Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My system is CentOS 6.3, openldap is configured well, PAM authorization works fine.

But after turning pam_check_host_attr to yes, all LDAP-auths fail with message "Access denied for this host".

  1. hostname on the server returns correct value, the same value is listed in user's profile.
  2. "pam_check_host_attr no" works fine and allows everyone with correct uid/password
  3. a piece of /var/log/secure:

    Sep 26 05:33:01 ldap sshd[1588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=my-host user=my-username

    Sep 26 05:33:01 ldap sshd[1588]: Failed password for my-username from 77.AA.BB.CC port 58528 ssh2

    Sep 26 05:33:01 ldap sshd[1589]: fatal: Access denied for user my-username by PAM account configuration

  4. Another two servers (CentOS 5.7 Debian) authorizes on this LDAP server correctly. Even with pam_check_host_attr yes!

  5. I didn't edit /etc/security/access.conf, it is empty, only default comments.

I don't know what to do! How to fix this?

share|improve this question
    
what does the directory server log show for this condition? – Terry Gardner Sep 27 '12 at 16:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.