For users with REAL system account (/etc/passwd), I see entries in the syslog like this:
Dec 5 17:12:25 uacp-demo slapd[1882]: conn=294 op=0 BIND dn="" method=128
Dec 5 17:12:25 uacp-demo slapd[1882]: conn=294 op=0 RESULT tag=97 err=0 text=
Dec 5 17:12:25 uacp-demo slapd[1882]: conn=294 op=1 SRCH base="ou=People,dc=uccinc,dc=net" scope=2 filter="(&(objectClass=posixAccount)(uid=nagios))"
Dec 5 17:12:26 uacp-demo slapd[1882]: conn=294 op=1 SEARCH RESULT tag=101 err=0 text=
Dec 5 17:12:26 uacp-demo slapd[1881]: conn=294 op=2 UNBIND
It seems to be authenticating okay...but...
When I create a user in the LDAP directory (one that's not listed in /etc/passwd), I'm not able to authenticate this user.
Any ideas as to why this isn't working?
The relevant config files are attached (please let me know if I missed any): /etc/ldap.conf /etc/openldap/slapd.conf /etc/conf.d/slapd /etc/pam.d/sshd (this file wasn't discussed in the Guide) /etc/pam.d/system-auth
#suffix "dc=uccinc,dc=net" #pam_filter objectclass=posixAccount #pam_member_attribute memberuid #host 127.0.0.1 uri ldap://uacp-demo.uccinc.net ldap_version 3 base dc=uccinc,dc=net scope sub timelimit 30 pam_login_attribute uid pam_filter objectclass=posixAccount nss_base_passwd ou=People,dc=uccinc,dc=net nss_base_shadow ou=People,dc=uccinc,dc=net nss_base_group ou=People,dc=uccinc,dc=net #scope one #pam_password exop #nss_base_passwd ou=People,dc=uccinc,dc=net #nss_base_shadow ou=People,dc=uccinc,dc=net #nss_base_group ou=Group,dc=uccinc,dc=net #nss_base_hosts ou=Hosts,dc=uccinc,dc=net #ssl start_tls #ssl on
# conf.d file for the openldap-2.1 series # # To enable both the standard unciphered server and the ssl encrypted # one uncomment this line or set any other server starting options # you may desire. # # OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'" OPTS="-h ldap:// ldaps:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock"
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.7 2001/09/27 20:00:31 kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
password-hash {crypt}
TLSCertificateFile /etc/ssl/ldap.pem
TLSCertificateKeyFile /etc/openldap/ssl/ldap.pem
TLSCACertificateFile /etc/ssl/ldap.pem
# Define global ACLs to disable default read access.
access to dn=".*,dc=uccinc,dc=net" attr="userPassword"
by dn="uid=root,ou=People,dc=uccinc,dc=net" write
by anonymous auth
by self write
by * search
access to *
by dn="uid=root,ou=People,dc=uccinc,dc=net" write
by * read
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
# Load dynamic backend modules:
# modulepath /usr/lib/openldap/openldap
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la
#
# Sample Access Control
# Allow read access of root DSE
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
#
#access to dn="" by * read
#access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default is:
# Allow read by all
#
# rootdn can always write!
#######################################################################
# ldbm database definitions
#######################################################################
database ldbm
suffix "dc=uccinc,dc=net"
#suffix "o=My Organization Name,c=US"
rootdn "cn=Manager,dc=uccinc,dc=net"
#rootdn "cn=Manager,o=My Organization Name,c=US"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw {MD5}bCnpzEBC2XKxX/AwTmNohg==
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd/tools. Mode 700 recommended.
directory /var/lib/openldap-ldbm
# Indices to maintain
index objectClass eq
#%PAM-1.0 #auth required pam_stack.so service=system-auth #auth required pam_shells.so #auth required pam_nologin.so #account required pam_stack.so service=system-auth #password required pam_stack.so service=system-auth #session required pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so auth sufficient /lib/security/pam_ldap.so auth required /lib/security/pam_unix.so shadow nullok use_first_pass account sufficient /lib/security/pam_ldap.so account required /lib/security/pam_unix.so password required /lib/security/pam_cracklib.so password required /lib/security/pam_unix.so nullok use_authtok shadow session required /lib/security/pam_unix.so session optional /lib/security/pam_console.so
#%PAM-1.0 # LDAP system-auth config. auth sufficient /lib/security/pam_ldap.so use_first_pass account sufficient /lib/security/pam_ldap.so password sufficient /lib/security/pam_ldap.so use_authtok session required /lib/security/pam_mkhomedir.so skel=/etc/skel umask=0 session optional /lib/security/pam_ldap.so # Standard Linux system-auth config. auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_unix.so likeauth nullok nodelay auth required /lib/security/pam_deny.so account required /lib/security/pam_unix.so password required /lib/security/pam_cracklib.so retry=3 password sufficient /lib/security/pam_unix.so nullok md5 shadow use_authtok password required /lib/security/pam_deny.so session required /lib/security/pam_limits.so session required /lib/security/pam_unix.so
-- [EMAIL PROTECTED] mailing list
