Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I 've managed to setup ldap server and i can search it succefully from the server machine. i ve added to the database all info except from the fstab file and automount info. I migrated succefully the sudoers file too. I used padl scripts. However i want to login from a wireless client only via ldap and i cant. What i did was from the client i run

 pam-config -a --ldap 

and edited nsswitch.conf to allow ldap binds. When i login and if i have erased my local accounts from /etc/passwd i have a critical login error and after some minutes i get a login prompt but my input doesnt show up in the screen(despite the fact that i type). On the server i can see activity that the client has succeffully queried the server and the server accepted the connection but after some read write cryptographic messages between the 2 machines i see some entries like

   TLS trace: SSL_accept:error in SSLv2/v3 read client hello A
   TLS: can't accept: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol.
   50aba02e connection_read(16): TLS accept failure error=-1 id=1508, closing
   50aba04c conn=1510 fd=16 closed (TLS negotiation failure)

but i have configured properly tls directives in both the client and the server machines (the ldap.conf files are identical).The cacert.pem is copied over to the client. The server in slapd.conf doesnt have to verify the clients certificate. Here are the entries in slapd.conf

     TLSCACertificateFile /etc/openldap/cacert.pem
     TLSCertificateFile /etc/openldap/newcert.pem
     TLSCertificateKeyFile /etc/openldap/newkey.pem
     TLSVerifyClient never
     TLSCipherSuite HIGH:MEDIUM:+SSLv2

/etc/ldap.conf and /etc/openldap/ldap.conf are both configured using man pages and these

Any advice here i repeat i can ldapsearch from the server machine succefully with any user but cant login or search from the wireless client. I believe apart from the tls obvious error here something has to do with pam because it adds to common-auth-pc file a required entry and i think it expects something different.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.