1

I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.  I can now switch to user from root account but can not log on with password (pam_unix(sshd:auth): authentication failure). I will see if I can turn on pam debug and also raise the problem here.  I want to list the detailed steps here to get helps.  I am not sure it is related to userPassword (I already set dsHeuristics to 000000001) or unixUserPassword attribute, but I will continue to investigate.

  1. Windows Server 2012 R2 (AD) side: Setup AD DS. Enable SSL for AD. Installed Identity Management for UNIX Add attributes(uidNumber,gidNumber,unixHomeDirectory) to global catalog in schema.  Added couple of users (luser02 which is the bind user, luser03, luser04) and group (unixGrp2) with posixAccount/posixGroup set, respectively.  To verify it, I can use ldapsearch in the target CentOS 6:

    ldapsearch -x -H ldap://114.116.43.118:389 -D "CN=luser02,CN=Users,DC=kelamayi,DC=com" -b "DC=kelamayi,DC=com" -W sAMAccountName=luser03

    # extended LDIF
    #
    # LDAPv3
    # base <DC=kelamayi,DC=com> with scope subtree
    # filter: sAMAccountName=luser03
    # requesting: ALL
    #
    
    # luser03, Users, kelamayi.com
    dn: CN=luser03,CN=Users,DC=kelamayi,DC=com
    objectClass: top
    objectClass: posixAccount
    objectClass: person
    objectClass: organizationalPerson
    objectClass: user
    cn: luser03
    givenName: luser03
    distinguishedName: CN=luser03,CN=Users,DC=kelamayi,DC=com
    instanceType: 4
    whenCreated: 20180824095929.0Z
    whenChanged: 20180824103333.0Z
    displayName: luser03
    uSNCreated: 24826
    memberOf: CN=unigGrp2,DC=kelamayi,DC=com
    memberOf: CN=unixGrp,DC=kelamayi,DC=com
    uSNChanged: 24861
    name: luser03
    objectGUID:: Q/Bx5j48CEWikaDPlHoyRw==
    userAccountControl: 66048
    badPwdCount: 0
    codePage: 0
    countryCode: 0
    badPasswordTime: 0
    lastLogoff: 0
    lastLogon: 0
    pwdLastSet: 131795783694428731
    primaryGroupID: 513
    objectSid:: AQUAAAAAAAUVAAAA3G4iEdoCV++319XAWgQAAA==
    accountExpires: 9223372036854775807
    logonCount: 0
    sAMAccountName: luser03
    sAMAccountType: 805306368
    userPrincipalName: luser03@kelamayi.com
    objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=kelamayi,DC=com
    dSCorePropagationData: 16010101000000.0Z
    uidNumber: 20003
    gidNumber: 20001
    unixHomeDirectory: /home/luser03
    loginShell: /bin/bash
    
    # search reference
    ref: ldap://ForestDnsZones.kelamayi.com/DC=ForestDnsZones,DC=kelamayi,DC=com
    
    # search reference
    ref: ldap://DomainDnsZones.kelamayi.com/DC=DomainDnsZones,DC=kelamayi,DC=com
    
    # search reference
    ref: ldap://kelamayi.com/CN=Configuration,DC=kelamayi,DC=com
    
    # search result
    search: 2
    result: 0 Success
    
    # numResponses: 5
    # numEntries: 1
    # numReferences: 3
    

    I can also use the Java API to connect to AD with ldaps. The getent passwd also works well.

    $ getent passwd luser03
    luser03:*:20003:513:luser03:/home/luser03:/bin/bash
    $ getent passwd 20002
    luser02:*:20002:513:luser02:/home/luser02:/bin/bash
    $ getent passwd 20003
    luser03:*:20003:513:luser03:/home/luser03:/bin/bash
    
  2. Linux (CentOS 6): I am going to list below attached.

    grep -v '^$\|^\s*\#' /etc/nslcd.conf:

    binddn CN=luser02,CN=Users,DC=kelamayi,DC=com
    bindpw Passw0rd
    uid nslcd
    gid ldap
    uri ldap://114.116.43.118:389/
    base dc=kelamayi,dc=com
    ssl no
    tls_cacertdir /etc/openldap/cacerts
    filter passwd (objectClass=user)
    filter group  (objectClass=group)
    map     passwd uid sAMAccountName
    map     passwd  homeDirectory      unixHomeDirectory
    map     passwd  gecos              displayName
    map     passwd  gidNumber          primaryGroupID
    map     group   uniqueMember       member
    

    grep -v '^$\|^\s*\#' /etc/openldap/ldap.conf:

    base dc=kelamayi,dc=com
    uri ldap://114.116.43.118:389/
    ssl no
    tls_cacertdir /etc/openldap/cacerts
    pam_password md5
    

