SRD

underlying authentication

SRD
Dec 22nd, 2015
279
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.35 KB | None | 0 0
  1. server: OpenLDAP 2.4.43
  2. clients: nss-pam-ldapd 0.9.6
  3.  
  4. I've added an LDAP password for my user on the server.
  5. ---
  6. $ ldappasswd -xWD "cn=manager,dc=my,dc=example,dc=com" -S "uid=james,ou=users,dc=my,dc=example,dc=com"
  7. New password:
  8. Re-enter new password:
  9. Enter LDAP Password:
  10.  
  11. That seems to work. Then, try to ssh to an ldap client machine returns the following.
  12. ---
  13. $ ssh 10.10.10.120
  14. You are required to change your password immediately (root enforced)
  15. WARNING: Your password has expired.
  16. You must change your password now and login again!
  17. passwd: User not known to the underlying authentication module
  18. passwd: password unchanged
  19. Connection to 10.10.10.120 closed.
  20.  
  21. Here is /etc/pam.d/system-auth on client and server side.
  22. ---
  23. auth required pam_env.so
  24. auth required pam_unix.so try_first_pass likeauth nullok
  25. auth optional pam_permit.so
  26. auth sufficient pam_ldap.so use_first_pass
  27. account required pam_unix.so
  28. account optional pam_permit.so
  29. account sufficient pam_ldap.so
  30. password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
  31. password required pam_unix.so try_first_pass use_authtok nullok sha512 shadow
  32. password optional pam_permit.so
  33. password sufficient pam_ldap.so use_authtok use_first_pass
  34. session required pam_limits.so
  35. session required pam_env.so
  36. session required pam_unix.so
  37. session optional pam_permit.so
  38. session optional pam_ldap.so
  39.  
  40. /etc/nslcd.conf
  41. ---
  42. uid nslcd
  43. gid nslcd
  44. uri ldap://10.10.10.100/
  45. base dc=my,dc=example,dc=com
  46.  
  47. /etc/nsswitch.conf on client
  48. ---
  49. passwd: compat ldap
  50. shadow: compat ldap
  51. group: compat ldap
  52.  
  53. hosts: files dns
  54. networks: files dns
  55.  
  56. services: db files
  57. protocols: db files
  58. rpc: db files
  59. ethers: db files
  60. netmasks: files
  61. netgroup: files
  62. bootparams: files
  63.  
  64. automount: files
  65. aliases: files
  66.  
  67.  
  68. /etc/ldap.conf on client
  69. ---
  70. host 10.10.10.100
  71. base dc=my,dc=example,dc=com
  72. uri ldap://10.10.10.100/
  73. ldap_version 3
  74. pam_password exop
  75. pam_filter objectclass=posixAccount
  76. nss_reconnect_tries 4
  77. nss_reconnect_sleeptime 1
  78. nss_reconnect_maxsleeptime 16
  79. nss_reconnect_maxconntries 2
  80. nss_initgroups_ignoreusers ldap,openldap,mysql,syslog,root,postgres
  81.  
  82. When trying to ssh into an ldap client, the following appears in the server /var/log/messages file.
  83. ---
  84. Jan 2 18:44:09 machine slapd[9347]: conn=1005 op=26 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  85. Jan 2 18:44:09 machine slapd[9347]: conn=1005 op=26 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  86. Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  87. Jan 2 18:44:09 machine slapd[9347]: conn=1005 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text=
  88. Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=8 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  89. Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=8 SRCH attr=uid uidNumber
  90. Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  91. Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=8 SEARCH RESULT tag=101 err=0 nentries=1 text=
  92. Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=9 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=james)(member=uid=james,ou=users,dc=my,dc=example,dc=com)))"
  93. Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=9 SRCH attr=cn gidNumber
  94. Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (memberUid) not indexed
  95. Jan 2 18:44:09 machine slapd[9347]: <= mdb_equality_candidates: (member) not indexed
  96. Jan 2 18:44:09 machine slapd[9347]: conn=1009 op=9 SEARCH RESULT tag=101 err=0 nentries=0 text=
  97. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=10 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  98. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=10 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  99. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  100. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=10 SEARCH RESULT tag=101 err=0 nentries=1 text=
  101. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=11 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  102. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=11 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  103. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  104. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=11 SEARCH RESULT tag=101 err=0 nentries=1 text=
  105. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=12 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=james))"
  106. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=12 SRCH attr=shadowFlag shadowMax shadowMin shadowLastChange uid shadowExpire shadowInactive shadowWarning
  107. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  108. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=12 SEARCH RESULT tag=101 err=0 nentries=1 text=
  109. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=13 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  110. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=13 SRCH attr=uid uidNumber
  111. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  112. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=13 SEARCH RESULT tag=101 err=0 nentries=1 text=
  113. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=14 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=james))"
  114. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=14 SRCH attr=shadowFlag shadowMax shadowMin shadowLastChange uid shadowExpire shadowInactive shadowWarning
  115. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  116. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=14 SEARCH RESULT tag=101 err=0 nentries=1 text=
  117. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=15 ABANDON msg=15
  118. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=16 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  119. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=16 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  120. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  121. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=16 SEARCH RESULT tag=101 err=0 nentries=1 text=
  122. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=17 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  123. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=17 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  124. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  125. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=17 SEARCH RESULT tag=101 err=0 nentries=1 text=
  126. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=18 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  127. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=18 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  128. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  129. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=18 SEARCH RESULT tag=101 err=0 nentries=1 text=
  130. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=19 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  131. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=19 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  132. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  133. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=19 SEARCH RESULT tag=101 err=0 nentries=1 text=
