0

Yesterday, I set up an OpenLDAP server and tried to configure it to be useful for SSH. Followed these two guides from DigitalOcean: https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-a-basic-ldap-server-on-an-ubuntu-12-04-vps and https://www.digitalocean.com/community/tutorials/how-to-authenticate-client-computers-using-ldap-on-an-ubuntu-12-04-vps

That being said, I've been having a lot of issues with authenticating via SSH since yesterday evening. It worked fine in the morning, but not throughout the rest of the day and I have no idea why. I've restored my Linux VM back to a previous snapshot just so that I could try setting it all up again, and still can't get it to go.

Basically, when I run slapd -d 1, there doesn't appear to be anything that stands out, indicating that something's wrong. However, when I try SSH'ing into my local box (which hosts the OpenLDAP server), this is what I see in the /var/log/auth.log file:

Dec  4 10:03:46 mybox sshd[17741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost  user=root
Dec  4 10:03:49 mybox sshd[17741]: Failed password for root from 127.0.0.1 port 45071 ssh2

I can only SSH using credentials that are stored on my SSH server, and it's not authenticating through LDAP. I can login with LDAP through ldapsearch without any problem, so I don't think the problem is with LDAP.

Can someone please point me in the right direction?

EDIT: Got things working with the help of a friend (not my stuff). Here's two files that were simply used:

file.ldif (used this with ldapadd)

version: 1
dn: dc=dolgen,dc=net
objectClass: top
objectClass: dcObject
objectClass: organization
dc: dolgen
o: Some Org
description: A sample domain

dn: ou=people,dc=dolgen,dc=net
objectClass: top
objectClass: organizationalUnit
ou: people

dn: cn=Bob Anderson,ou=people,dc=dolgen,dc=net
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: Bob Anderson
sn: Anderson
uid: test
# the userpassword is set to the SHA1 of 'testtesttest'
userPassword: {SSHA}ih08rDcGRC+S5ol888SZG5YUjOX1oVVK
description: This is Bob
uidNumber: 2000
gidNumber: 1100
homeDirectory: /
loginShell: /bin/sh

slapd.conf

include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/inetorgperson.schema
include         /etc/ldap/schema/nis.schema


pidfile         /tmp/slapd.pid
argsfile        /tmp/slapd.args

TLSCertificateFile /tmp/ldap.pem
TLSCertificateKeyFile /tmp/ldap.key
moduleload back_hdb.la
database        hdb
suffix          "dc=dolgen,dc=net" 
rootdn          "cn=Manager,dc=dolgen,dc=net" 
# password is 'testtesttest'
rootpw          {SSHA}ih08rDcGRC+S5ol888SZG5YUjOX1oVVK
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /tmp/openldap-data
# Indices to maintain
index   objectClass     eq
23
  • Are you trying to login to SSH using root?
    – eyoung100
    Dec 4, 2014 at 16:20
  • Correct. I was able to using root (using both my Linux PW and the PW configured in LDAP), so I feel pretty convinced that it authenticated via LDAP yesterday. Not sure if this isn't what's recommended or not though. Should I create another account instead? Dec 4, 2014 at 16:21
  • Can you verify that PermitRootLogin is set to True in your sshd config file?
    – eyoung100
    Dec 4, 2014 at 16:24
  • It's set to "yes". I can SSH into root atm using my Linux password just fine though. Dec 4, 2014 at 16:25
  • 1
    In Short, AD is Windows Based and doesn't understand the login mechanism used by SSH, but SSH can communicate with AD. The tutorial you were using assumes that your SSH server existed in a network that wasn't using AD for authentication. Your friend's static config file contains the information needed to use the AD as a passthrough authentication, including a Database lookup. 2ndly, IIRC 2 cn's cannot exist in the same AD forest. Since your friends real network was configured properly, it was disallowing access to your test.
    – eyoung100
    Dec 4, 2014 at 20:29

1 Answer 1

0

Check whether /etc/ssh/sshd_config has "UsePAM yes". It basically enables PAM authentication required for OpenLDAP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .