1

So I have setup LDAP Login on every server at my work successfully except one. Of course there has to be that one! And I want to close my jira ticket, but I can't figure out what the issue is. The system is a Ubuntu 10 x32

Here is the output of the auth.log

Oct 29 10:56:33 localhost sshd[2560]: Invalid user LDAPUSERNAME from 10.1.11.224
Oct 29 10:56:33 localhost sshd[2560]: Failed none for invalid user LDAPUSERNAME from 10.1.11.224 port 51830 ssh2
Oct 29 10:56:36 localhost sshd[2560]: pam_unix(sshd:auth): check pass; user unknown
Oct 29 10:56:36 localhost sshd[2560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.1.11.224
Oct 29 10:56:36 localhost sshd[2560]: pam_ldap: error trying to bind as user "uid=LDAPUSERNAME,ou=People,dc=DOMAIN,dc=com" (Invalid credentials)
Oct 29 10:56:38 localhost sshd[2560]: Failed password for invalid user LDAPUSERNAME from 10.1.11.224 port 51830 ssh2

UPDATE: This is a successfull login on another server and the output of auth.log

Oct 29 11:23:56 daily sshd[20625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.1.11.224  user=LDAPUSERNAME
Oct 29 11:23:56 daily sshd[20625]: Accepted password for LDAPUSERNAME from 10.1.11.224 port 52211 ssh2
Oct 29 11:23:56 daily sshd[20625]: pam_unix(sshd:session): session opened for user LDAPUSERNAME by (uid=0)
  • Any chance this one server has a wrong time set? – steve Oct 29 '16 at 15:15
  • I've got NTP setup on all servers locally – FreeSoftwareServers Oct 29 '16 at 15:17
  • That IP was my local IP that I was trying to log in FROM, just FYI. – FreeSoftwareServers Nov 3 '16 at 16:59
1

The authentication to the LDAP server is failing for some reason (not the authentication of the user):

Oct 29 10:56:36 localhost sshd[2560]: pam_ldap: error trying to bind as user "uid=LDAPUSERNAME,ou=People,dc=DOMAIN,dc=com" (Invalid credentials)

How do you authenticate to the LDAP server, try to set debug 9 to the pam_ldap line to get more information. Comparison with doing the same on the working server might bring some more ideas.

Also running manually ldapsearch can revel some errors in configuration.

0

For some reason /etc/nslcd.conf was not created during installation. I copied it from another Ubuntu 10 Server which had working LDAP setup, but it wouldn't start because of the line >>

#nss_initgroups_ignoreusers ALLLOCAL

Which is odd, because its on the other Ubuntu 10 server, which I setup as well with the same configs, but thats linux. Regardless, (I commented it out) its working now!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.