    grep -v '^$\|^\s*\#' /etc/pam_ldap.conf:

    base dc=kelamayi,dc=com
    uri ldap://114.116.43.118:389/
    ssl no
    tls_cacertdir /etc/openldap/cacerts
    pam_password md5
    

    grep -v '^$\|^\s*\#' /etc/pam.d/system-auth:

    auth        required      pam_env.so
    auth        sufficient    pam_fprintd.so
    auth        sufficient    pam_unix.so nullok try_first_pass
    auth        requisite     pam_succeed_if.so uid >= 500 quiet
    auth        sufficient    pam_ldap.so use_first_pass
    auth        required      pam_deny.so
    account     required      pam_unix.so broken_shadow
    account     sufficient    pam_localuser.so
    account     sufficient    pam_succeed_if.so uid < 500 quiet
    account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
    account     required      pam_permit.so
    password    requisite     pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1
    password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
    password    sufficient    pam_ldap.so use_authtok
    password    required      pam_deny.so
    session     optional      pam_keyinit.so revoke
    session     required      pam_limits.so
    session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
    session     required      pam_unix.so
    session     optional      pam_ldap.so
    

    grep -v '^$\|^\s*\#' /etc/pam.d/password-auth:

    auth        required      pam_env.so
    auth        sufficient    pam_unix.so nullok try_first_pass
    auth        requisite     pam_succeed_if.so uid >= 500 quiet
    auth        sufficient    pam_ldap.so use_first_pass
    auth        required      pam_deny.so
    account     required      pam_unix.so broken_shadow
    account     sufficient    pam_localuser.so
    account     sufficient    pam_succeed_if.so uid < 500 quiet
    account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
    account     required      pam_permit.so
    password    requisite     pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1
    password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
    password    sufficient    pam_ldap.so use_authtok
    password    required      pam_deny.so
    session     optional      pam_keyinit.so revoke
    session     required      pam_limits.so
    session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
    session     required      pam_unix.so
    session     optional      pam_ldap.so
    

    grep -v '^$\|^\s*\#' /etc/nsswitch:

    passwd:     files ldap
    shadow:     files ldap
    group:      files ldap
    hosts:      files dns
    bootparams: nisplus [NOTFOUND=return] files
    ethers:     files
    netmasks:   files
    networks:   files
    protocols:  files
    rpc:        files
    services:   files ldap
    netgroup:   files ldap
    publickey:  nisplus
    automount:  files ldap
    aliases:    files nisplus
    
  3. Test&Debug:

    ssh -v luser03@114.116.41.255
    nslcd -d
    tail -f -n /var/log/secure
    

    log of ssh:

    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    
         here pending for a while, about 10 seconds.
    
    debug1: Authentications that can continue: publickey,password
    debug1: Next authentication method: publickey
    debug1: Trying private key: /root/.ssh/identity
    debug1: Trying private key: /root/.ssh/id_rsa
    debug1: Trying private key: /root/.ssh/id_dsa
    debug1: Trying private key: /root/.ssh/id_ecdsa
    debug1: Next authentication method: password
    luser03@114.116.41.255's password:
    debug1: Authentications that can continue: publickey,password
    Permission denied, please try again.
    luser03@114.116.41.255's password:
    

    debug of nslcd. I do not know why there is a "ldap_result() timed out" in the log before input the password. (This performance issue was addressed by Stefan. Thanks him!)

    nslcd: DEBUG: add_uri(ldap://114.116.43.118:389/)
    nslcd: DEBUG: ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR,"/etc/openldap/cacerts")
    nslcd: version 0.7.5 starting
    nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory
    nslcd: DEBUG: setgroups(0,NULL) done
    nslcd: DEBUG: setgid(55) done
    nslcd: DEBUG: setuid(65) done
    nslcd: accepting connections
    
