I'm trying to configure Ubuntu 10.04 so that I can login using ldap credentials.
I've followed these general configuration steps outlined in several tutorials I found:
1) Install libraries:
sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd
2) entered in the connection details when prompted by libnss_ldap
3) configured nsswitch.conf to use ldap:
...
passwd: files ldap
group: files ldap
shadow: files ldap
...
4) configured pam.d common-* files
Here's the contents of "common-auth":
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so use_first_pass
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
I've tried this on 2 linux servers. Neither seems to recognize any ldap users. For example, getent passwd <ldap username>
doesn't return anything. id <ldap username>
returns no such user
.
If I try to ssh using my ldap credential, I see this in the auth.log:
Jun 2 14:16:50 hostnameXX sshd[1527]: pam_unix(sshd:auth): check pass; user unknown
Jun 2 14:16:50 hostnameXX sshd[1527]: pam_unix(sshd:auth): authentication failure; logname=uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.xx.xx
UPDATE
I uncommented the following in ldap.conf:
nss_base_passwd ou=xxx,dc=xxx,dc=xxx
nss_base_shadow ou=xxx,dc=xxx,dc=xxx
nss_base_group ou=xxx,dc=xxx,dc=xxx
and now making a little progress - I'm now seeing this in the auth.log:
Jun 2 16:15:03 <hostname> sshd[1566]: pam_ldap: error trying to bind as user cn=xxxx,ou=xxx,dc=xxx,dc=xx" (Invalid credentials)
Jun 2 16:15:05 <hostname> sshd[1566]: Failed password for invalid user xxxx from xx.xx.xx.xx port xxxx ssh2
If I do an ldapsearch
using the same host and base dn as specified in ldap.conf, I can query and find my ldap user account successfully.
What am I missing? Maybe some service needs to be started? Thanks much for any help.