Re: RHEL 3.8 LDAP Auth Failure

Hi John,

The issue here is that a RHEL 3.8 host is having trouble authenticating 
and a CentOS 3.8 host with an identical configuration is authenticating 
perfectly against the same LDAP server.  Both hosts have identical:

   /etc/ldap.conf
   /etc/openldap/ldap.conf
   /etc/pam.d/system-auth
   /etc/nsswitch.conf

It doesn't make any sense at all...  I'm comparing packages right now to 
make sure that they have all of the same packages installed.

(I do have SSL/TLS enabled on the LDAP server as a requirement, I just 
disabled it momentarily to make sure that wasn't the problem.)

Thanks, your help is much appreciated!
--
Joshua M. Miller - RHCE,VCP


John Haxby wrote:
> Joshua M. Miller wrote:
>> Turns out the problem is with the ACL on the ldap server.  For some 
>> reason RHEL 3.8 attempts to bind to the LDAP server to retrieve the 
>> password anonymously unlike the other Linux distros that we use 
>> configured the exact same way.
>>
>> Anyone know why this might be?
>>
> I don't know why, but I know that you can configure an authenticated 
> bind in /etc/ldap.conf (I think that's the file that pam_ldap uses, I 
> don't have it installed here to check, sorry).
> 
> I don't think pam_ldap retrieves the password though, I think it 
> searches for the user according to the filter specified in 
> /etc/ldap.conf and then does an authenticated bind with the resulting 
> DN.  It then does an authenticated bind with the user's DN and if 
> successful, you're in.  (This is all from reading the code from memory, 
> sorry.)   pam_ldap also retrieves other information from the user's 
> entry in the LDAP server and uses that to determine, for example, 
> whether the account is locked in the account phase.
> 
> Anyway, what's failing is the anonymous search and you can configure 
> that in /etc/ldap.conf.  You might also want to turn on TLS because at 
> some stage chances are its sending the user's password in cleartext 
> across the net.  TLS might be enabled by default or it might be up to 
> /etc/openldap/ldap.conf to enable it.
> 
> If that's not enough I can be more definitve when I'm on my normal work 
> machine, sorry.
> 
> jch
> 
> -- 
> Taroon-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/taroon-list
> 

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list