# pam ldap problem

## jorisbeld

After a pam update, ldap-users are unable to login to the server, giving the following error in the log files:

```
Jan 31 11:03:35 deepfreeze sshd[5803]: pam_unix(sshd:auth): check pass; user unknown

Jan 31 11:03:35 deepfreeze sshd[5803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx

Jan 31 11:03:35 deepfreeze sshd[5803]: pam_ldap: error trying to bind as user "uid=xx,ou=xx,dc=xx,dc=xx,dc=xx" (Invalid credentials)

Jan 31 11:03:37 deepfreeze sshd[5799]: error: PAM: Authentication failure for illegal user xx from xx

Jan 31 11:03:37 deepfreeze sshd[5799]: Failed keyboard-interactive/pam for invalid user xx from xx

Jan 31 11:03:37 deepfreeze sshd[5804]: pam_tally(sshd:auth): pam_get_uid; no such user
```

etc-update is clean

root can still login

/etc/pam.d/sshd looks like:

```
auth       include      system-remote-login

account    include      system-remote-login

password   include      system-remote-login

session    include      system-remote-login
```

/etc/pam.d/system-remote-login looks like:

```
auth            include         system-login

account         include         system-login

password        include         system-login

session         include         system-login
```

/etc/pam.d/system-login looks like:

```
auth            required        pam_tally.so file=/var/log/faillog onerr=succeed

auth            required        pam_shells.so

auth            required        pam_nologin.so

auth            include         system-auth

account         required        pam_access.so

account         required        pam_nologin.so

account         include         system-auth

account         required        pam_tally.so file=/var/log/faillog onerr=succeed

password        include         system-auth

session         required        pam_env.so

session         optional        pam_lastlog.so

session         include         system-auth

session         optional        pam_motd.so motd=/etc/motd

session         optional        pam_mail.so
```

and /etc/pam.d/system-auth looks like:

```
auth       required     /lib/security/pam_env.so

auth       sufficient   /lib/security/pam_unix.so likeauth nullok

auth       sufficient   /lib/security/pam_ldap.so use_first_pass

auth       required     /lib/security/pam_deny.so

account    sufficient   /lib/security/pam_unix.so

#account    required    /lib/security/pam_unix.so

account    sufficient   /lib/security/pam_ldap.so

account    required     /lib/security/pam_deny.so

password   required     /lib/security/pam_cracklib.so retry=3

password   sufficient   /lib/security/pam_unix.so nullok md5 shadow use_authtok

password   sufficient   /lib/security/pam_ldap.so use_authtok

password   required     /lib/security/pam_deny.so

session    required     /lib/security/pam_limits.so

session    required     /lib/security/pam_unix.so

session    optional     /lib/security/pam_ldap.so
```

What am I doing wrong? Thanks a lot!

Best,

Joris

----------

## VinzC

```
passwd:      compat ldap

shadow:      compat ldap

group:       compat ldap
```

----------

## jorisbeld

/etc/nsswitch.conf reads:

```
passwd:      files ldap

shadow:      files ldap

group:       files ldap

# passwd:    db files nis

# shadow:    db files nis

# group:     db files nis

hosts:       files dns

networks:    files dns

services:    db files ldap

protocols:   db files

rpc:         db files

ethers:      db files

netmasks:    files

netgroup:    files ldap

bootparams:  files

automount:   files nis ldap

aliases:     files ldap
```

----------

## VinzC

Does getent passwd return UNIX accounts from your LDAP server?

