1 |
I am currently trying to make a ldap server which i can use to authenticate users. Sadly a large number of how to's are incomplete and don't work, so after reading alot of how to's and manuals I have got 99.9% of the way. On attempting to authenticate a user it denies the user access with a error from auth.log |
2 |
|
3 |
May 4 02:21:08 nemo sshd[1271]: error: PAM: authentication error for william from 172.20.0.1 |
4 |
|
5 |
I can succesfully search the ldap with this user binding to the ldap |
6 |
|
7 |
ldapsearch -x -D "uid=william,ou=Admin,dc=chocolate,dc=lan" -W '(uid=william)' |
8 |
Enter LDAP Password: |
9 |
# extended LDIF |
10 |
# |
11 |
# LDAPv3 |
12 |
# base <dc=chocolate,dc=lan> (default) with scope subtree |
13 |
# filter: (uid=william) |
14 |
# requesting: ALL |
15 |
# |
16 |
|
17 |
# william, Admin, chocolate.lan |
18 |
dn: uid=william,ou=Admin,dc=chocolate,dc=lan |
19 |
uid: william |
20 |
cn: william |
21 |
objectClass: account |
22 |
objectClass: posixAccount |
23 |
objectClass: shadowAccount |
24 |
objectClass: top |
25 |
loginShell: /bin/bash |
26 |
uidNumber: 10000 |
27 |
gidNumber: 10000 |
28 |
homeDirectory: /home/william |
29 |
userPassword:: e1NTSEF9Z3BQd05Lc3JUMWwxSVNhOVQvN1dPb3ZOcnVBSXJwVTE= |
30 |
gecos: William Brown,,,, |
31 |
description: William Brown |
32 |
shadowLastChange: 1 |
33 |
shadowMax: 0 |
34 |
shadowExpire: 0 |
35 |
|
36 |
# search result |
37 |
search: 2 |
38 |
result: 0 Success |
39 |
|
40 |
# numResponses: 2 |
41 |
# numEntries: 1 |
42 |
|
43 |
Slapd when trying to authenticate shows this. |
44 |
|
45 |
/usr/local/libexec/slapd -4 -d 256 |
46 |
|
47 |
slapd starting |
48 |
conn=0 fd=10 ACCEPT from IP=127.0.0.1:28629 (IP=0.0.0.0:389) |
49 |
conn=0 op=0 BIND dn="" method=128 |
50 |
conn=0 op=0 RESULT tag=97 err=0 text= |
51 |
connection_input: conn=0 deferring operation: binding |
52 |
conn=0 op=1 SRCH base="ou=Nemo,ou=Group,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixGroup))" |
53 |
conn=0 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber |
54 |
conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= |
55 |
conn=0 op=2 SRCH base="ou=Marvin,ou=Group,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixGroup))" |
56 |
conn=0 op=2 SRCH attr=cn userPassword memberUid uniqueMember gidNumber |
57 |
conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= |
58 |
conn=0 fd=10 closed (connection lost) |
59 |
conn=1 fd=10 ACCEPT from IP=127.0.0.1:43475 (IP=0.0.0.0:389) |
60 |
conn=1 op=0 BIND dn="" method=128 |
61 |
conn=1 op=0 RESULT tag=97 err=0 text= |
62 |
connection_input: conn=1 deferring operation: binding |
63 |
conn=1 op=1 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" |
64 |
conn=1 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire |
65 |
<= bdb_equality_candidates: (uid) not indexed |
66 |
conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= |
67 |
conn=2 fd=12 ACCEPT from IP=127.0.0.1:15318 (IP=0.0.0.0:389) |
68 |
conn=2 op=0 BIND dn="" method=128 |
69 |
conn=2 op=0 RESULT tag=97 err=0 text= |
70 |
connection_input: conn=2 deferring operation: binding |
71 |
conn=2 op=1 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" |
72 |
conn=2 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire |
73 |
<= bdb_equality_candidates: (uid) not indexed |
74 |
conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= |
75 |
conn=2 op=2 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" |
76 |
conn=2 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire |
