Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an existing LDAP (openldap) server that I'm trying to get CentOS servers to authenticate to and for the life of me I cannot make this happen. For example, I want to do # ssh some_ldap_user@whateverclientserver and be able to successfully authenticate. Can someone please point me to a resource that can help me make this happen? It doesn't seem lie a particularly complex task but my search skills are really letting me down or something.

share|improve this question
What have you already done? If you want a howto on setting up pam_ldap/nss_ldap Google has plenty of them. Otherwise we need more information to help you... –  voretaq7 May 23 '11 at 21:37

1 Answer 1

Assuming your LDAP server is setup correctly (and there are a TON of variables).. this is a small script I wrote to execute on each of our machines, to enable LDAP authentication:

#Redhats tool to configure LDAP auth (aka, 'setup' from command line)
#change order of two servers to change which one to check first (I pick closest one)
authconfig --enableldap --enableldapauth --enablemkhomedir --ldapserver=server1.local,server2.local --ldapbasedn="dc=whatever,dc=local" --update
#I use sudo in LDAP. (very handy tool, see the SUDO LDAP files on the web)
echo 'sudoers:    files ldap' >> /etc/nsswitch.conf
echo 'base dc=whatever,dc=local
timelimit 120
bind_policy soft
bind_timelimit 120
idle_timelimit 3600
uri ldaps://server1.local/
uri ldaps://server2.local/
ssl yes
#without this line, will complain about our self signed certs
tls_checkpeer no
#because of security choices, have to send the password in the clear (but it goes over SSL, so no big deal).  Then Ldap will hash it and compare.
#without this line, my people couldn't change passwords.
pam_password clear
sudoers_base    ou=SUDOers,dc=whatever,dc=local
' > /etc/ldap.conf
#this lets us know which servers LDAP authentication is setup on...
echo '*************************************************' >> /etc/ssh/banner
echo '*Authorized users, please use your LDAP password*' >> /etc/ssh/banner
echo '*************************************************' >> /etc/ssh/banner

echo 'Banner /etc/ssh/banner' >> /etc/ssh/sshd_config
service sshd restart
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.