----------

## jorisbeld

getent passwd gives:

```
root:x:0:0:root:/root:/bin/bash

bin:x:1:1:bin:/bin:/bin/false

daemon:x:2:2:daemon:/sbin:/bin/false

adm:x:3:4:adm:/var/adm:/bin/false

lp:x:4:7:lp:/var/spool/lpd:/bin/false

sync:x:5:0:sync:/sbin:/bin/sync

shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

halt:x:7:0:halt:/sbin:/sbin/halt

mail:x:8:12:mail:/var/spool/mail:/bin/false

news:x:9:13:news:/usr/lib/news:/bin/false

uucp:x:10:14:uucp:/var/spool/uucppublic:/bin/false

operator:x:11:0:operator:/root:/bin/bash

man:x:13:15:man:/usr/share/man:/bin/false

postmaster:x:14:12:postmaster:/var/spool/mail:/bin/false

smmsp:x:209:209:smmsp:/var/spool/mqueue:/bin/false

portage:x:250:250:portage:/var/tmp/portage:/bin/false

nobody:x:65534:65534:nobody:/:/bin/false

sshd:x:22:22:added by portage for openssh:/var/empty:/usr/sbin/nologin

cron:x:16:16:added by portage for cronbase:/var/spool/cron:/usr/sbin/nologin

rpc:x:111:111:added by portage for portmap:/dev/null:/usr/sbin/nologin

ldap:x:439:439:added by portage for openldap:/usr/lib/openldap:/usr/sbin/nologin
```

I'm kinda clueless, in this case, so is this good or bad?

----------

## Falador

The getent passwd command should also output all users from the ldap directory. Could you post your /etc/ldap.conf file.

Also can you bind to the ldap server manually

----------

## VinzC

If you have followed a guide to setup PAM authentication with LDAP, please post the URL here. Otherwise or if you don't know at all how to set it up at all, please tell us too for there are good guides all over the place, first off that from Gentoo documentation itself. Bear in mind you'll need to be familiar with LDAP syntax to fill your directory with user data and other stuff.

----------

## jorisbeld

/etc/ldap.conf is very simple (it's just an ldap client)

i can do e.g. ldapsearch uidnumber=xxx and that works fine...so it has a connection to the ldap server

