1

I'm configuring LDAP on a cluster of Ubuntu 14.04 machines.

I successfully set up the LDAP host using these instructions. Now I'm trying to get an LDAP client to work using these instructions.

ldapsearch works from the client (i.e. I can do ldapsearch -x -LLL -h REDACTED -D REDACTED -w REDACTED -b REDACTED from the client machine and get exactly the results I would expect).

However, the client machine doesn't see the LDAP users at all (i.e. getent passwd doesn't show any LDAP users, sudo su - LDAP_USERNAME on the client machine returns No passwd entry for user error, ssh LDAP_USERNAME@LDAP_CLIENT gets a Permission denied error).

Relevant files:

/etc/nsswitch.conf

passwd:         ldap compat
group:          ldap compat
shadow:         ldap compat

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup: nis

/etc/pam.d/common-session

session [default=1]                     pam_permit.so

session requisite                       pam_deny.so

session required                        pam_permit.so

session optional                        pam_umask.so

session required                        pam_mkhomedir.so umask=0022 skel=/etc/skel
session required        pam_unix.so
session optional                        pam_ldap.so
session optional        pam_systemd.so

/etc/pam.d/common-auth

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass

auth    requisite                       pam_deny.so

auth    required                        pam_permit.so

auth    optional                        pam_cap.so

/etc/pam.d/common-account

account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so

account requisite                       pam_deny.so

account required    

/etc/pam.d/common-password

password        [success=2 default=ignore]      pam_unix.so obscure sha512
password        [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok     try_first_pass

password        requisite                       pam_deny.so

password        required    

Any ideas as to what could possibly be the culprit of this issue? If this info is incomplete then feel free to ask for any additional context that might be relevant. Any help would be greatly appreciated.

EDIT: I see the following in /var/log/auth.log on the client machine.

Feb 20 11:19:31 REDACTED nscd: nss_ldap: failed to bind to LDAP server ldap:///REDACTED: Invalid credentials
Feb 20 11:19:31 REDACTED nscd: nss_ldap: reconnecting to LDAP server...
Feb 20 11:19:31 REDACTED nscd: nss_ldap: failed to bind to LDAP server ldap:///REDACTED: Invalid credentials
Feb 20 11:19:31 REDACTED nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...
Feb 20 11:19:32 REDACTED nscd: nss_ldap: failed to bind to LDAP server ldap:///REDACTED: Invalid credentials
Feb 20 11:19:32 REDACTED nscd: nss_ldap: could not search LDAP server - Server is unavailable
Feb 20 11:19:42 REDACTED nscd: nss_ldap: failed to bind to LDAP server ldap:///REDACTED: Invalid credentials
Feb 20 11:19:42 REDACTED nscd: nss_ldap: reconnecting to LDAP server...
Feb 20 11:19:42 REDACTED nscd: nss_ldap: failed to bind to LDAP server ldap:///REDACTED: Invalid credentials
Feb 20 11:19:42 REDACTED nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...
Feb 20 11:19:43 REDACTED nscd: nss_ldap: failed to bind to LDAP server ldap:///REDACTED: Invalid credentials
Feb 20 11:19:43 REDACTED nscd: nss_ldap: could not search LDAP server - Server is unavailable

And, to reiterate, I can connect to the LDAP host via the LDAP client with ldapsearch using the exact same password that is in /etc/ldap.secret

EDIT 2: I tried changing the host server on the off chance that it was some firewall issue (though I don't know why ldapsearch would work in that case). Same exact issue.

  • @AaronCopley: So, to confirm, I should copy session optional pam_ldap.so to the other pam files? – Gaios Feb 19 '15 at 16:54
  • @AaronCopley: Check the edit. Do those files look good? – Gaios Feb 19 '15 at 17:00
  • @AaronCopley: sudo /etc/init.d/nscd restart works fine. However, sudo update-rc.d nslcd enable returns update-rc.d: /etc/init.d/nslcd: file does not exist – Gaios Feb 19 '15 at 17:10
  • @AaronCopley: Yeah, sudo update-rc.d nscd enable worked. getent passwd still doesn't see the LDAP users. – Gaios Feb 19 '15 at 17:44
  • 1
    @Aaron Copley - nslcd and nscd are completely different programs. The former is a daemon LDAP authenticator (mandatory for libnss-ldapd & libpam-ldapd), the latter is (purely optional) caching daemon that is commonly used with *nix LDAP auth. Both names are valid in this context, but for different purposes. – sam_pan_mariusz Feb 21 '15 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.