77 |
<= bdb_equality_candidates: (uid) not indexed |
78 |
conn=2 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= |
79 |
conn=2 fd=12 closed (connection lost) |
80 |
conn=3 fd=12 ACCEPT from IP=127.0.0.1:63485 (IP=0.0.0.0:389) |
81 |
conn=3 op=0 BIND dn="" method=128 |
82 |
conn=3 op=0 RESULT tag=97 err=0 text= |
83 |
connection_input: conn=3 deferring operation: binding |
84 |
conn=3 op=1 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" |
85 |
conn=3 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire |
86 |
<= bdb_equality_candidates: (uid) not indexed |
87 |
conn=3 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= |
88 |
conn=3 op=2 SRCH base="ou=Admin,dc=chocolate,dc=lan" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=william))" |
89 |
conn=3 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass shadowLastChange shadowMax shadowExpire |
90 |
<= bdb_equality_candidates: (uid) not indexed |
91 |
conn=3 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= |
92 |
conn=3 fd=12 closed (connection lost) |
93 |
conn=1 fd=10 closed (connection lost) |
94 |
|
95 |
|
96 |
Here is my /etc/ldap.conf |
97 |
base dc=chocolate,dc=lan |
98 |
suffix dc=chocolate,dc=lan |
99 |
uri ldap://ldap.srv.chocolate.lan |
100 |
ldap_version 3 |
101 |
rootbinddn cn=Manager,dc=chocolate,dc=lan |
102 |
scope one |
103 |
timelimit 3 |
104 |
bind_timelimit 3 |
105 |
bind_policy soft |
106 |
pam_filter objectclass=posixAccount |
107 |
pam_login_attribute uid |
108 |
pam_check_host_attr no |
109 |
pam_member_attribute memberuid |
110 |
pam_password exop |
111 |
nss_reconnect_tries 4 # number of times to double the sleep time |
112 |
nss_reconnect_sleeptime 1 # initial sleep value |
113 |
nss_reconnect_maxsleeptime 16 # max sleep value to cap at |
114 |
nss_reconnect_maxconntries 2 # how many tries before sleeping |
115 |
nss_base_passwd ou=Admin,dc=chocolate,dc=lan?one |
116 |
nss_base_passwd ou=People,dc=chocolate,dc=lan?one |
117 |
nss_base_shadow ou=Admin,dc=chocolate,dc=lan?one |
118 |
nss_base_shadow ou=People,dc=chocolate,dc=lan?one |
119 |
nss_base_group ou=Nemo,ou=Group,dc=chocolate,dc=lan?one |
120 |
nss_base_group ou=Marvin,ou=Group,dc=chocolate,dc=lan?one |
121 |
ssl off |
122 |
|
123 |
Here is /etc/openldap/slapd.conf |
124 |
|
125 |
include /usr/local/etc/openldap/schema/core.schema |
126 |
include /usr/local/etc/openldap/schema/cosine.schema |
127 |
include /usr/local/etc/openldap/schema/inetorgperson.schema |
128 |
include /usr/local/etc/openldap/schema/nis.schema |
129 |
pidfile /var/run/openldap/slapd.pid |
130 |
argsfile /var/run/openldap/slapd.args |
131 |
modulepath /usr/local/libexec/openldap |
132 |
moduleload back_bdb |
133 |
access to attrs=userPassword |
134 |
by dn="uid=william,ou=Admin,dc=chocolate,dc=lan" write |
135 |
by anonymous auth |
136 |
by self write |
137 |
by * none |
138 |
access to * |
139 |
by self write |
140 |
by users read |
141 |
database bdb |
142 |
suffix "dc=chocolate,dc=lan" |
143 |
rootdn "cn=Manager,dc=chocolate,dc=lan" |
144 |
rootpw {SSHA}pG0QHakwiNmJHXcyTB5H4RQtoDAGbEsm |
145 |
directory /var/db/openldap-data |
146 |
index objectClass eq |
147 |
index uid eq |
148 |
password-hash {SSHA} |
149 |
|
150 |
Here is the /etc/openldap/ldap.conf from both the client and server |
151 |
|
152 |
BASE dc=chocolate,dc=lan |
153 |
URI ldap://ldap.srv.chocolate.lan |
154 |
|
155 |
Any help with this would be greatly appreciated |
156 |
|
157 |
William |