1

Dears,

I spent much time on this and even successfully verified (Auth)Linux-LDAP-openLDAP ok. But get blocked with AD.I can now switch to user from root account but can not log on with password(pam_unix(sshd:auth): authentication failure). I will see if I can turn on pam debug and also raise the problem here.I want to list the detailed steps here to get helps. I am not sure it is related to userPassword(I already set dsHeuristics to 000000001) or unixUserPassword attribute but I will continue to investigate.

  1. Windows server 2012 R2(AD) side:Setup AD DS.Enable SSL for AD. Installed Identity Management for UNIX Add attributes(uidNumber,gidNumber,unixHomeDirectory) to global catalog in schema.Added couple of users(luser02 which is the bind user,luser03,luser04) and group(unixGrp2) with posixAccount/posixGroup set respectively. To verify it, I can use ldapsearch in the target CENT OS 6 ldapsearch -x -H ldap://114.116.43.118:389 -D "CN=luser02,CN=Users,DC=kelamayi,DC=com" -b "DC=kelamayi,DC=com" -W sAMAccountName=luser03
# extended LDIF
#
# LDAPv3
# base <DC=kelamayi,DC=com> with scope subtree
# filter: sAMAccountName=luser03
# requesting: ALL
#

# luser03, Users, kelamayi.com
dn: CN=luser03,CN=Users,DC=kelamayi,DC=com
objectClass: top
objectClass: posixAccount
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: luser03
givenName: luser03
distinguishedName: CN=luser03,CN=Users,DC=kelamayi,DC=com
instanceType: 4
whenCreated: 20180824095929.0Z
whenChanged: 20180824103333.0Z
displayName: luser03
uSNCreated: 24826
memberOf: CN=unigGrp2,DC=kelamayi,DC=com
memberOf: CN=unixGrp,DC=kelamayi,DC=com
uSNChanged: 24861
name: luser03
objectGUID:: Q/Bx5j48CEWikaDPlHoyRw==
userAccountControl: 66048
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
pwdLastSet: 131795783694428731
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAA3G4iEdoCV++319XAWgQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: luser03
sAMAccountType: 805306368
userPrincipalName: luser03@kelamayi.com
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=kelamayi,DC=com
dSCorePropagationData: 16010101000000.0Z
uidNumber: 20003
gidNumber: 20001
unixHomeDirectory: /home/luser03
loginShell: /bin/bash

# search reference
ref: ldap://ForestDnsZones.kelamayi.com/DC=ForestDnsZones,DC=kelamayi,DC=com

# search reference
ref: ldap://DomainDnsZones.kelamayi.com/DC=DomainDnsZones,DC=kelamayi,DC=com

# search reference
ref: ldap://kelamayi.com/CN=Configuration,DC=kelamayi,DC=com

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3

I can also use java api to connect to AD with ldaps. The getent passwd also works well.

getent passwd luser03
luser03:*:20003:513:luser03:/home/luser03:/bin/bash
getent passwd 20002
luser02:*:20002:513:luser02:/home/luser02:/bin/bash
getent passwd 20003
luser03:*:20003:513:luser03:/home/luser03:/bin/bash
  1. Linux(CENT OS 6): I am going to list below attached.

grep -v '^$\|^\s*\#' /etc/nslcd.conf

binddn CN=luser02,CN=Users,DC=kelamayi,DC=com
bindpw Passw0rd
uid nslcd
gid ldap
uri ldap://114.116.43.118:389/
base dc=kelamayi,dc=com
ssl no
tls_cacertdir /etc/openldap/cacerts
filter passwd (objectClass=user)
filter group  (objectClass=group)
map     passwd uid sAMAccountName
map     passwd  homeDirectory      unixHomeDirectory
map     passwd  gecos              displayName
map     passwd  gidNumber          primaryGroupID
map     group   uniqueMember       member

grep -v '^$\|^\s*\#' /etc/openldap/ldap.conf

base dc=kelamayi,dc=com
uri ldap://114.116.43.118:389/
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

grep -v '^$\|^\s*\#' /etc/pam_ldap.conf

base dc=kelamayi,dc=com
uri ldap://114.116.43.118:389/
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5

grep -v '^$\|^\s*\#' /etc/pam.d/system-auth

auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

grep -v '^$\|^\s*\#' /etc/pam.d/password-auth

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so retry=3 minlen=8 difok=3 ucredit=-1 lcredit=-2 dcredit=-1 ocredit=-1
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

grep -v '^$\|^\s*\#' /etc/nsswitch

passwd:     files ldap
shadow:     files ldap
group:      files ldap
hosts:      files dns
bootparams: nisplus [NOTFOUND=return] files
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files ldap
netgroup:   files ldap
publickey:  nisplus
automount:  files ldap
aliases:    files nisplus
  1. Test&Debug: ssh -v luser03@114.116.41.255 nslcd -d tail -f -n /var/log/secure

log of ssh:

debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received

     here pending for a while,about 10 seconds.

debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Next authentication method: password
luser03@114.116.41.255's password:
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
luser03@114.116.41.255's password:

debug of nslcd. I do not know why there is a "ldap_result() timed out" in the log before input the password. (This performance issue was addressed by Stefan. Thanks him!)

