0
votes
0answers
27 views

LDAP: forced to change root password on every login

I have finally configured my new server as LDAP-client of my existing one. Now, every time I login as root, I am prompted to change my 'LDAP password': login as: root root@111.111.111.111's password: ...
-1
votes
0answers
16 views

Openldap ppolicy and pam_ldap interoperability

I followed ubuntu server guide, set up openldap for user authentication and connect my server to it using pam_ldap and things goes fine. But when i tried to add ppolicy to openldap, I'm not sure about ...
2
votes
1answer
110 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
0
votes
0answers
53 views

OpenLDAP+pam_ldap+ppolicy does not notify user that they are blocked

We have an OpenLDAP server configured to use the password policy overlay in order to lock users when they reach a certain number of failed password attempts. This is working perfectly but when a ...
1
vote
0answers
105 views

OpenLDAP on ArchLinux users cannot change passwd

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
0
votes
1answer
292 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
0
votes
1answer
100 views

OpenLDAP client configuration. Can search but cannot login?

I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :) First off, the LDAP ...
0
votes
0answers
38 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: Updating ...
3
votes
1answer
209 views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
2
votes
3answers
276 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
0
votes
1answer
131 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
0
votes
0answers
114 views

How to allow the root user to change LDAP password for normal users?

I have a LDAP-Server that is running on Debian 6.0.7 Squeeze. The LDAP-Server is used for the user authentication and the sudo management of all other virtual servers in our network. On a Debian 7 ...
3
votes
2answers
426 views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
0
votes
1answer
203 views

PAM: auth: pam_unix(dovecot:auth): authentication failure;

We have opnldap setup on our ubuntu server, and were getting this message for a user: auth: pam_unix(dovecot:account): account has expired (account expired) Sep 3 19:05:03 auth: ...
0
votes
1answer
187 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
1
vote
3answers
2k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
1answer
2k views

What is nsswitch compat mode?

Red Hat recommended me compat mode in /etc/nsswitch.conf as one of the options to enumerate LDAP users, but later said that it's not a much-used method. nsswitch.conf passwd: files compat ...
0
votes
1answer
85 views

What are disadvantages of using nsswitch compat?

In my current LDAP set-up "getent passwd" shows all 600+ users that exist in the LDAP, not enumerating only the 20 LDAP-users that have permission to access this netgroup/server. This can be solved ...
6
votes
1answer
242 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
1
vote
2answers
127 views

How can I allow users to change their local passwords?

We use an LDAP-server, but we also use local accounts. [jdoe@tst-03 ~]$ passwd Changing password for user jdoe. Changing password for jdoe. (current) UNIX password: Enter login(LDAP) password: This ...
0
votes
1answer
111 views

LDAP queries for local users

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. ...
0
votes
2answers
206 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
0
votes
1answer
211 views

restarting authconfig changes order of my /etc/nsswitch.conf

Here is my nsswitch.conf: passwd: files ldap sss shadow: files ldap sss group: files sss When I restart authconfig, it removes ldap from passwd, shadow, and group. Here's my ...
0
votes
1answer
649 views

getent and ldapsearch results are inconsistent concerning the loginShell

I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell. This user does ...
1
vote
1answer
337 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
265 views

validate only one user with pam ldap and nslcd

I want only user "theuser" to login to this host. I have tried the following in nslcd.conf: pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser)) but all can login. If ...
3
votes
1answer
61 views

sudo failing even though ownership and modes set correctly

I am getting the dreaded sudo: must be setuid root error even though the executable in /usr/bin/sudo has ownership root:root and mode 4755 (-rwsr-xr-x). /etc/sudoers is mode 440. My user is in sudoers ...
1
vote
4answers
223 views

PAM LDAP authentication restriction

I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers. For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we ...
2
votes
3answers
3k views

pam_ldap.so before pam_unix.so? Is it ever possible?

we have a couple of servers with PAM+LDAP. The configuration is standard (see http://arthurdejong.org/nss-pam-ldapd/setup or http://wiki.debian.org/LDAP/PAM). For example, /etc/pam.d/common-auth ...
2
votes
1answer
571 views

