Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- server: OpenLDAP 2.4.43
- clients: nss-pam-ldapd 0.9.6
- I've added an LDAP password for my user on the server.
- ---
- $ ldappasswd -xWD "cn=manager,dc=my,dc=example,dc=com" -S "uid=james,ou=users,dc=my,dc=example,dc=com"
- New password:
- Re-enter new password:
- Enter LDAP Password:
- That seems to work. Then, try to ssh to an ldap client machine returns the following.
- ---
- $ ssh 10.10.10.120
- You are required to change your password immediately (root enforced)
- WARNING: Your password has expired.
- You must change your password now and login again!
- passwd: User not known to the underlying authentication module
- passwd: password unchanged
- Connection to 10.10.10.120 closed.
- Here is /etc/pam.d/system-auth on client and server side.
- ---
- auth required pam_env.so
- auth required pam_unix.so try_first_pass likeauth nullok
- auth optional pam_permit.so
- auth sufficient pam_ldap.so use_first_pass
- account required pam_unix.so
- account optional pam_permit.so
- account sufficient pam_ldap.so
- password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
- password required pam_unix.so try_first_pass use_authtok nullok sha512 shadow
- password optional pam_permit.so
- password sufficient pam_ldap.so use_authtok use_first_pass
- session required pam_limits.so
- session required pam_env.so
- session required pam_unix.so
- session optional pam_permit.so
- session optional pam_ldap.so
- /etc/nslcd.conf
- ---
- uid nslcd
- gid nslcd
- uri ldap://10.10.10.100/
- base dc=my,dc=example,dc=com
- /etc/nsswitch.conf on client
- ---
- passwd: compat ldap
- shadow: compat ldap
- group: compat ldap
- hosts: files dns
- networks: files dns
- services: db files
- protocols: db files
- rpc: db files
- ethers: db files
- netmasks: files
- netgroup: files
- bootparams: files
- automount: files
- aliases: files
- /etc/ldap.conf on client
- ---
- host 10.10.10.100
- base dc=my,dc=example,dc=com
- uri ldap://10.10.10.100/
- ldap_version 3
- pam_password exop
- pam_filter objectclass=posixAccount
- nss_reconnect_tries 4
- nss_reconnect_sleeptime 1
- nss_reconnect_maxsleeptime 16
- nss_reconnect_maxconntries 2
- nss_initgroups_ignoreusers ldap,openldap,mysql,syslog,root,postgres
- When trying to ssh into an ldap client, the following appears in the server /var/log/messages file.
- ---
- Jan 2 18:44:09 machine slapd[9347]: conn=1005 op=26 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:09 machine slapd[9347]: conn=1005 op=26 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:09 machine slapd[9347]: conn=1005 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=8 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=8 SRCH attr=uid uidNumber
- Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=8 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=9 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=james)(member=uid=james,ou=users,dc=my,dc=example,dc=com)))"
- Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=9 SRCH attr=cn gidNumber
- Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (memberUid) not indexed
- Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (member) not indexed
- Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=9 SEARCH RESULT tag=101 err=0 nentries=0 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=10 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=10 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=10 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=11 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=11 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=11 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=12 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=12 SRCH attr=shadowFlag shadowMax shadowMin shadowLastChange uid shadowExpire shadowInactive shadowWarning
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=12 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=13 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=13 SRCH attr=uid uidNumber
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=13 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=14 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=14 SRCH attr=shadowFlag shadowMax shadowMin shadowLastChange uid shadowExpire shadowInactive shadowWarning
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=14 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=15 ABANDON msg=15
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=16 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=16 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=16 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=17 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=17 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=17 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=18 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=18 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=18 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=19 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=19 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=19 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=20 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=20 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=20 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=21 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=21 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=21 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=22 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=22 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=22 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=23 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=23 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=24 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=24 SRCH attr=uid uidNumber
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=25 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=james)(member=uid=james,ou=users,dc=my,dc=example,dc=com)))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=25 SRCH attr=cn gidNumber
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (memberUid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (member) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=25 SEARCH RESULT tag=101 err=0 nentries=0 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=26 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=26 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=27 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=27 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=27 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=28 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=28 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=28 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=27 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=1000))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=27 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uidNumber) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=27 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=28 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=28 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=28 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=29 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=29 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=29 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=29 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=29 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=29 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=30 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=30 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=30 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=31 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=31 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=31 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=32 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=32 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=32 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=33 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=33 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=33 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=34 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=34 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
- Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=34 SEARCH RESULT tag=101 err=0 nentries=1 text=
- Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=35 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=root))"
- Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=35 SRCH attr=uid uidNumber
- Jan 2 18:46:07 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
- Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=35 SEARCH RESULT tag=101 err=0 nentries=0 text=
- Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=36 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=root))"
- Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=36 SRCH attr=cn gidNumber
- Jan 2 18:46:07 machine slapd[9347]: <= mdb_equality_candidates: (memberUid) not indexed
- Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=36 SEARCH RESULT tag=101 err=0 nentries=0 text=
Advertisement
Add Comment
Please, Sign In to add comment