I have this error when I ssh to my LDAP client using the login name on the LDAP server my LDAP client's running Ubuntu 9.10 Karmic my LDAP server is Fedora Core 4 and running Fedora Directory Server

ssh billyduc@ldap-client.mydomain.com
cat /var/log/auth.log    //on the client
Dec 18 10:24:17 ubuntu-ltsp sshd[4527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=billyhost.local  user=billyduc
Dec 18 10:24:17 ubuntu-ltsp sshd[4527]: pam_ldap: error trying to bind as user "uid=billyduc,dc=mydomain,dc=com" (Invalid credentials)
Dec 18 10:24:18 ubuntu-ltsp sshd[4527]: Failed password for billyduc from port 51449 ssh2

Here's my /etc/pam.d/sshd

cat /etc/pam.d/sshd
auth    [success=1 default=ignore] pam_unix.so
auth    required    pam_ldap.so use_first_pass
auth    required    pam_permit.so
account sufficient  pam_permit.so

I also edit my /etc/ssh/sshd_config in both client and Server

PasswordAuthentication yes

So I think something wrong with the password when the ssh server do checking


This looks like a problem with pam_ldap, not your PAM setup for ssh.

The logs indicate that the configuration translated the username billyduc into the LDAP DN uid=billyduc,dc=mydomain,dc=com but encountered an Invalid credentials error when using the password provided to authenticate to that account.

You should check:

  • That this is indeed the right DN for user billyduc in the LDAP server. If not, change the pam_ldap configuration on the client.
  • That the server is configured to allow that DN to bind. Check this using a simple LDAP client, like ldapsearch on the command line or Apache Directory Studio.

If this doesn't help, you should add your pam_ldap configuration and your LDAP server configuration to the question.

  • Dear Jonathan, I had solve out this problem before, the problem come from the different between global password and user password format type, I've change all to use the save format 'mcrypt' and everything now working fine, so thank you so much for your suggestion. !^^!
    – billyduc
    Mar 18 '10 at 5:27
  • You can answer your own question and mark your own answer as the one that solved the issue. As for the mcrypt: that's weird, I have a setup in which some passwords are SSHA, some are SHA and some use just crypt, I only have to point pam_ldap and nss_ldap to LDAP server and "it just works" with 4-line config files... Dec 9 '10 at 19:42

On my case if it could help, I forgot to add the ldap module into /etc/nsswitch.conf

# /etc/nsswitch.conf
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap
gshadow:        files ldap

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.