3

I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie.

Authentication part is working great, as I can login to SSH using my kerberos account.

I even can create user home directory using pam_mkhomedir.so

However, I can't use Ldap posixGroup to allow access to my SSH server :

Here is the output of getent group

getent group | grep tupac
adminsLinux:*:3000:uid=tupac,ou=people,dc=maytacapac,dc=inc

Here is the extract of sshd_config :

AllowGroups adminsLinux

Here are the log files :

sshd[3305]: User tupac from a.b.c.d not allowed because not in any group
sshd[3305]: input_userauth_request: invalid user tupac [preauth]
sshd[3305]: Connection closed by a.b.c.d [preauth]

Here is id tupac output

uid=20003(tupac) gid=20003 groups=20003

tupac user is not part of any Unix group, but I want to allow access based on OpenLdap posixGroup. I have thought /etc/nsswitch.conf configuration and getent group resolution would be enough to grant access according to posixGroups.

| improve this question | |
5

uid=tupac,ou=people,dc=maytacapac,dc=inc looks wrong, as most (okay, all except this one) LDAP-provided group memberships I've seen do not include a LDAP DN, and instead just the username, so I would expect to instead see adminsLinux:*:3000:tupac.

| improve this answer | |
  • 1
    +1. also, commas are used to separate usernames for entries in the groups db (whether from /etc/group or elsewhere). – cas Apr 22 '16 at 3:49
  • ok thank you thrig; indeed putting uid value for memberUid makes more sense and solved the issue. I however had to reload nscd as well as the erroneous content was cached for a (short) while. Many thanks again – philippe Apr 22 '16 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.