Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been migrating some servers and desktops using Ubuntu 10.04 from getting the users from an old OpenLDAP implementation to a newer Centos Active Directory. I haven't had any problems so far, until I reached a Debian Lenny server.

I've set up the server as the others, setting /etc/ldap.conf and /etc/ldap/ldap.conf. However, when I issue "getent passwd", I get nothing from the LDAP server.

Reading the pam_ldap manpage, I realized that /etc/ldap.conf was not an accepted file by pam_ldap -it worked with Ubuntu though-, so I renamed it to /etc/pam_ldap.conf. Same result. However, once I've changed the name of this file, when I login using SSH I get this on the LDAP server logs:

[20/Jul/2012:11:19:40 +0200] conn=16501 fd=155 slot=155 connection from x.x.x.50 to 10.1.176.237
[20/Jul/2012:11:19:40 +0200] conn=16501 op=0 BIND dn="uid=ubuntu,ou=Applications,ou=CITIUS,dc=inv,dc=usc,dc=es" method=128 version=3
[20/Jul/2012:11:19:40 +0200] conn=16501 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=ubuntu,ou=applications,ou=citius,dc=inv,dc=usc,dc=es"
[20/Jul/2012:11:19:40 +0200] conn=16501 op=1 SRCH base="ou=People,ou=CITIUS,dc=inv,dc=usc,dc=es" scope=2 filter="(uid=jorge.suarez)" attrs=ALL
[20/Jul/2012:11:19:40 +0200] conn=16501 op=1 RESULT err=0 tag=101 nentries=1 etime=0 notes=U
[20/Jul/2012:11:19:40 +0200] conn=16501 op=2 BIND dn="uid=jorge.suarez,ou=People,ou=CITIUS,dc=inv,dc=usc,dc=es" method=128 version=3
[20/Jul/2012:11:19:40 +0200] conn=16501 op=2 RESULT err=49 tag=97 nentries=0 etime=0

The password isn't working. I don't know that could be wrong, anything else seems to be OK. That user/password is working from another clients:

[20/Jul/2012:11:29:39 +0200] conn=16528 fd=188 slot=188 connection from x.x.x.224 to 10.1.176.237
[20/Jul/2012:11:29:39 +0200] conn=16528 op=0 BIND dn="uid=ubuntu,ou=Applications,ou=CITIUS,dc=inv,dc=usc,dc=es" method=128 version=3
[20/Jul/2012:11:29:39 +0200] conn=16528 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=ubuntu,ou=applications,ou=citius,dc=inv,dc=usc,dc=es"
[20/Jul/2012:11:29:39 +0200] conn=16528 op=1 SRCH base="ou=People,ou=CITIUS,dc=inv,dc=usc,dc=es" scope=2 filter="(uid=jorge.suarez)" attrs=ALL
[20/Jul/2012:11:29:39 +0200] conn=16528 op=1 RESULT err=0 tag=101 nentries=1 etime=0 notes=U
[20/Jul/2012:11:29:39 +0200] conn=16528 op=2 BIND dn="uid=jorge.suarez,ou=People,ou=CITIUS,dc=inv,dc=usc,dc=es" method=128 version=3
[20/Jul/2012:11:29:39 +0200] conn=16528 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=jorge.suarez,ou=people,ou=citius,dc=inv,dc=usc,dc=es"

I'm using SSHA for storing passwords on the LDAP server. Maybe this is not supported by Debian Lenny?

On pam_ldap.conf, I've set up this, as in all the other servers:

# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
pam_password md5

Also tried clear, but it didn't work. Anyways, it's weird that issuing getent passwd still gets me no users.

However, if I use pamtest from the package libpam-dotfile to test login, it works.

# pamtest ssh jorge.suarez
Trying to authenticate <jorge.suarez> for service <ssh>.
Password: 
Authentication successful.
# pamtest foo jorge.suarez
Trying to authenticate <jorge.suarez> for service <foo>.
Password: 
Authentication successful.

But "su" won't work also:

# su jorge.suarez
Id. descoñecido: jorge.suarez

Just the output from getent passwd :

# getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
Debian-exim:x:101:103::/var/spool/exim4:/bin/false
statd:x:102:65534::/var/lib/nfs:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
luser:x:1000:1000:Usuario local de Burdeos,,,:/home/luser:/bin/bash
messagebus:x:105:107::/var/run/dbus:/bin/false
sge-admin:x:1001:1001:Administrador do SGE,,,:/home/cluster/sge-admin:/bin/bash
ntp:x:107:110::/home/ntp:/bin/false
haldaemon:x:108:111:Hardware abstraction layer,,,:/var/run/hald:/bin/false
vde2-net:x:109:114::/var/run/vde2:/bin/false
uml-net:x:110:115::/home/uml-net:/bin/false
polkituser:x:111:116:PolicyKit,,,:/var/run/PolicyKit:/bin/false
Debian-pxe:x:113:65534:Dummy user for Debian pxe package,,,:/home/Debian-pxe:/bin/false

Nscd was stopped from the beginning.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I've migrated to libpam-ldapd and now everything works.

I only had to redo the configuration on a new file called ''/etc/nslcd.conf''. libpam-ldapd is much better than libpam-ldap.

The most interesting thing is that it relies on a daemon, so you can just call the daemon with debug parameters (''nslcd -d'') and take a look if something is not working as expected, if there's some caveat on the configuration, etc.

Ubuntu 10.04 has libpam-ldapd 0.7.x that lacks some interesting options. Better go for a 0.8.x by using a PPA. Debian Squeeze already has the 0.8.x version, and I've installed it from there on Lenny without problems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.