    nslcd: [8b4567] DEBUG: connection from pid=2856 uid=0 gid=0
    nslcd: [8b4567] DEBUG: nslcd_passwd_byname(luser03)
    nslcd: [8b4567] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
    nslcd: [8b4567] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
    nslcd: [8b4567] DEBUG: ldap_set_rebind_proc()
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0)
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0)
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0)
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0)
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON)
    nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
    nslcd: [8b4567] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
    nslcd: [8b4567] DEBUG: rebinding to ldap://kelamayi.com/CN=Configuration,DC=kelamayi,DC=com
    nslcd: [8b4567] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://kelamayi.com/CN=Configuration,DC=kelamayi,DC=com")
    nslcd: [8b4567] ldap_result() timed out
    nslcd: [8b4567] DEBUG: ldap_abandon()
    nslcd: [8b4567] DEBUG: ldap_unbind()
    nslcd: [7b23c6] DEBUG: connection from pid=2856 uid=0 gid=0
    nslcd: [7b23c6] DEBUG: nslcd_passwd_byname(luser03)
    nslcd: [7b23c6] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
    nslcd: [7b23c6] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
    nslcd: [7b23c6] DEBUG: ldap_set_rebind_proc()
    nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
    nslcd: [7b23c6] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
    nslcd: [7b23c6] DEBUG: ldap_result(): end of results
    nslcd: [3c9869] DEBUG: connection from pid=2856 uid=0 gid=0
    nslcd: [3c9869] DEBUG: nslcd_passwd_byname(luser03)
    nslcd: [3c9869] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
    nslcd: [3c9869] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
    nslcd: [3c9869] DEBUG: ldap_set_rebind_proc()
    nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
    nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
    nslcd: [3c9869] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
    nslcd: [3c9869] DEBUG: ldap_result(): end of results
    nslcd: [334873] DEBUG: connection from pid=2856 uid=0 gid=0
    nslcd: [334873] DEBUG: nslcd_passwd_byname(luser03)
    nslcd: [334873] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
    nslcd: [334873] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
    nslcd: [334873] DEBUG: ldap_set_rebind_proc()
    nslcd: [334873] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
    nslcd: [334873] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
    nslcd: [334873] DEBUG: ldap_result(): end of results
    

    /var/log/secure:

    Aug 24 19:42:07 ecs-c191-0006 sshd[2856]: pam_unix(sshd:auth): authentication failure;
    logname= uid=0 euid=0 tty=ssh ruser= rhost=114.116.42.247  user=luser03
    

    Tried to enable pam debug by Switch on PAM debugging to Syslog, but I got another error when build:

    patching file modules/pam_unix/pam_unix_passwd.c
    Hunk #1 succeeded at 233 (offset -7 lines).
    patching file modules/pam_unix/pam_unix.8.xml
    patching file modules/pam_unix/passverify.c
    Hunk #1 succeeded at 1088 (offset -7 lines).
    patching file modules/pam_unix/passverify.h
    patching file modules/pam_unix/support.c
    Hunk #1 FAILED at 495.
    1 out of 1 hunk FAILED -- saving rejects to file modules/pam_unix/support.c.rej
    
0
0

First, I'd recommend testing the connection with getent passwd before changing the PAM configuration.

Using your configuration, I also suffered from long waiting times and occasional time outs. I think this happens because you only define base dc=kelamayi,dc=com as search base instead of map-specific ones.

According to man 5 nslcd.conf

   base [MAP] DN
      Specifies the base distinguished name (DN) to use as search base.  This option  may
      be supplied multiple times and all specified bases will be searched.

      A  global  search  base may be specified or a MAP-specific one.  If no MAP-specific
      search bases are defined the global ones are used.

So to speed up the search and prevent time outs, you could (and probably should) define (at least) the following bases in /etc/nslcd.conf:

base passwd CN=Users,DC=kelamayi,DC=com
base group  CN=unixGrp,DC=kelamayi,DC=com
base shadow CN=Users,DC=kelamayi,DC=com

See also: https://arthurdejong.org/nss-pam-ldapd/setup for further information on setting up PAM with LDAP.

Update (2020-03-20): Having learned more about PAM and LDAP, the problem probably was that pam_unix.so will try to authenticate an user (via the nss facility) before pam_ldap.so is consulted. Order matters in a PAM configuration so pam_ldap.so should probably be either before pam_unix.so or you could use pam_localuser.so to skip pam_unix.so if a user is in /etc/passwd. I don't know why the nss-pam-ldapd website suggested this order. Switching to SSSD is probably a good idea.

4
  • Thanks for your input. You are right. After I use the new BASE DN: base ou=portal,dc=kelamayi,dc=com which only contains the 3 users luser02,luser03 and luser04. The getent passwd and getent passwd luser03 and getent passwd 20003 20003 is the luser03's uid. All works and responses immediately. I updated the question with this information. But the same problem still exists. I can share the env to you if if you are interested in the issue....
    – Ricky Ru
    Aug 27 '18 at 9:24
  • I am able to use getent passwd,getent group commands to fetch the information from AD. But getent shadow only returns the local ones. I think the problem may be clear now that is the shadow/password needs to be mapped for AD. But I tried to config /etc/pam_ldap.conf and /etc/openldap/ldap.conf according to link and still not work.
    – Ricky Ru
    Aug 27 '18 at 11:46
  • See access.redhat.com/solutions/87133 for possible mappings. I hope it helps.
    – stefan0xC
    Aug 27 '18 at 15:19
  • 1
    Stefan, thanks for your help. I still could not make it work and finally I switched to use sssd and made it work.
    – Ricky Ru
    Aug 28 '18 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.