Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a 389-ds LDAP Server on Linux, and I want to configure Solaris to authenticate against it as an LDAP client.

I am able to see the user in getent passwd output, and can see user in ldaplist output, but cant login via ssh.

I dont have much idea about solaris - This is the first time I installed solaris. Can someone give me ideas as to why this may not be working and how to fix it? My configuration and some troubleshooting results are below.

nsswitch.conf

passwd:     files ldap
group:      files ldap
hosts: files dns # Added by DHCP
ipnodes: files dns # Added by DHCP
networks:   files
protocols:  files
rpc:        files
ethers:     files
netmasks:   files
bootparams: files
publickey:  files
netgroup:   files
automount:  files
aliases:    files
services:   files
printers:   user files
auth_attr:  files
prof_attr:  files
project:    files
tnrhtp:     files
tnrhdb:     files

pam.conf

login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth required           pam_unix_cred.so.1
login   auth required           pam_unix_auth.so.1
login   auth required           pam_dial_auth.so.1
login   auth required           pam_ldap.so.1
rlogin  auth sufficient         pam_rhosts_auth.so.1
rlogin  auth requisite          pam_authtok_get.so.1
rlogin  auth required           pam_dhkeys.so.1
rlogin  auth required           pam_unix_cred.so.1
rlogin  auth required           pam_unix_auth.so.1
rlogin  auth required           pam_unix_auth.so.1
krlogin auth required           pam_unix_cred.so.1
krlogin auth required           pam_krb5.so.1
rsh     auth sufficient         pam_rhosts_auth.so.1
rsh     auth required           pam_unix_cred.so.1
rsh     auth required           pam_ldap.so.1
krsh    auth required           pam_unix_cred.so.1
krsh    auth required           pam_krb5.so.1
ktelnet auth required           pam_unix_cred.so.1
ktelnet auth required           pam_krb5.so.1
ppp     auth requisite          pam_authtok_get.so.1
ppp     auth required           pam_dhkeys.so.1
ppp     auth required           pam_unix_cred.so.1
ppp     auth required           pam_unix_auth.so.1
ppp     auth required           pam_dial_auth.so.1
ppp     auth required           pam_ldap.so.1
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1
other   auth required           pam_unix_auth.so.1
other   auth required           pam_ldap.so.1
passwd  auth required           pam_passwd_auth.so.1
passwd  auth required           pam_ldap.so.1
cron    account required        pam_unix_account.so.1
other   account sufficient      pam_ldap.so.1
other   account requisite       pam_roles.so.1
other   account required        pam_unix_account.so.1
other   session required        pam_unix_session.so.1
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1 force_check
other   password required       pam_authtok_store.so.1

/var/ldap/ldap_client_file

NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= 192.168.122.155
NS_LDAP_SEARCH_BASEDN= dc=example,dc=com
NS_LDAP_AUTH= simple
NS_LDAP_SEARCH_REF= TRUE
NS_LDAP_SEARCH_SCOPE= sub
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_CACHETTL= 43200
NS_LDAP_PROFILE= default
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=People,dc=example,dc=com?
sub
NS_LDAP_SERVICE_SEARCH_DESC= group: ou=Groups,dc=example,dc=com?sub
NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=People,dc=example,dc=com?sub
NS_LDAP_BIND_TIME= 2

User Lookup

bash-3.2# getent passwd test
test:x:1001:1001::/home/test:/bin/bash

bash-3.2# ldaplist -l passwd test
dn: uid=test,ou=People,dc=example,dc=com
        uidNumber: 1001
        sn: test
        gidNumber: 1001
        loginShell: /usr/bin/bash
        shadowMax: 99999
        objectClass: person
        objectClass: organizationalPerson
        objectClass: inetOrgPerson
        objectClass: posixAccount
        objectClass: shadowAccount
        objectClass: top
        uid: test
        shadowLastChange: 12994
        cn: test
        homeDirectory: /home/test
        shadowWarning: 7
        userPassword: [REDACTED]
share|improve this question
    
Can you bind as the user in question using ldapclient on the Solaris host? –  Ladadadada Dec 13 '11 at 19:19
    
@Ladadadada Yes I can. Only authentication using SSH/terminal fails. I believe it has something to do with PAM or a stuff i am missing. –  atolani Dec 13 '11 at 20:36
    
You can't log in using SSH, but I see no logging information in your pastebin from the SSH daemon -- We can't magically divine what's wrong without more information :-) Also please include the relevant bits in your question - If your pastebin goes away this question loses all meaning. –  voretaq7 Dec 14 '11 at 19:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.