Yesterday, I set up an OpenLDAP server and tried to configure it to be useful for SSH. Followed these two guides from DigitalOcean: https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-a-basic-ldap-server-on-an-ubuntu-12-04-vps and https://www.digitalocean.com/community/tutorials/how-to-authenticate-client-computers-using-ldap-on-an-ubuntu-12-04-vps

That being said, I've been having a lot of issues with authenticating via SSH since yesterday evening. It worked fine in the morning, but not throughout the rest of the day and I have no idea why. I've restored my Linux VM back to a previous snapshot just so that I could try setting it all up again, and still can't get it to go.

Basically, when I run slapd -d 1, there doesn't appear to be anything that stands out, indicating that something's wrong. However, when I try SSH'ing into my local box (which hosts the OpenLDAP server), this is what I see in the /var/log/auth.log file:

Dec  4 10:03:46 mybox sshd[17741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost  user=root
Dec  4 10:03:49 mybox sshd[17741]: Failed password for root from port 45071 ssh2

I can only SSH using credentials that are stored on my SSH server, and it's not authenticating through LDAP. I can login with LDAP through ldapsearch without any problem, so I don't think the problem is with LDAP.

Can someone please point me in the right direction?

EDIT: Got things working with the help of a friend (not my stuff). Here's two files that were simply used:

file.ldif (used this with ldapadd)

version: 1
dn: dc=dolgen,dc=net
objectClass: top
objectClass: dcObject
objectClass: organization
dc: dolgen
o: Some Org
description: A sample domain

dn: ou=people,dc=dolgen,dc=net
objectClass: top
objectClass: organizationalUnit
ou: people

dn: cn=Bob Anderson,ou=people,dc=dolgen,dc=net
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: Bob Anderson
sn: Anderson
uid: test
# the userpassword is set to the SHA1 of 'testtesttest'
userPassword: {SSHA}ih08rDcGRC+S5ol888SZG5YUjOX1oVVK
description: This is Bob
uidNumber: 2000
gidNumber: 1100
homeDirectory: /
loginShell: /bin/sh


include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/nis.schema

pidfile         /tmp/slapd.pid
argsfile        /tmp/slapd.args

TLSCertificateFile /tmp/ldap.pem
TLSCertificateKeyFile /tmp/ldap.key
moduleload back_hdb.la
database        hdb
suffix          "dc=dolgen,dc=net" 
rootdn          "cn=Manager,dc=dolgen,dc=net" 
# password is 'testtesttest'
rootpw          {SSHA}ih08rDcGRC+S5ol888SZG5YUjOX1oVVK
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /tmp/openldap-data
# Indices to maintain
index   objectClass     eq
  • Are you trying to login to SSH using root? – eyoung100 Dec 4 '14 at 16:20
  • Correct. I was able to using root (using both my Linux PW and the PW configured in LDAP), so I feel pretty convinced that it authenticated via LDAP yesterday. Not sure if this isn't what's recommended or not though. Should I create another account instead? – user3447014 Dec 4 '14 at 16:21
  • Can you verify that PermitRootLogin is set to True in your sshd config file? – eyoung100 Dec 4 '14 at 16:24
  • It's set to "yes". I can SSH into root atm using my Linux password just fine though. – user3447014 Dec 4 '14 at 16:25
  • 1
    In Short, AD is Windows Based and doesn't understand the login mechanism used by SSH, but SSH can communicate with AD. The tutorial you were using assumes that your SSH server existed in a network that wasn't using AD for authentication. Your friend's static config file contains the information needed to use the AD as a passthrough authentication, including a Database lookup. 2ndly, IIRC 2 cn's cannot exist in the same AD forest. Since your friends real network was configured properly, it was disallowing access to your test. – eyoung100 Dec 4 '14 at 20:29

Check whether /etc/ssh/sshd_config has "UsePAM yes". It basically enables PAM authentication required for OpenLDAP

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.