  134. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=20 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  135. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=20 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  136. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  137. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=20 SEARCH RESULT tag=101 err=0 nentries=1 text=
  138. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=21 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  139. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=21 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  140. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  141. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=21 SEARCH RESULT tag=101 err=0 nentries=1 text=
  142. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=22 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  143. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=22 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  144. Jan 2 18:44:17 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  145. Jan 2 18:44:17 machine slapd[9347]: conn=1009 op=22 SEARCH RESULT tag=101 err=0 nentries=1 text=
  146. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=23 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  147. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=23 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  148. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  149. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text=
  150. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=24 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  151. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=24 SRCH attr=uid uidNumber
  152. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  153. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text=
  154. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=25 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=james)(member=uid=james,ou=users,dc=my,dc=example,dc=com)))"
  155. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=25 SRCH attr=cn gidNumber
  156. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (memberUid) not indexed
  157. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (member) not indexed
  158. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=25 SEARCH RESULT tag=101 err=0 nentries=0 text=
  159. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=26 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  160. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=26 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  161. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  162. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text=
  163. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=27 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  164. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=27 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  165. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  166. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=27 SEARCH RESULT tag=101 err=0 nentries=1 text=
  167. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=28 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  168. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=28 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  169. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  170. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=28 SEARCH RESULT tag=101 err=0 nentries=1 text=
  171. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=27 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=1000))"
  172. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=27 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  173. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uidNumber) not indexed
  174. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=27 SEARCH RESULT tag=101 err=0 nentries=1 text=
  175. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=28 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  176. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=28 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  177. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  178. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=28 SEARCH RESULT tag=101 err=0 nentries=1 text=
  179. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=29 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  180. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=29 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  181. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  182. Jan 2 18:44:18 machine slapd[9347]: conn=1005 op=29 SEARCH RESULT tag=101 err=0 nentries=1 text=
  183. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=29 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  184. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=29 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  185. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  186. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=29 SEARCH RESULT tag=101 err=0 nentries=1 text=
  187. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=30 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  188. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=30 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  189. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  190. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=30 SEARCH RESULT tag=101 err=0 nentries=1 text=
  191. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=31 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  192. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=31 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  193. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  194. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=31 SEARCH RESULT tag=101 err=0 nentries=1 text=
  195. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=32 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  196. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=32 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  197. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  198. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=32 SEARCH RESULT tag=101 err=0 nentries=1 text=
  199. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=33 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  200. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=33 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  201. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  202. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=33 SEARCH RESULT tag=101 err=0 nentries=1 text=
  203. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=34 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=james))"
  204. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=34 SRCH attr=uidNumber cn gecos uid objectClass homeDirectory gidNumber loginShell
  205. Jan 2 18:44:18 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  206. Jan 2 18:44:18 machine slapd[9347]: conn=1009 op=34 SEARCH RESULT tag=101 err=0 nentries=1 text=
  207. Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=35 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=root))"
  208. Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=35 SRCH attr=uid uidNumber
  209. Jan 2 18:46:07 machine slapd[9347]: <= mdb_equality_candidates: (uid) not indexed
  210. Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=35 SEARCH RESULT tag=101 err=0 nentries=0 text=
  211. Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=36 SRCH base="dc=my,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=root))"
  212. Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=36 SRCH attr=cn gidNumber
  213. Jan 2 18:46:07 machine slapd[9347]: <= mdb_equality_candidates: (memberUid) not indexed
  214. Jan 2 18:46:07 machine slapd[9347]: conn=1009 op=36 SEARCH RESULT tag=101 err=0 nentries=0 text=
Advertisement
Add Comment
Please, Sign In to add comment