[gentoo-user-fr] Re: ssh et ldap

[Christophe PEREZ]

Le Thu, 20 Apr 2006 09:02:45 -0400, Christophe PEREZ a écrit :

> De plus, poursuivant à l'instant mes investigations, je me rends compte
> que ldapsearch -x -W -D "cn=Manager,dc=novazur,dc=fr" "uid=chris" en root
> me donne bien le résultat souhaité, aussi bien sur le serveur que le
> client.

Bon, stupide erreur de ma part. Evidemment, une simple question de droits.
En effet, nss_ldap se base sur /etc/ldap.conf, mais les outils openldap
(ldapsearch etc...) eux, même sur le client, se basent sur
/etc/openldap/ldap.conf.
Or, ce fichier était en 640 root:ldap, donc évidemment lisible
uniquement en root.

[...]
> Ceci dit, je ne vois pas comment un problème de paramétrage sur le
> serveur pourrait causer un dysfonctionnement de ssh sur un seul poste.

Et évidemment, ça ne règle absolument pas le pb d'accès ssh.
C'est quand même dingue.

Voici les logs les plus verbeux que j'ai avec ssh, mais ça ne me
renseigne pas beaucoup plus sur l'erreur nss_ldap :

Apr 21 16:47:45 KanelXP sshd[18203]: debug1: rexec start in 4 out 4 newsock 4 pipe 6 sock 7
Apr 21 16:47:45 KanelXP sshd[18194]: debug1: Forked child 18203.
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: inetd sockets after dupping: 3, 3
Apr 21 16:47:45 KanelXP sshd[18203]: Connection from 192.168.0.101 port 37307
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: Client protocol version 2.0; client software version OpenSSH_4.3
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: match: OpenSSH_4.3 pat OpenSSH*
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: Enabling compatibility mode for protocol 2.0
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: Local version string SSH-2.0-OpenSSH_4.3
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: temporarily_use_uid: 501/100 (e=0/0)
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: trying public key file /home/chris/.ssh/authorized_keys
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: matching key found: file /home/chris/.ssh/authorized_keys, line 2
Apr 21 16:47:45 KanelXP sshd[18203]: Found matching RSA key: 40:74:69:42:64:d1:0e:f6:06:58:b9:04:f5:8a:43:72
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: restore_uid: 0/0
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: temporarily_use_uid: 501/100 (e=0/0)
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: trying public key file /home/chris/.ssh/authorized_keys
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: matching key found: file /home/chris/.ssh/authorized_keys, line 2
Apr 21 16:47:45 KanelXP sshd[18203]: Found matching RSA key: 40:74:69:42:64:d1:0e:f6:06:58:b9:04:f5:8a:43:72
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: restore_uid: 0/0
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: ssh_rsa_verify: signature correct
Apr 21 16:47:45 KanelXP sshd[18203]: Accepted publickey for chris from 192.168.0.101 port 37307 ssh2
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: monitor_child_preauth: chris has been authenticated by privileged process
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: permanently_set_uid: 501/100
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: Entering interactive session for SSH2.
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: server_init_dispatch_20
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: server_input_channel_open: ctype session rchan 0 win 65536 max 16384
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: input_session_request
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: channel 0: new [server-session]
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: session_new: init
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: session_new: session 0
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: session_open: channel 0
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: session_open: session 0: link with channel 0
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: server_input_channel_open: confirm session
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: server_input_channel_req: channel 0 request pty-req reply 0
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: session_by_channel: session 0 channel 0
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: session_input_channel_req: session 0 req pty-req
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: Allocating pty.
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: session_new: init
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: session_new: session 0
Apr 21 16:47:45 KanelXP sshd[18203]: nss_ldap: could not search LDAP server - Can't contact LDAP server
Apr 21 16:47:45 KanelXP sshd[18203]: fatal: login_get_lastlog: Cannot find account for uid 501
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: do_cleanup
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: session_pty_cleanup: session 0 release /dev/pts/6
Apr 21 16:47:45 KanelXP sshd[18203]: nss_ldap: could not search LDAP server - Can't contact LDAP server
Apr 21 16:47:45 KanelXP sshd[18203]: fatal: login_init_entry: Cannot find user "chris"
Apr 21 16:47:45 KanelXP sshd[18203]: debug1: do_cleanup
Apr 21 16:47:45 KanelXP sshd[18208]: debug1: do_cleanup

Je poursuis mes recherches, mais si quelqu'un a une idée...
Merci.

-- 
Christophe PEREZ
-- 
gentoo-user-fr@g.o mailing list