up vote 2 down vote favorite
share [g+] share [fb]

I have problem with ldap, that when it is online, I login with user/pass from LDAP db and then cannot su to root with local pass. When I turn offline LDAP I can login with local user/pass and su to root with local pass. auth.log:

Sep 27 12:18:33 intranet sshd[18321]: pam_unix(sshd:session): session opened for user mejmo by (uid=0)
Sep 27 12:18:39 intranet unix_chkpwd[18340]: check pass; user unknown
Sep 27 12:18:39 intranet unix_chkpwd[18340]: password check failed for user (root)
Sep 27 12:18:39 intranet su[18339]: pam_unix(su:auth): authentication failure; logname=mejmo uid=10009 euid=10009 tty=/dev/pts/1 ruser=mejmo rhost=  user=r
Sep 27 12:18:42 intranet su[18339]: pam_authenticate: Permission denied
Sep 27 12:18:42 intranet su[18339]: FAILED su for root by mejmo

I'm typing the good password, because I can login when LDAP server is offline. Please help, getting crazy ...

EDIT: I figured out, that when I create user locally as well, turn LDAP online, then I am able to su to root. I think the problem is, that pam_unix can't see the user that is using su, because there is no entry in passwd, but nssswitch.conf is ok (files ldap on passwd,shadow,etc.)

EDIT2:

account         sufficient      pam_ldap.so debug
account         sufficient      pam_unix.so audit

auth    sufficient      pam_ldap.so
auth    sufficient      pam_unix.so audit likeauth use_first_pass
auth    required        pam_deny.so

EDIT3: It works with nscd running, but it does nasty logs and occasionally I cannot login .. Where could be the problem with nscd ? :( 

Sep 27 16:27:35 intranet sshd[25830]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Sep 27 16:27:35 intranet sshd[25830]: pam_ldap: reconnecting to LDAP server...
Sep 27 16:27:35 intranet sshd[25830]: pam_ldap: ldap_simple_bind Can't contact LDAP server
link|improve this question
55% accept rate
What's in your PAM configuration files? – pjc50 Sep 27 '10 at 11:44
My problem seems to appear only when using ldaps ... Can it be a problem with certificate ? – John Sep 27 '10 at 12:35
feedback

2 Answers

up vote 1 down vote

Are you sure that you check the local authentication first, then the LDAP backend ?

Check your /etc/nsswitch.conf

It should show:

passwd: files ldap group: files ldap shadow: files ldap

or maybe also the "compat" option

Edit:

nscd has been a source of problems on my RHEL machines, creating bugs where you'd never expected one from nscd. So the answer is yes, nscd can be the cause of this strange behavior. You should try to clean the cache of nscd during your tests.

nscd -i passwd nscd -i group

link|improve this answer
My nsswitch is just like this. – John Sep 27 '10 at 11:22
feedback
up vote 0 down vote

Is the user from LDAP in the correct group to do su to root?

Typically this is the wheel group, but may be different in your environment.

link|improve this answer
I do not use pam_wheel, so the group wheel does not affect this. – John Sep 27 '10 at 11:21
So you checked that the LDAP user has permission to su to root though right? Or even run su at all? – dunxd Sep 27 '10 at 11:29
How can I check it ? Debian. – John Sep 27 '10 at 12:02
Looking again at your log messages, su:auth says that mejmo doesn't have permission to su. So it is almost certain that you need to say who can su somewhere. You also should check the permissions on the su executable too, just in case - ls -l /bin/su. But I don't think this is the issue. PAM says no, so look into PAM config. – dunxd Sep 27 '10 at 12:51
I managed to get it working. I had to enable nscd (i disable it in the past because it was making big big problems while debugging), I set cache ttl to couple of seconds, and now everthing is working. I really dunno why, but I think that nscd is looking in passwd file somehow too (except for nsswitch). – John Sep 27 '10 at 13:09
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.