/etc/ldap.conf

```
# @(#)$Id: ldap.conf,v 2.47 2006/05/15 08:13:44 lukeh Exp $

#

# This is the configuration file for the LDAP nameservice

# switch library and the LDAP PAM module.

#

# PADL Software

# http://www.padl.com

#

# Your LDAP server. Must be resolvable without using LDAP.

# Multiple hosts may be specified, each separated by a

# space. How long nss_ldap takes to failover depends on

# whether your LDAP client library supports configurable

# network or connect timeouts (see bind_timelimit).

host xxx.xxx.xxx.xxx

# The distinguished name of the search base.

base dc=xx,dc=xx,dc=xx

# Another way to specify your LDAP server is to provide an

# uri with the server name. This allows to use

# Unix Domain Sockets to connect to a local LDAP Server.

#uri ldap://127.0.0.1/

#uri ldaps://xxx.xxx.xxx.xxx

#suffix         "dc=xx,dc=xx,dc=xx"

#uri ldapi://%2fvar%2frun%2fldapi_sock/

# Note: %2f encodes the '/' used as directory separator

# The LDAP version to use (defaults to 3

# if supported by client library)

ldap_version 3

# The distinguished name to bind to the server with.

# Optional: default is to bind anonymously.

#binddn cn=proxyuser,dc=padl,dc=com

# The credentials to bind with.

# Optional: default is no credential.

#bindpw secret

# The distinguished name to bind to the server with

# if the effective user ID is root. Password is

# stored in /etc/ldap.secret (mode 600)

#rootbinddn cn=manager,dc=padl,dc=com

# The port.

# Optional: default is 389.

#port 389

# The search scope.

#scope sub

#scope one

#scope base

# Search timelimit

#timelimit 30

# Bind/connect timelimit

#bind_timelimit 30

# Reconnect policy:

#  hard_open: reconnect to DSA with exponential backoff if

#             opening connection failed

#  hard_init: reconnect to DSA with exponential backoff if

#             initializing connection failed

#  hard:      alias for hard_open

#  soft:      return immediately on server failure

#bind_policy hard

# Connection policy:

#  persist:   DSA connections are kept open (default)

#  oneshot:   DSA connections destroyed after request

#nss_connect_policy persist

# Idle timelimit; client will close connections

# (nss_ldap only) if the server has not been contacted

# for the number of seconds specified below.

#idle_timelimit 3600

# Use paged rseults

#nss_paged_results yes

# Pagesize: when paged results enable, used to set the

# pagesize to a custom value

#pagesize 1000

# Filter to AND with uid=%s

#pam_filter objectclass=account

# The user ID attribute (defaults to uid)

#pam_login_attribute uid

# Search the root DSE for the password policy (works

# with Netscape Directory Server)

#pam_lookup_policy yes

# Check the 'host' attribute for access control

# Default is no; if set to yes, and user has no

# value for the host attribute, and pam_ldap is

# configured for account management (authorization)

# then the user will not be allowed to login.

#pam_check_host_attr yes

# Check the 'authorizedService' attribute for access

# control

# Default is no; if set to yes, and the user has no

# value for the authorizedService attribute, and

# pam_ldap is configured for account management

# (authorization) then the user will not be allowed

# to login.

#pam_check_service_attr yes

# Group to enforce membership of

#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com

# Group member attribute

#pam_member_attribute memberuid

# Specify a minium or maximum UID number allowed

#pam_min_uid 0

#pam_max_uid 0

# Template login attribute, default template user

# (can be overriden by value of former attribute

# in user's entry)

#pam_login_attribute userPrincipalName

#pam_template_login_attribute uid

#pam_template_login nobody

# HEADS UP: the pam_crypt, pam_nds_passwd,

# and pam_ad_passwd options are no

# longer supported.

#

# Do not hash the password at all; presume

# the directory server will do it, if

# necessary. This is the default.

pam_password crypt

# Hash password locally; required for University of

# Michigan LDAP server, and works with Netscape

# Directory Server if you're using the UNIX-Crypt

# hash mechanism and not using the NT Synchronization

# service.

#pam_password crypt

# Remove old password first, then update in

# cleartext. Necessary for use with Novell

# Directory Services (NDS)

#pam_password nds

# RACF is an alias for the above. For use with

# IBM RACF

#pam_password racf

# Update Active Directory password, by

# creating Unicode password and updating

# unicodePwd attribute.

#pam_password ad

# Use the OpenLDAP password change

# extended operation to update the password.

#pam_password exop

# Redirect users to a URL or somesuch on password

# changes.

#pam_password_prohibit_message Please visit http://internal to change your password.

# Use backlinks for answering initgroups()

#nss_initgroups backlink

# Enable support for RFC2307bis (distinguished names in group

# members)

#nss_schema rfc2307bis

# RFC2307bis naming contexts

# Syntax:

# nss_base_XXX          base?scope?filter

# where scope is {base,one,sub}

# and filter is a filter to be &'d with the

# default filter.

# You can omit the suffix eg:

# nss_base_passwd       ou=People,

# to append the default base DN but this

# may incur a small performance impact.

#nss_base_passwd        ou=People,dc=deepblue,dc=ethz,dc=ch

#nss_base_shadow        ou=People,dc=deepblue,dc=ethz,dc=ch

#nss_base_group         ou=Group,dc=deepblue,dc=ethz,dc=ch

#nss_base_hosts         ou=Hosts,dc=deepblue,dc=ethz,dc=ch

#nss_base_services      ou=Services,dc=padl,dc=com?one

#nss_base_networks      ou=Networks,dc=padl,dc=com?one

#nss_base_protocols     ou=Protocols,dc=padl,dc=com?one