nslcd: DEBUG: add_uri(ldap://114.116.43.118:389/)
nslcd: DEBUG: ldap_set_option(LDAP_OPT_X_TLS_CACERTDIR,"/etc/openldap/cacerts")
nslcd: version 0.7.5 starting
nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory
nslcd: DEBUG: setgroups(0,NULL) done
nslcd: DEBUG: setgid(55) done
nslcd: DEBUG: setuid(65) done
nslcd: accepting connections

nslcd: [8b4567] DEBUG: connection from pid=2856 uid=0 gid=0
nslcd: [8b4567] DEBUG: nslcd_passwd_byname(luser03)
nslcd: [8b4567] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
nslcd: [8b4567] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
nslcd: [8b4567] DEBUG: ldap_set_rebind_proc()
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0)
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0)
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0)
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0)
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON)
nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
nslcd: [8b4567] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
nslcd: [8b4567] DEBUG: rebinding to ldap://kelamayi.com/CN=Configuration,DC=kelamayi,DC=com
nslcd: [8b4567] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://kelamayi.com/CN=Configuration,DC=kelamayi,DC=com")
nslcd: [8b4567] ldap_result() timed out
nslcd: [8b4567] DEBUG: ldap_abandon()
nslcd: [8b4567] DEBUG: ldap_unbind()
nslcd: [7b23c6] DEBUG: connection from pid=2856 uid=0 gid=0
nslcd: [7b23c6] DEBUG: nslcd_passwd_byname(luser03)
nslcd: [7b23c6] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
nslcd: [7b23c6] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
nslcd: [7b23c6] DEBUG: ldap_set_rebind_proc()
nslcd: [7b23c6] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [7b23c6] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
nslcd: [7b23c6] DEBUG: ldap_result(): end of results
nslcd: [3c9869] DEBUG: connection from pid=2856 uid=0 gid=0
nslcd: [3c9869] DEBUG: nslcd_passwd_byname(luser03)
nslcd: [3c9869] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
nslcd: [3c9869] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
nslcd: [3c9869] DEBUG: ldap_set_rebind_proc()
nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [3c9869] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
nslcd: [3c9869] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
nslcd: [3c9869] DEBUG: ldap_result(): end of results
nslcd: [334873] DEBUG: connection from pid=2856 uid=0 gid=0
nslcd: [334873] DEBUG: nslcd_passwd_byname(luser03)
nslcd: [334873] DEBUG: myldap_search(base="dc=kelamayi,dc=com", filter="(&(objectClass=user)(sAMAccountName=luser03))")
nslcd: [334873] DEBUG: ldap_initialize(ldap://114.116.43.118:389/)
nslcd: [334873] DEBUG: ldap_set_rebind_proc()
nslcd: [334873] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [334873] DEBUG: ldap_simple_bind_s("CN=luser02,CN=Users,DC=kelamayi,DC=com","***") (uri="ldap://114.116.43.118:389/")
nslcd: [334873] DEBUG: ldap_result(): end of results

/var/log/secure:

Aug 24 19:42:07 ecs-c191-0006 sshd[2856]: pam_unix(sshd:auth): authentication failure; 
logname= uid=0 euid=0 tty=ssh ruser= rhost=114.116.42.247  user=luser03

Tried to enable pam debug by > Tried to enable pam debug by this:https://serverfault.com/questions/249671/switch-on-pam-debugging-to-syslog but got another error when build

patching file modules/pam_unix/pam_unix_passwd.c
Hunk #1 succeeded at 233 (offset -7 lines).
patching file modules/pam_unix/pam_unix.8.xml
patching file modules/pam_unix/passverify.c
Hunk #1 succeeded at 1088 (offset -7 lines).
patching file modules/pam_unix/passverify.h
patching file modules/pam_unix/support.c
Hunk #1 FAILED at 495.
1 out of 1 hunk FAILED -- saving rejects to file modules/pam_unix/support.c.rej

hard days.....

0

First, I'd recommend testing the connection with getent passwd before changing the PAM configuration.

Using your configuration, I also suffered from long waiting times and occasional time outs. I think this happens because you only define base dc=kelamayi,dc=com as search base instead of map-specific ones.

According to man 5 nslcd.conf

   base [MAP] DN
      Specifies the base distinguished name (DN) to use as search base.  This option  may
      be supplied multiple times and all specified bases will be searched.

      A  global  search  base may be specified or a MAP-specific one.  If no MAP-specific
      search bases are defined the global ones are used.

So to speed up the search and prevent time outs, you could (and probably should) define (at least) the following bases in /etc/nslcd.conf:

base passwd CN=Users,DC=kelamayi,DC=com
base group  CN=unixGrp,DC=kelamayi,DC=com
base shadow CN=Users,DC=kelamayi,DC=com

See also: https://arthurdejong.org/nss-pam-ldapd/setup for further information on setting up PAM with LDAP.

  • Thanks for your input. You are right. After I use the new BASE DN: base ou=portal,dc=kelamayi,dc=com which only contains the 3 users luser02,luser03 and luser04. The getent passwd and getent passwd luser03 and getent passwd 20003 20003 is the luser03's uid. All works and responses immediately. I updated the question with this information. But the same problem still exists. I can share the env to you if if you are interested in the issue.... – Ricky Ru Aug 27 '18 at 9:24
  • I am able to use getent passwd,getent group commands to fetch the information from AD. But getent shadow only returns the local ones. I think the problem may be clear now that is the shadow/password needs to be mapped for AD. But I tried to config /etc/pam_ldap.conf and /etc/openldap/ldap.conf according to link and still not work. – Ricky Ru Aug 27 '18 at 11:46
  • See access.redhat.com/solutions/87133 for possible mappings. I hope it helps. – Stefan Aug 27 '18 at 15:19
  • Stefan, thanks for your help. I still could not make it work and finally I switched to use sssd and made it work. – Ricky Ru Aug 28 '18 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.