Linux ldap authentication, pam_filter ignored

I've set up linux client authentication via ldap, it works. I want to control user's access to several services by adding or removing different OUs for accounts. E.g., if user is allowed to login ...
2
votes
1answer
140 views

Locking user account on RHEL using PAM LDAP

I have a bit of an edge case here. My institution has a RHEL server where students can log in and do their work. Accounts are held in LDAP and the server uses PAM and LDAP to authenticate. At the end ...
1
vote
1answer
364 views

Immediate logout after login with PAM, Kerberos, and LDAP

I've set up remote login on a computer using Kerberos and LDAP. I've also configured NFS to mount onto /home so that the user's home directory is the same wherever they login. Kerberos authentication ...
12
votes
2answers
221 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
1
vote
0answers
411 views

CentOS PAM+LDAP login and host attribute

My system is CentOS 6.3, openldap is configured well, PAM authorization works fine. But after turning pam_check_host_attr to yes, all LDAP-auths fail with message "Access denied for this host". ...
0
votes
1answer
68 views

Can you use LDAP and PAM to implement a restricted shell?

Can you use LDAP and PAM to implement a restricted shell and control those users via groups on the LDAP DC? I would like to do this for several Red Hat, Solaris and Ubuntu servers? Thanks!
1
vote
3answers
53 views

Rip authentication from LDAP to local

We are taking a small portion of our network offline, and running a separate network using that portion. (By small portion I mean 2 servers, that will be connected to 30 odd boxes that aren't usually ...
1
vote
1answer
1k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
1
vote
2answers
519 views

LDAP and pam without binddn and anonymous access

I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
4
votes
2answers
293 views

Samba: read-only LDAP + additional local users

My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication. Now and then there will be ...
1
vote
1answer
2k views

LdapErr: DSID-0C0903AA, data 52e: authenticating against AD '08 with pam_ldap

I have full admin access to the AD '08 server I'm trying to authenticate towards. The error code means invalid credentials, but I wish this was as simple as me typing in the wrong password. First ...
1
vote
2answers
1k views

Samba + LDAP: Newly created users cannot log in

I'm having a problem where users which recently were created are unable to log in, even though they have been added to the correct groups. When viewing the error logs, I'm getting these errors: ...
0
votes
2answers
1k views

How to enable LDAP auth for SFTP logins only

I currently use ActiveDirectory for authentication on my Ubuntu 10.04 servers using a tool called Centrify Express. Centrify has a custom .so file that is configured in /etc/pam.d/common-auth. I'd ...
0
votes
0answers
517 views

Clients not recognizing secondary LDAP groups?

I'm having an issue where users who are members of secondary groups in LDAP are not being recognized as members of that group by the client. In this case, user jdoe is not being recognized as a member ...
0
votes
2answers
267 views

LDAP auth in Ubuntu PAM?

I have a 64-bit Ubuntu 11.04 server I'm setting up, and I would like to configure it to use LDAP for authentication. The LDAP server happens to be an ActiveDirectory server, but I'm not trying to bind ...
0
votes
1answer
793 views

Apache Kerberos Authentication with LDAP Authorization: access to / failed, reason: require directives present and no Authoritative handler

I am trying to get a VirtualHost (well multiple VirutalHosts) up and running with kerberos authentication and group requirements. My latest configuration within the <Directory> directive looks ...
1
vote
1answer
3k views

smbpasswd: Failed to add entry for user

tl;dr Assuming a basic (but functioning) LDAP/PAM configuration, how come smbpasswd fails with this error message when I try to add an existing UNIX/LDAP user to Samba? I have a basic, but working ...
0
votes
1answer
328 views

pam_ldap, where is the filter set?

A while ago I asked a question about this same issue already (Cyrus on CentOS with sasl / pam / ldap), and I came a bit further. The Bind DN is no longer empty; LDAP works with all apps except imap. ...
1
vote
3answers
2k views

VsFTPd - pam_mkhomedir

I am trying to set up a FTP server that authenticates against an LDAP server. This part is done and works. My server is VsFTPd on Ubuntu Server 11.04. But I have to create the home directories for my ...
3
votes
2answers
6k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
1
vote
1answer
1k views

VsFTPd - LDAP - PAM [duplicate]

Possible Duplicate: VsFTPd - LDAP - PAM I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both ...