I have some custom built instances running in AWS EC2 that are configured with ldap authentication. I have now brought up one of the AWS-provided EC2 AMIs, and am trying to configure it to work with pam authentication. This is a relatively straight forward configuration, but for some reason, pam / ldap is not working. Here's a quick summary of how I have configured the instance, anything obvious I am missing?
Installed software (yum / rpm, over and above default, relevant to this setup): pam_ldap nss-pam-ldapd
Configuration: /etc/ldap.conf - configured with a copy of an ldap.conf from my custom-built AMI - identical parameters. The following parameters are used (values omitted, only relevant config shown - excluding ssl / tls config stuff):
uri timelimit base scope suffix ldap_version 3 binddn bindpw rootbinddn pam_filter pam_login_attribute pam_member_attribute pam_password pam_check_host_attr nss_base_passwd (x 2 of these) nss_base_shadow nss_base_group nss_base_hosts nss_initgroups_ignoreusers
passwd: files ldap shadow: files ldap group: files ldap
URI ldap://my-ldap-server BASE dc=organization,dc=com
/etc/pam_ldap.conf - this file is only on the AWS-provided AMI. I copied the config from /etc/ldap.conf to this file to try get things working
/etc/pam.d/system-auth (showing context of +1 and -1 lines. Added lines indicated with a "+"):
auth sufficient pam_unix.so nullok try_first_pass + auth sufficient pam_ldap.so use_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet account sufficient pam_localuser.so + account [default=bad success=ok user_unknown=ignore] pam_ldap.so account sufficient pam_succeed_if.so uid < 500 quiet password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok + password sufficient pam_ldap.so use_authtok password required pam_deny.so session required pam_limits.so + session optional pam_mkhomedir.so skel=/etc/skel umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so + session optional pam_ldap.so
To test, I try
getend passwd or
getent group and don't see any of my ldap-based entries.
any ideas as to where I am going wrong? /var/log/messages and secure don't give any indication of errors.