1

I'm running a CentOS 7 VirtualBox instance. I am trying to set up LDAP authentication through our company Active Directory server.

Note: The AD server DOES NOT have Unix extensions installed.

Setup:

  • I have nss-pam-ldapd installed
  • The nslcd and nscd services are set to run at startup
  • /etc/nsswitch.conf has been edited to add ldap:

    passwd:     files ldap
    group:      files ldap
    shadow:     files ldap 
    hosts:      files ldap dns myhostname
    ethers:     files ldap
    networks:   files ldap
    protocols:  files ldap
    rpc:        files ldap
    services:   files ldap sss
    aliases:    files ldap nisplus
    
  • /etc/pam.d/password-auth and /etc/pam.d/system-auth edited to add:

    auth     sufficient    pam_ldap.so use_first_pas
    account  [default=bad success=ok user_unknown=ignore] pam_ldap.so
    password sufficient    pam_ldap.so use_authok
    session  optional      pam_ldap
    session  required      pam_mkhomedir.so skel=/etc/skel umask=0077
    
  • /etc/nslcd.conf edited:

    uid nslcd
    gid nslcd
    
    uri ldap://myserver.com/
    
    base dc=myserver,dc=com
    
    binddn CN=My Name,OU=Users,OU=DV,DC=myserver,DC=com
    
    bindpw PASSWORDHERE
    
    # Alternative mappings for Active Directory
    pagesize 1000
    referrals off
    idle_timelimit 800
    filter passwd (&(objectClass=user)(!(objectClass=computer)))
    map    passwd uid           userPrincipalName
    map    passwd uidNumber     objectSid:CorrectSID
    map    passwd gidNumber     objectSid:CorrectSID
    map    passwd homeDirectory "/home/$cn"
    map    passwd gecos         displayName
    map    passwd loginShell    "/bin/bash"
    filter group (objectClass=group)
    map    group gidNumber      objectSid:CorrectSID
    ssl no
    

On rebooting the VM, and remoting in with the default user, I can list all the AD users (user@myserver.com), and the groups, using

    $ getent passwd
    and
    $ getent group

However, if I attempt to either login to the GUI or remote in with my AD user:

    $ ssh my.name@myserver.com@linuxboxip
    my.name@myserver.com@linuxboxip's password:
    Permission denied, please try again.

I've been over the related questions on this site, through the debug, and reconfigured fresh from scratch. No luck.

Any thoughts?

  • I'd work with your systems adminstration group...your system might be restricted administratively from getting to the AD. – mdpc Feb 17 '17 at 0:02
  • I'll look into it, but I'm betting it is not the problem. I can see all the users and groups in the AD inside the Linux instance using getent – Richard Wymarc Feb 17 '17 at 14:16
0

OK, I found the problem.

See link

When editing the PAM files: /etc/pam.d/password-auth and /etc/pam.d/system-auth

The edits must be done to the appropriate sections, not just added to the bottom of the file. In particular, the password required pam_deny.so lines MUST be the LAST entry in the section.

I can now log in with LDAP user/password via SSH and the GUI.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.