0

In our company, we have a network where I installed a working LDAP server for our CentOS 6 servers (FTP/WEB/Pydio/VOD/etc servers) about 25 of them. All working perfectly with LDAP authentication.

Next to that we have about 120 slightly outdated (cannot update them) OpenSuse 10.2 servers. Those have an installer given to us by the supplier of that 'special' machines and we cannot go to a newer distribution. I would like these 120 nodes to authenticate on the CentOS LDAP server as well, but with those I run into issues.

I used yast to setup the ldap_client configuration, but when I try to login I got the message:

Failed publickey for user... of IP 10.11.12.13 port 30891

After typing the password I got a second message:

Failed password for user... of IP 10.11.12.13 port 30891

Each time a different port. Also tried several users all result in the same messages.

So I tried to google what could go wrong, but there isn't anyone that matches these 2 distro's and posted some details how to.

On CentOS I could (and did) use the authconfig tool and without any issues all working. I guess for these OpenSuSE systems I have to alter some things manually.

Last thing I found but not sure of is that OpenSuSE still uses SHA512 hashing and CentOS6.x uses SHA1024 Hashing, but I also found some contradictions on that as well.

Edit: output of /etc/ldap.conf

#Stripped all comments only actual values to reduce size. 
host 172.23.3.1 
base dc=nmc 
bind_policy soft 
pam_password exop 
nss_initgroups_ignoreusers root,ldap 
nss_schema rfc2307bis 
nss_map_attribute uniqueMember member 
ssl no ldap_version 3 
pam_filter objectclass=posixAccount 
nss_base_passwd dc=nmc 
nss_base_shadow dc=nmc 
nss_base_group dc=nmc 
tls_checkpeer no
  • My goodness is that old (not to mention a huge security risk). Can you post the output of /etc/ldap.conf for the SuSE Box? I'm going to take a guess that something isn't right in pam_password. – SailorCire Jan 19 '15 at 16:21
  • here it is:DHCP-IP16:/publitronic/objects/code # cat /etc/ldap.conf #Stripped all comments only actual values to reduce size. host 172.23.3.1 base dc=nmc bind_policy soft pam_password exop nss_initgroups_ignoreusers root,ldap nss_schema rfc2307bis nss_map_attribute uniqueMember member ssl no ldap_version 3 pam_filter objectclass=posixAccount nss_base_passwd dc=nmc nss_base_shadow dc=nmc nss_base_group dc=nmc tls_checkpeer no – SHLelieveld Jan 20 '15 at 13:20
  • Looks hiddious..... :( – SHLelieveld Jan 20 '15 at 13:21
  • I've edited your original question to reflect this output. – SailorCire Jan 20 '15 at 13:26
  • 1
    Yesterday I got it to work on the local terminal as mentioned before, but via putty or ssh not yet. But I found the issue on that as well :) The ssh deamon wasn't setup to use PAM, so changed #UsePAM yes to UsePAM yes :) Thanks you all for the suggestions it did point me in the correct directions, just had to fine tune it :) – SHLelieveld Jan 22 '15 at 14:31
0

From your description it seems that the problem isn't with the LDAP server as other servers and machines were able to authenticate without problem.

My thoughts were to look at /etc/pam.d/common-auth and /etc/pam.d/common-account to have OpenSuSE read from those files for authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.