account section for
pam_ldap.so.
Im not as familiar with opie (know what it is, just havent used
it much), but since it is set as requisite and before the ldap module, its possibly
failing your auth stack if you don’t have it setup properly. Test with it
commented out using your ldap user, and again with ldap commented out using a
local user. Make sure ldap is working by itself (and the same for opie) before
laying other stuff on top of it. Consult the various pam-opie-ldap integration
guides on the best way to get that working together.
Since you have pam.d/common-*, those are likely the files you
will want to edit rather than sshd. The sshd pam config file probably has a
line that includes the common stack files, which should already have the basic
stack in them, duplicating it in sshd will cause problems.
(I assume this is a debian style system) Also check that your
pam_ldap.conf is setup the same as libnss-ldap.conf, you can probably replace
it with a symlink to libnss-ldap.conf.
Don’t use rootbinddn, use binddn or just comment them all
out. rootbinddn gets its password from a file and expects to be the root/cn=Manager
user of your directory. Its generally not needed for auth. The bindpw is the pw
for binddn, which should be a user that can read user/group entries, and auth
to userPassword. If your directory allows anonymous reads, you can comment both
out and pam will work with anonymous binds.
You can generally leave the nss_base_* mappings all commented
out unless your directory is setup strangely, and you probably want
pam_password set to exop so that ldap handles passwords internally rather than
forcing a method (unless you have a reason for it (opie req?)).
-T
From:
openldap-technical-bounces+tmackey=zetta.net@OpenLDAP.org
[mailto:openldap-technical-bounces+tmackey=zetta.net@OpenLDAP.org] On Behalf
Of dubois.michel@gmail.com
Sent: Wednesday, April 21, 2010 1:57 AM
To: openldap-technical@openldap.org
Subject: Re: Re: OpenLDAP and SSH authentification
Thanks to all .........
I add this following in the /etc/libnss-ldap.conf on the server side :
rootbinddn cn=proxyuser,dc=exemple,dc=org
bindpw proxy
pam_password MD5
nss_base_passwd ou=people,dc=exemple,dc=org?one
nss_base_shadow ou=people,dc=exemple,dc=org?one
nss_base_group ou=groups,dc=exemple,dc=org?one
and I add this line in the /etc/pam.d/common-session file :
session required pam_mkhomedir.so skel=/etc/skel/
for creating the home dir when the user is connecting for the first time...
Thanks for your help anyway...........
Le , Ariel <ariel@bidcactus.com> a écrit :
> In your /etc/nsswitch.conf
>
>
> Try changing to these lines:
>
>
> passwd: files ldap
> group: files ldap
> shadow: files ldap
>
>
> Also in pam.d/sshd password section try adding:
>
>
> password sufficient pam_ldap.so
>
>
>
>
> To make much of this easier you might want to install packages something
like this for your distro:
> libpam-ldap
> libnss-ldap
> ldap-auth-client
> ldap-auth-config
>
>
> Good luck.
> -a
>
>
>
>
> On Apr 20, 2010, at 3:15 AM, Michel Dubois wrote:
>
> Hello Everyone,
>
> I'm newbie on OpenLDAP. I build a LDAP server with one user. I can see
this user when I did a "getent passwd" on my
client. This is meaning that my LDAP server is working and my client
is connecting on the LDAP server.
>
> I already modify my /etc/pam.d/sshd file on t my client machine like
this :
>
>
> # auth
> auth required pam_nologin.so no_warn
> auth sufficient pam_opie.so no_warn no_fake_prompts
> auth requisite pam_opieaccess.so no_warn allow_local
> auth sufficient /usr/local/lib/pam_ldap.so no_warn
> auth required pam_unix.so no_warn try_first_pass
>
> # account
> account required pam_login_access.so
> account required pam_unix.so
>
> # session
> session required pam_permit.so
>
> # password
> password required pam_unix.so no_warn try_first_pass
>
>
>
>
>
>
>
> But I can't be connected in shh mode on my client machine with the user
login ? And this modification disable my ssh root connection.
>
> What do I have to check?
> Regards,
>
> --
> -----------------------------------------------------------
> Michel Dubois
>
>
>
>
>
>
>
>