Centos 6 Linux and nss-pam-ldapd

Question

I am trying get centos 6 to authenticate against ldap (active directory to be specific) I am a bit confuse though because after installing nss-pam-ldapd I see several files that appear to be the same configuration. For example I have /etc/pam_ldap.conf and /etc/nslcd.conf. Both of these files seem to have the same configuration options. None seem to work. Any guidance would be much appreciated.

Answer 1

Make sure you:
   1. yum remove sssd
   2. yum install openldap-clients nss-pam-ldapd
   3. Run Authconfig
   4. Check your /etc/openldap/ldap.conf
           - Check for your valid certfile is pointed to
   5. Check your /etc/nslcd.conf
           - confirm ssl start_tls
           - confirm certfile is pointing to a valid file

Here is a example authconfig line:

authconfig --enableldap --enableldapauth \
   --ldapserver=ldap://ldap.example.com/,ldap://ldap2.example.com/ \
   --ldapbasedn=dc=example,dc=com  --update

Then make sure:
/etc/openldap/ldap.conf
TLS_CACERT /etc/pki/tls/certs/ca-bundle.crt
TLS_REQCERT demand


And in /etc/nslcd.conf:
ssl start_tls
tls_cacertfile /etc/pki/tls/certs/ca-bundle.crt
tls_reqcert never

So that you get a certificate not a empty directory.

Answer 2

While this has already been answered, there are few things to keep in mind:

• It is important to note that there is no need to disable sssd, as that can connect to active directory.
• You can also enable TLS and everything else in one shot with authconfig.

So to connect to LDAP, you would:

• Install pam_ldap, nss-pamd-ldapd and sssd (using yum to satisfy the dependencies) and enable sssd
• Copy the cert file into /etc/openldap/cacerts

Then in one shot, run this:

authconfig --enablesssd --enableldap --enableldaptls --ldapserver=ldap.example.com --ldapbasedn=dc=example,dc=com --enableldapauth --update

(authconfig will automatically pick up the cert residing in /etc/openldap/cacerts)

Answer 3

I can confirm the steps should be working.

if not use the TLS, just "ssl yes" is ok too

Must install these packages, cost me a lot of time to find out all these necessary packages on Redhat 6 nss-pam-ldapd pam_ldap openldap openldap-clients

Sam

Answer 4

I basically got this to work (except its sending passwords in clear text, I plan to fix this) so I figured I would share what I did.

I installed the nss-pam-ldap package using yum. I edited both pam_ldap.conf and nslcd.conf to reflect my environment. I then ran authconfig-tui answered its questions as best as I could. I did not turn on tls or ssl, just wanted to see if things were working. I ran "/etc/init.d/nslcd restart" and then I could su into ldap users as well as login with them via ssh. Then when I turned on ssl/tls it stopped working. And so I looked using TCP dump and grep-ed and found that my password was getting sent in clear text. So it works but I still need to get ssl/tls working. I would ldap client would send passwords already hashed but I guess not. Maybe there is a way to tell it what cypher to use to has before sending the password to ldap.

Any way I hope this helps others with this problem. Thanks