#nss_base_rpc           ou=Rpc,dc=padl,dc=com?one

#nss_base_ethers        ou=Ethers,dc=padl,dc=com?one

#nss_base_netmasks      ou=Networks,dc=padl,dc=com?ne

#nss_base_bootparams    ou=Ethers,dc=padl,dc=com?one

#nss_base_aliases       ou=Aliases,dc=padl,dc=com?one

#nss_base_netgroup      ou=Netgroup,dc=padl,dc=com?one

# attribute/objectclass mapping

# Syntax:

#nss_map_attribute      rfc2307attribute        mapped_attribute

#nss_map_objectclass    rfc2307objectclass      mapped_objectclass

# configure --enable-nds is no longer supported.

# NDS mappings

#nss_map_attribute uniqueMember member

# Services for UNIX 3.5 mappings

#nss_map_objectclass posixAccount User

#nss_map_objectclass shadowAccount User

#nss_map_attribute uid msSFU30Name

#nss_map_attribute uniqueMember msSFU30PosixMember

#nss_map_attribute userPassword msSFU30Password

#nss_map_attribute homeDirectory msSFU30HomeDirectory

#nss_map_attribute homeDirectory msSFUHomeDirectory

#nss_map_objectclass posixGroup Group

#pam_login_attribute uid

#pam_filter objectclass=posixAccount

#pam_password ad

# configure --enable-mssfu-schema is no longer supported.

# Services for UNIX 2.0 mappings

#nss_map_objectclass posixAccount User

#nss_map_objectclass shadowAccount user

#nss_map_attribute uid msSFUName

#nss_map_attribute uniqueMember posixMember

#nss_map_attribute userPassword msSFUPassword

#nss_map_attribute homeDirectory msSFUHomeDirectory

#nss_map_attribute shadowLastChange pwdLastSet

#nss_map_objectclass posixGroup Group

#nss_map_attribute cn msSFUName

#pam_login_attribute msSFUName

#pam_filter objectclass=User

#pam_password ad

# RFC 2307 (AD) mappings

#nss_map_objectclass posixAccount user

#nss_map_objectclass shadowAccount user

#nss_map_attribute uid sAMAccountName

#nss_map_attribute homeDirectory unixHomeDirectory

#nss_map_attribute shadowLastChange pwdLastSet

#nss_map_objectclass posixGroup group

#nss_map_attribute uniqueMember member

#pam_login_attribute sAMAccountName

#pam_filter objectclass=User

#pam_password ad

# configure --enable-authpassword is no longer supported

# AuthPassword mappings

#nss_map_attribute userPassword authPassword

# AIX SecureWay mappings

#nss_map_objectclass posixAccount aixAccount

#nss_base_passwd ou=aixaccount,?one

#nss_map_attribute uid userName

#nss_map_attribute gidNumber gid

#nss_map_attribute uidNumber uid

#nss_map_attribute userPassword passwordChar

#nss_map_objectclass posixGroup aixAccessGroup

#nss_base_group ou=aixgroup,?one

#nss_map_attribute cn groupName

#nss_map_attribute uniqueMember member

#pam_login_attribute userName

#pam_filter objectclass=aixAccount

#pam_password clear

# For pre-RFC2307bis automount schema

#nss_map_objectclass automountMap nisMap

#nss_map_attribute automountMapName nisMapName

#nss_map_objectclass automount nisObject

#nss_map_attribute automountKey cn

#nss_map_attribute automountInformation nisMapEntry

# Netscape SDK LDAPS

ssl no

nss_map_attribute       uniqueMember member

pam_filter      objectclass=posixAccount

nss_base_passwd dc=deepblue,dc=ethz,dc=ch

nss_base_shadow dc=deepblue,dc=ethz,dc=ch

nss_base_group dc=deepblue,dc=ethz,dc=ch

# Netscape SDK SSL options

#sslpath /etc/ssl/certs

# OpenLDAP SSL mechanism

# start_tls mechanism uses the normal LDAP port, LDAPS typically 636

#ssl start_tls

###ssl on

# Gentoo note: Don't use 'ssl on' in 249/250. They are broken in some cases! Use start_tls instead.

# OpenLDAP SSL options

# Require and verify server certificate (yes/no)

# Default is to use libldap's default behavior, which can be configured in

# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for

# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".

#tls_checkpeer yes

# CA certificates for server certificate verification

# At least one of these are required if tls_checkpeer is "yes"

#tls_cacertfile /etc/ssl/ca.cert

#tls_cacertdir /etc/ssl/certs

# Seed the PRNG if /dev/urandom is not provided

#tls_randfile /var/run/egd-pool

# SSL cipher suite

# See man ciphers for syntax

#tls_ciphers TLSv1

# Client certificate and key

# Use these, if your server requires client authentication.

#tls_cert

#tls_key

# Disable SASL security layers. This is needed for AD.

#sasl_secprops maxssf=0

# Override the default Kerberos ticket cache location.

#krb5_ccname FILE:/etc/.ldapcache

# Timeout behavior

# Upstream nss_ldap hard-codes these values:

#nss_reconnect_tries 5                  # number of times to double the sleep time

#nss_reconnect_sleeptime 4              # initial sleep value

#nss_reconnect_maxsleeptime 64  # max sleep value to cap at

#nss_reconnect_maxconntries 2   # how many tries before sleeping

# This leads to a delay of 124 seconds (4+8+16+32+64=124) per lookup if the

# server is not available.

# For Gentoo's distribution of nss_ldap, as of 250-r1, we use these values

# (The hardwired constants in the code are changed to them as well):

#nss_reconnect_tries 4                  # number of times to double the sleep time

#nss_reconnect_sleeptime 1              # initial sleep value

#nss_reconnect_maxsleeptime 16  # max sleep value to cap at

#nss_reconnect_maxconntries 2   # how many tries before sleeping

# This leads to a delay of 15 seconds (1+2+4+8=15)

# If you are impatient, and know your LDAP server is reliable, fast or local,

# you may wish to use these values instead:

#nss_reconnect_tries 1                  # number of times to double the sleep time

#nss_reconnect_sleeptime 1              # initial sleep value

#nss_reconnect_maxsleeptime 1   # max sleep value to cap at

#nss_reconnect_maxconntries 3   # how many tries before sleeping

# This leads to a delay of 1 second.

