Hi,
i'm trying to use pam_ldap and nss_ldap on a freebsd 5.3 box.
This is my first try to use ldap for sshd logins.
When the user exists in the files i can connect without problem.
I created the same user in ldap with a different password and i can login
with both passwords (files and ldap).
If the user exists only in ldap, it doesn't work
I receive the following error in debug.log
Jan 25 22:19:30 vmldap sshd[608]: NSSWITCH(nss_method_lookup): ldap,
group, setgrent, not found
Jan 25 22:19:30 vmldap sshd[608]: NSSWITCH(nss_method_lookup): ldap,
group, getgrent_r, not found
Jan 25 22:19:30 vmldap sshd[608]: NSSWITCH(nss_method_lookup): ldap,
group, endgrent, not found
Jan 25 22:19:30 vmldap sshd[609]: NSSWITCH(nss_method_lookup): ldap,
passwd, endpwent, not found
Can somebody have a look what i'm doing wrong?
If you need extra info don't hesitate to contact me.
Any help will be appreciated.
Thanks in advance,
Serge
uname -a: vmldap.ecss.be 5.3-RELEASE-p2 FreeBSD 5.3-RELEASE-p2 #0: Tue Dec
21 21:45:18 CET 2004
[EMAIL PROTECTED]:/usr/obj/usr/src/sys/ECXKERNEL i386
##nsswitch.conf
vmldap# cat /etc/nsswitch.conf
passwd: files [NOTFOUND=continue] ldap
group: files [NOTFOUND=continue] ldap
hosts: files dns
networks: files
shells: files
##nss_ldap.conf and ldap.conf
vmldap# cat /usr/local/etc/nss_ldap.conf
host 127.0.0.1
base dc=ecss,dc=be
scope sub
port 389
pam_password md5
ldap_version 3
pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_member_attribute memberUid
nss_base_passwd ou=people,dc=ecss,dc=be?one
nss_base_group ou=groups,dc=ecss,dc=be?one
nss_base_shadow ou=people,dc=ecss,dc=be?one
#debug testing
logdir /var/log
debug 9
vmldap# cat /etc/pam.d/sshd
#
# $FreeBSD: src/etc/pam.d/sshd,v 1.15 2003/04/30 21:57:54 markm Exp $
#
# PAM configuration for the sshd service
#
authsufficient /usr/local/lib/pam_ldap.so debug
try_first_pass
# auth
auth requiredpam_nologin.so no_warn
authsufficient pam_opie.so no_warn
no_fake_prompts
authrequisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn
try_first_pass
#auth sufficient pam_ssh.so no_warn
try_first_pass
authrequiredpam_unix.so no_warn
try_first_pass
# account
#accountrequiredpam_krb5.so
account requiredpam_login_access.so
account sufficient pam_ldap.so debug
account requiredpam_unix.so
# session
#sessionoptionalpam_ssh.so
session requiredpam_permit.so
# password
#password sufficient pam_krb5.so no_warn
try_first_pass
passwordsufficient pam_ldap.so debug
passwordrequiredpam_unix.so no_warn
try_first_pass
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]
