3

I made a fresh install of Linux Mint 18.3 and then established a connection to my LDAP server. I can see the list of LDAP users with getent passwd. The strange thing is that, when I boot, the start up screen only displays the local account. I can't connect to any LDAP account.

However, if I login once with a LDAP account in command line using TTY1, then the corresponding user appears on the start up screen, and remains after reboot.

Since I see no reason for that, I don't know what file content I should share, but please ask for anything useful and I'll be happy to provide it. I even reinstalled Linux Mint, but that did not change anything. Ideally, I'd like to see all the LDAP users on the start up (as it has been for years using the exact same installation procedure).

Edit Thanks to Thegs and kemotp, I managed to solve the issue, or more precisely to find a workaround, by simply installing mdm with

sudo apt install mdm

and choosing mdm when asked for default desktop manager. However, what the issue is with lightdm is still open.

  • This is something set in your desktop manager. Would you happen to know which one you are using? – Thegs Feb 28 '18 at 16:48
  • @Thegs In /etc/pam.d/, I have lightdm. On the other operational PCs, I have mdm. So that's probably where the problem comes from indeed. – anderstood Feb 28 '18 at 18:19
  • OK, I solved the problem by installing mdm and setting it as default. Thank you both! – anderstood Feb 28 '18 at 18:44
1

Issue Could be with GDM

It appears your issue could be related to this post as well?

Check your /etc/pam.d/common-session for this line (add it if it does not exist):

session required pam_mkhomedir.so umask=0022 skel=/etc/skel

You will also need to make sure that gdm has an entry in /etc/security/group.conf and that /etc/pam.d/gdm has the following line:

auth optional pam_group.so

If you continue having issues:

Let us start with a fresh install of Linux Mint and reconfigure the LDAP client from scratch. I am referencing this guide as it appears to be the most straight forward one I could find.

Install Necessary LDAP Client Packages

sudo apt-get update
sudo apt-get install libnss-ldap libpam-ldap nscd

Make sure to enter the correct IP address for your LDAP server URI:

ldap://X.X.X.X

The next value should be identical to your LDAP server /etc/phpldapadmin/config.php values.

dc=foo,dc=bar

Use LDAP version 3

Make local root Database admin: [Depends on your needs, most likely No]

Does the LDAP database require login? No

LDAP account for root (Again should match the values in /etc/phpldapadmin/config.php)

"cn=blort,dc=foo,dc=bar"

Now enter your LDAP root password.

You have now completed the process for libnss-ldap will repeat this process for libpam-ldap. Make sure all the values are the same.

If you want to change the values set up you can just run this to redo the configuration

sudo dpkg-reconfigure ldap-auth-config or sudo dpkg-reconfigure libnss-ldap

Configure the Client

Edit the /etc/ldap/ldap.conf file and uncomment the following lines and enter your LDAP information:

[...]
BASE    dc=foo,dc=bar
URI     ldap://X.X.X.X
[...]

Edit /etc/nsswitch.conf with the following lines:

[...]
passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap
[...]
netgroup:       ldap
[...]

After that restart the nscd service: /etc/init.d/nscd restart

PAM Configuration

Edit /etc/pam.d/common-auth to contain the following lines:

[...]
auth    [success=2 default=ignore]      pam_unix.so nullok_secure try_first_pass
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
[...]
auth    requisite                       pam_deny.so
[...]
auth    required                        pam_permit.so
[...]

Edit /etc/pam.d/common-account to have the following lines:

[...]
account [success=2 new_authtok_reqd=done default=ignore]         pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
[...]
account requisite                       pam_deny.so
[...]
account required                        pam_permit.so
[...]

Edit /etc/pam.d/common-password and make sure that the following lines are set:

[...]
password        [success=2 default=ignore]      pam_unix.so obscure sha512
password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_pass
[...]
password        requisite                       pam_deny.so
[...]
password        required                        pam_permit.so
[...]

Edit /etc/pam.d/common-session and add the following line to the bottom:

[...]
session  required                                         pam_mkhomedir.so

Edit /etc/pam.d/common-session-noninterative and make sure the following lines are set up:

[...]
session [default=1]                     pam_permit.so
[...]
session requisite                       pam_deny.so
[...]
session required                        pam_permit.so
[...]
session required        pam_unix.so
session optional                        pam_ldap.so

Now restart the nscd service: /etc/init.d/nscd restart. Restart the computer and attempt to login.

Conclusion

Study up on PAM and LDAP authentication here. You can also reference this guide for additional information. You mentioned that you have done this before, to help troubleshoot look into what is different about your current set up compared to the previous known working set up. Best of Luck!

  • Thanks to your answer, I managed to find my problem: it is due to something in lightdm. By installing mdm instead, any LDAP user can log in. So I'm not sure what is exactly is happening with lightdm, but you helped me find a workaround. – anderstood Feb 28 '18 at 18:47
  • You should update your question with the issue with lightdm and then add an answer of what you did with mdm – kemotep Feb 28 '18 at 19:17
  • Yes I had started editing my question and got interrupted. I'm finishing now. – anderstood Feb 28 '18 at 19:34
  • No problem, glad you could figure your issue out. – kemotep Feb 28 '18 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.