1

I have a Debian 10 system which was configured to talk to an OpenLDAP server (10.5.5.35) for password, group and shadow. I need to switch the host over to a Duo Auth Proxy (10.5.5.50). I thought I could just change the IP address (uri) in /etc/ldap.conf and /etc/ldap/ldap.conf but authentication is still going to the .35 address (I can see this traffic via tcpdump when logging in).

my /etc/ldap/ldap.conf -> /etc/ldap.conf (they are a symlink) are directly below. Interestingly enough, changing the uri to something completely errant (1.1.1.1) does not affect authentication. Only CLI utils like ldapsearch fail:

uri                    ldap://10.5.5.35
base                   dc=corp,dc=net
nss_base_group         ou=groups,dc=corp,dc=net
ldap_version           3
pam_password           md5
ssl                    start_tls
tls_reqcert            allow
TLS_CACERTDIR          /etc/ssl/certs
ldap_version           3
pam_password           crypt
pam_login_attribute    uid
tls_reqcert            never
bind_timelimit         60
pam_groupdn            cn=ldapuser,ou=groups,dc=corp,dc=net
#
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,cyrus,daemon,debian-spamd,dnsmasq,dovecot,dovenull,freerad,games,gdm,gnats,haldaemon,hplip,irc,kernoops,landscape,libuuid,list,lp,mail,man,memcache,messagebus,mysql,nagios,news,ntp,nx,openldap,polkituser,postfix,proxy,root,saned,sshd,statd,stunnel4,sympa,sync,sys,syslog,uml-net,unscd,usbmux,uucp,whoopsie,www-data,xrdp                                                                                                           

timelimit              60
idle_timelimit         60

/etc/nsswitch.conf

mfcb# cat /etc/nsswitch.conf 
passwd: files ldap
group:  files ldap
shadow: files ldap

hosts:     files dns
networks:  files

protocols: db files
services:  db files
ethers:    db files
rpc:       db files

netgroup: nis
sudoers:  files

The ldap packages installed on the client are:

# dpkg -l | grep ldap | awk '{print $1" "$2}'
ii ldap-utils
ii libldap-2.4-2:amd64
ii libldap-common
ii libnet-ldap-perl
ii libnss-ldapd:amd64
ii libpam-ldapd:amd64
ii sudo-ldap

I'm not sure why I have the -ldapd packages installed instead of -ldap. Much of the documentation I found today shows the -ldap packages being used instead. I looked it up in our ticket system and we apparently standardized on -ldapd back in 2018 when authentication suddenly stopped working after a Ubuntu upgrade. I should note, most of our infra is Ubuntu. Debian makes up only five of our 60-some hosts so not intricately familiar with it. We do have LDAP auth configured/working on all of them however.

I tried installing the -ldap packages but it removed my /etc/ldap.conf and /etc/ldap/ldap.conf files for some reason and that pretty much broke everything.

What config/file/daemon-to-restart is Debian 10 using to figure out what LDAP server to talk to for authentication?

1 Answer 1

2

Just in case it helps anyone else, I had to change /etc/nslcd.conf to the new server as well and restart the nslcd daemon.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .