I'm trying to configure Ubuntu 10.04 so that I can login using ldap credentials.
I've followed these general configuration steps outlined in several tutorials I found:
1) Install libraries:
sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd
2) entered in the connection details when prompted by libnss_ldap
3) configured nsswitch.conf to use ldap:
... passwd: files ldap group: files ldap shadow: files ldap ...
4) configured pam.d common-* files
Here's the contents of "common-auth":
auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config
I've tried this on 2 linux servers. Neither seems to recognize any ldap users. For example,
getent passwd <ldap username> doesn't return anything.
id <ldap username> returns
no such user.
If I try to ssh using my ldap credential, I see this in the auth.log:
Jun 2 14:16:50 hostnameXX sshd: pam_unix(sshd:auth): check pass; user unknown Jun 2 14:16:50 hostnameXX sshd: pam_unix(sshd:auth): authentication failure; logname=uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.xx.xx
I uncommented the following in ldap.conf:
nss_base_passwd ou=xxx,dc=xxx,dc=xxx nss_base_shadow ou=xxx,dc=xxx,dc=xxx nss_base_group ou=xxx,dc=xxx,dc=xxx
and now making a little progress - I'm now seeing this in the auth.log:
Jun 2 16:15:03 <hostname> sshd: pam_ldap: error trying to bind as user cn=xxxx,ou=xxx,dc=xxx,dc=xx" (Invalid credentials) Jun 2 16:15:05 <hostname> sshd: Failed password for invalid user xxxx from xx.xx.xx.xx port xxxx ssh2
If I do an
ldapsearch using the same host and base dn as specified in ldap.conf, I can query and find my ldap user account successfully.
What am I missing? Maybe some service needs to be started? Thanks much for any help.