17

pam_ldap and nsswitch have no caching mechanisms, but nscd or sssd may be present on your system that implement cache. To invalidate / flush nscd groups cache use: sudo nscd --invalidate=group To invalidate / flush sssd groups cache use: sudo sss_cache -G


16

This excerpt was taken from amazing book written by Linux advocate Evi Nemeth( unfortunately recently lost in the sea http://www.theregister.co.uk/2013/07/05/evi_nemeth_unix_dead/ ) in her one of the first and best linux admin book: Linux® Administration Handbook. For this case it was in the second edition of the book, I am not sure if this was duplicated ...


8

To know if my server and clients settings are correct I use this: ldapsearch -x -b "uid=username,ou=people,dc=example,dc=com" the answer will be something like this on success: # extended LDIF # # LDAPv3 # base <uid=username,ou=people,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # username, people, example.com ...


4

As far as I can tell, pam_ldap uses openssl for its TLS functionality, or uses similar functionality that is built in to pam_ldap itself. openssl needs the name of the ca file to be the value of the hash of the subject followed by ".0" or if there is already another ca cert with that hash, increment the 0 to a 1 or a 2 or whatever the next unused number ...


3

It's most likely that you're running into an NFS permissions issue. In a standard setup, NFS client machines are not trusted for root access on the NFS server; access by uid=0 is mapped to an unprivileged user (nfsnobody or similar). In order to create the home directory, pam_mkdir (which runs as root) would need to have permissions to the directory in which ...


3

You're restricting access in /etc/security/access.conf, which while it controls who can access the server has no impact on what users are visible to the server. This is generally what you want: even if user alice is unable to log into the server, if she owns files on a shared filesystem I want to see: $ ls -l ~alice -rw-rw-r--. 1 alice alice 0 Aug 1 09:...


2

The nss-pam-ldapd package allows LDAP directory servers to be used as a primary source of name service information. When I would run 'getent passwd', I would only see the users from the /etc/passwd file. When I started the /etc/init.d/nslcd service and then issued the 'getent passwd' command, I then saw all LDAP users and system users and the shells were ...


2

If it is an option you could extend your ldap schema as per the following from http://www.secure-computing.net/wiki/index.php/OpenLDAP/Authentication To get this host verification, we're going to add a custom schema to allow for the host attribute on a posixAccount objectClass. You can download the new schema here. To use this new schema, unzip and save the ...


2

I ran into this as well -- my particular problem was that while some third-party applications (Okta in our case) looks for pwdReset, the pam_ldap plugin does not. After taking a look at the source code for pam_ldap as hosted here: https://github.com/wfhu/pam_ldap -- I've come to the conclusion that pam_ldap completely ignores pwdReset which is part of ...


2

You must make sure that pwdMustChange is set to TRUE on the user's effective password policy. See the slapo-ppolicy manpage for more information.


2

This is default behavior, RHEL restricts the users using PAM, nss tries to resolve all available user/group entries in the given ldap search base. There might be situations where the system has an nfs mount which includes files owned by users who do not have access to the machine, you can still resolve the users if all are visible to the OS (the access is ...


2

There are default schemas you can use for this purpose, but if really necessary, you can configure the LDAP module to tell it exactly where to find possible users. How this is done depends on the PAM module used (e.g. pam-ldap, pam-ldapd or sssd). The minimal number of fields you need are username, numerical uid, home directory, shell and password.


1

It would appear that the cache maintained by the Name Service Caching Daemon has grown stale/was not updated to reflect the new LDAP settings. sudo /etc/init.d/nscd restart should restart the service and update the cache.


1

The migrate_passwd.pl only parses the password file you give it as an argument, but this only works for old style (i.e. non-shadow password) systems. Systems with shadow password files only store an 'x' character in that file, the real password is stored in /etc/shadow. Looking at the source of that script it should do this. But, alas, you need to be root ...


