RHEL 3.8 LDAP Auth Failure
"Joshua M. Miller" <joshua-f6xmObXTzt04ywjSxp7K1wC/[email protected]> Fri, 04 May 2007 08:56:31 -0700
| Newsgroups | gmane.linux.redhat.release.taroon.general |
|---|---|
| Message-ID | <[email protected]> |
Good morning, I have a redhat 3.8 host that I am unable to authenticate to with an LDAp account after upgrading OpenLDAP (2.0.27 -> 2.3.34). All local accounts authenticate, but directory accounts fail. I am using the same configuration on ~100 hosts, including RHEL2.1/CentOS 2/3/4 hosts and I have 2 RHEL 3.8 hosts which do not work. Configs are pushed via cfengine to ensure correctness and homogeneity. I think it may be a problem with pam not falling through from pam_unix to pam_ldap but the config is the same on all hosts. #cat /etc/pam.d/system-auth auth required /lib/security/$ISA/pam_env.so debug auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok debug auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass debug auth required /lib/security/$ISA/pam_deny.so debug account sufficient /lib/security/$ISA/pam_unix.so debug account sufficient /lib/security/$ISA/pam_ldap.so debug password required /lib/security/$ISA/pam_cracklib.so retry=3 type= debug password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow debug password sufficient /lib/security/$ISA/pam_ldap.so use_authtok debug password required /lib/security/$ISA/pam_deny.so debug session required /lib/security/$ISA/pam_limits.so debug session required /lib/security/$ISA/pam_unix.so debug session optional /lib/security/$ISA/pam_ldap.so debug Has anybody experienced this issue? I've attached logs to this email. TIA, -- Joshua M. Miller - RHCE,VCP -- Taroon-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/taroon-list
rhel3.txt
(text/plain, 5.4 KB)
Notes:
* Other hosts have no problems authenticating to this LDAP directory using the same configuration.
* Upgraded LDAP directory from 2.0.27 -> 2.3.34 yesterday, this seems to directly related, although other hosts have had no issues.
* ~100 Linux hosts authenticating to this LDAP directory and the configuration is pushed out via cfengine to ensure that all of the configuration files are the same.
* Attempted to restart nscd, sshd to no avail.
* Verified that sshd is using PAM (/etc/ssh/sshd_config):
PAMAuthenticationViaKbdInt yes
* getent passwd, getent group returns all configured directory entries.
* ldapsearch returns all configured directory entries.
* Attempted using SSL/TLS and without SSL/TLS, same result.
* Log message (SANITIZED):
/var/log/messages:
May 4 06:46:35 <sshd_server_host> sshd(pam_unix)[329]: check pass; user unknown
May 4 06:46:35 <sshd_server_host> sshd(pam_unix)[329]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=<ldap_client_host>.example.org
/var/log/secure:
May 4 06:51:55 <sshd_server_host> sshd[647]: debug1: Forked child 673.
May 4 06:51:55 <sshd_server_host> sshd[673]: Connection from 192.168.11.155 port 50714
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: Client protocol version 2.0; client software version OpenSSH_3.6.1p2
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: match: OpenSSH_3.6.1p2 pat OpenSSH*
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: Enabling compatibility mode for protocol 2.0
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: Local version string SSH-2.0-OpenSSH_3.6.1p2
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: Starting up PAM with username "uid"
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: PAM setting rhost to "<ldap_client_host>.example.org"
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: temporarily_use_uid: <uid>/100 (e=0/0)
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: trying public key file /home/uid/.ssh/authorized_keys
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: restore_uid: 0/0
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: temporarily_use_uid: <uid>/100 (e=0/0)
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: trying public key file /home/uid/.ssh/authorized_keys2
May 4 06:51:55 <sshd_server_host> sshd[673]: debug1: restore_uid: 0/0
May 4 06:51:59 <sshd_server_host> sshd[673]: debug1: PAM password authentication failed for uid: Authentication failure
May 4 06:51:59 <sshd_server_host> sshd[673]: Failed password for uid from 192.168.11.155 port 50714 ssh2
May 4 06:52:00 <sshd_server_host> sshd[673]: debug1: Calling cleanup 0x8063ca0(0x0)
/var/log/ldap/ldap.log:
May 4 06:51:48 <ldap_server> slapd[31849]: conn=8 fd=15 ACCEPT from IP=192.168.11.182:40008 (IP=0.0.0.0:389)
May 4 06:51:48 <ldap_server> slapd[31849]: conn=8 op=0 BIND dn="" method=128
May 4 06:51:48 <ldap_server> slapd[31849]: conn=8 op=0 RESULT tag=97 err=0 text=
May 4 06:51:48 <ldap_server> slapd[31849]: conn=8 op=1 SRCH base="dc=example,dc=org" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=<uid>))"
May 4 06:51:48 <ldap_server> slapd[31849]: conn=8 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
May 4 06:51:48 <ldap_server> slapd[31849]: conn=8 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 fd=20 ACCEPT from IP=192.168.11.182:40009 (IP=0.0.0.0:389)
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 op=0 BIND dn="" method=128
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 op=0 RESULT tag=97 err=0 text=
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 op=1 SRCH base="dc=example,dc=org" scope=2 deref=0 filter="(&(objectClass=posixGroup))"
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 op=1 SEARCH RESULT tag=101 err=0 nentries=20 text=
May 4 06:51:50 <ldap_server> slapd[31849]: conn=9 fd=20 closed (connection lost)
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 fd=20 ACCEPT from IP=192.168.11.182:40010 (IP=0.0.0.0:389)
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=0 BIND dn="" method=128
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=0 RESULT tag=97 err=0 text=
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=1 SRCH base="dc=example,dc=org" scope=2 deref=0 filter="(uid=uid)"
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=2 SRCH base="dc=example,dc=org" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=uid)(uniqueMember=cn=joshua miller,ou=people,dc=example,dc=org)))"
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=2 SRCH attr=cn userPassword memberUid uniqueMember gidNumber
May 4 06:51:54 <ldap_server> slapd[31849]: conn=10 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text=
May 4 06:51:56 <ldap_server> slapd[31849]: conn=10 op=3 SRCH base="dc=example,dc=org" scope=2 deref=0 filter="(&(objectClass=shadowAccount)(uid=uid))"
May 4 06:51:56 <ldap_server> slapd[31849]: conn=10 op=3 SRCH attr=uid userPassword shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire
May 4 06:51:56 <ldap_server> slapd[31849]: conn=10 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 4 06:52:00 <ldap_server> slapd[31849]: conn=10 fd=20 closed (connection lost)