```

----------

## VinzC

Please remove comments from your configuration file, for clarity's sake.

```
egrep -v '^[[:space:]]*($|#)' /etc/ldap.conf
```

EDIT: sorry, I meant to edit your previous post  :Smile:  .

----------

## jorisbeld

sorry, here you go:

```
host xx.xx.xx.xx

base dc=xxx,dc=xxx,dc=xx

ldap_version 3

pam_password crypt

ssl no

nss_map_attribute       uniqueMember member

pam_filter      objectclass=posixAccount

nss_base_passwd dc=xxx,dc=xx,dc=ch

nss_base_shadow dc=xxx,dc=xx,dc=ch

nss_base_group dc=xxx,dc=xx,dc=ch
```

----------

## chojin

 :Sad: .. I have the same problem..

My ldap setup has worked for years by now.. and after the last system/world update, ldap users and groups are no longer found and can't login. However there is no single ldap related error or warning message in /var/log/messages...

my pam configuration is exactly the same as jorisbeld's. My ldap.conf also doesn't look much different: 

```
host xxxxxx

base dc=xxxx,dc=xxxx

scope one

nss_base_passwd         ou=People,dc=xxxx,dc=xxxx

nss_base_shadow         ou=People,dc=xxxx,dc=xxxx

nss_base_group          ou=Group,dc=xxxx,dc=xxxx

nss_base_hosts          ou=Hosts,dc=xxxx,dc=xxxx

nss_reconnect_tries 4                   # number of times to double the sleep time

nss_reconnect_sleeptime 1               # initial sleep value

nss_reconnect_maxsleeptime 16   # max sleep value to cap at

nss_reconnect_maxconntries 2    # how many tries before sleeping

```

I used the gentoo ldap howto to check every setting, and it all looks good... But it doesn't work.

And my girlfriend, using kubuntu can still login and use the ldap server as I could in Gentoo before the upgrade..

Have you got it working yet?

----------

## chojin

Nevermind.. I seem to have solved it by re-emerging openldap, pam_ldap and nss_ldap . I don't know which one did the trick, but after the emerge completed, I could login again as an ldap user..

----------