1

On ubuntu 18 I had a similar problem, seems like R-Studio community version only respects "auth" not "session" Workaround was to introduce /etc/pam.d/rstudio as follows: auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_exec.so /etc/pam.d/mkhome.sh @include common-auth @include common-account @include common-password @...


1

A lot of stuff will assume you are using NIS (bad for several reasons) which is what compat really means (that you can use NIS syntax like +@netgroup etc). I assume you are not actually using YP on these boxes but creating the relevant files manually (or with puppet or whatever). In that case I don't see a major drawback, just a little extra config and you'...


1

nsswitch is correct, don't change it! it DOESN'T have any filtering capability, so if it's outputting the ldap users, its set correctly. The problem is the ldap filter in /etc/ldap.conf. On solaris is filtering the users and only allowing the ones matching the filter, on the RHEL you aren't probably using any filter and so allowing all users. check the ...


1

in the screenshot you post the domain controller is 'ldap://dc1.test.com'. In the plugin (very scarce) documentation, you clearly see that there is no 'ldap', so just plain 'dc1.test.com': screenshot ldap plugin wordpress So that would explain the 'can't contact ldap server' syslog errors.


1

Rename the users. Numeric usernames are bad to start with (because utilities like getent passwd will then have no idea if you're asking about a UID or a username) and having UIDs start as low as 1 is bad for the reason you just found out. This is exactly why centralized stores like FreeIPA start their UID range in the millions. At the very last, all users (...


1

No schema change is required for Authentication - posixAccount, posixGroup etc work fine for me. I haven't implemented sudo in ODSEE, but did research the topic a while ago. There's loads of documentation online - see the sudo LDAP documentation or Solaris community forums for the current schema extensions.


1

I suspect it's your LDAP server. olcSizeLimit: size[.{soft|hard|unchecked}]= [...] Specify the maximum number of entries to return from a search operation. The default size limit is 500. Use unlimited to specify no limits. The second format allows a fine grain setting of the size limits. Extra args can be added in the same value or as additional ...


1

You need to increase the logging level in your OpenLDAP instance. I believe the one you're looking for is 256. http://www.openldap.org/doc/admin24/slapdconf2.html#cn=config For OLC, create a file with the following contents: dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: stats Then: ldapmodify -H ldapi:// -Y EXTERNAL -f <file>....


1

Krisko. First you have to install the packages for an sssd integration: yum install \ realmd \ sssd \ sssd-krb5 \ sssd-krb5-common \ sssd-common \ sssd-common-pac \ sssd-ad \ sssd-proxy \ sssd-tools \ python-sssdconfig \ samba \ samba-common \ authconfig \ authconfig-gtk Then create the machine account in an AD container your user ([Domain UID]) has full ...


1

It looks like you need to configure /etc/nslcd.conf with your binddn and bindpw. See http://arthurdejong.org/nss-pam-ldapd/nslcd.conf.5 Hope this helps! -Byron


1

Just to name one, what about posixAccount objectClass? In OpenLDAP is included in the nis schema file: olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction o f an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNu mber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) ...


1

nscd isn't designed to cache passwords. Check out sssd or pam_ccreds


1

I changed one of the options in the authconfig command. I changed --updateall to --update It doesn't affect my /etc/nsswitch.conf anymore.


1

I've been struggling all day with a very similar error to the above. In my case, I was seeing messages like this: Nov 26 15:19:25 digitalocean sshd[2373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.196-30-62.static.virginmediabusiness.co.uk Nov 26 15:19:25 digitalocean sshd[2373]: pam_ldap: error trying to ...


1

A couple of things: 1.) If you do a getent passwd $username for a user that only exists in ldap, does it pull back the correct entry? 2.) What does your /etc/pam.d/system-auth file look like. 3.) Does it return the results properly for ldapsearch -D $BINDDN -W -H ldap://$HOST 'uid=$RANDOM_USER' Lastly, It looks like the binddn you have in /usr/local/etc/...


Only top voted, non community-wiki answers of a minimum length are eligible