Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have this error when I ssh to my LDAP client using the login name on the LDAP server my LDAP client's running Ubuntu 9.10 Karmic my LDAP server is Fedora Core 4 and running Fedora Directory Server

ssh billyduc@ldap-client.mydomain.com
cat /var/log/auth.log    //on the client
Dec 18 10:24:17 ubuntu-ltsp sshd[4527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=billyhost.local  user=billyduc
Dec 18 10:24:17 ubuntu-ltsp sshd[4527]: pam_ldap: error trying to bind as user "uid=billyduc,dc=mydomain,dc=com" (Invalid credentials)
Dec 18 10:24:18 ubuntu-ltsp sshd[4527]: Failed password for billyduc from 192.168.5.121 port 51449 ssh2

Here's my /etc/pam.d/sshd

cat /etc/pam.d/sshd
auth    [success=1 default=ignore] pam_unix.so
auth    required 	pam_ldap.so use_first_pass
auth    required	pam_permit.so
account sufficient	pam_permit.so

I also edit my /etc/ssh/sshd_config in both client and Server

PasswordAuthentication yes

So I think something wrong with the password when the ssh server do checking

share|improve this question

1 Answer 1

This looks like a problem with pam_ldap, not your PAM setup for ssh.

The logs indicate that the configuration translated the username billyduc into the LDAP DN uid=billyduc,dc=mydomain,dc=com but encountered an Invalid credentials error when using the password provided to authenticate to that account.

You should check:

  • That this is indeed the right DN for user billyduc in the LDAP server. If not, change the pam_ldap configuration on the client.
  • That the server is configured to allow that DN to bind. Check this using a simple LDAP client, like ldapsearch on the command line or Apache Directory Studio.

If this doesn't help, you should add your pam_ldap configuration and your LDAP server configuration to the question.

share|improve this answer
    
Dear Jonathan, I had solve out this problem before, the problem come from the different between global password and user password format type, I've change all to use the save format 'mcrypt' and everything now working fine, so thank you so much for your suggestion. !^^! –  billyduc Mar 18 '10 at 5:27
    
You can answer your own question and mark your own answer as the one that solved the issue. As for the mcrypt: that's weird, I have a setup in which some passwords are SSHA, some are SHA and some use just crypt, I only have to point pam_ldap and nss_ldap to LDAP server and "it just works" with 4-line config files... –  Hubert Kario Dec 9 '10 at 19:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.