Re: RHEL 3.8 LDAP Auth Failure

I have done some more testing and analyzed some log output to find some 
interesting results.

I set logging to 'any' and re-enabled the ACL on the userPassword 
attribute to see what I could find out. I attempted a connection with 
the redhat host, and then with the centos host, saving the logs to a 
separate file for each one.

After analyzing the resulting (verbose) logs, I found out something very 
interesting – the redhat host does not make any subsequent bind attempts 
after the initial bind, while the centos host makes 3 binds.

Basic overview of centos login (from ldap server logs):

1. bind anonymously to directory to obtain account information (enable 
to mount home directory, etc...)
2. bind anonymously to directory to attempt to get userPassword attr - 
this fails on ACL restraint
3. bind as DN of user to directory to get userPassword attr - this 
succeeds (if pw is correct)

Redhat host only performs the first bind (according to ldap server 
logs), which leads me to believe that PAM is the culprit here and not 
passing the login request to pam_ldap, but leaving it at pam_unix... 
Very odd.


Thanks,
--
Joshua M. Miller - RHCE,VCP


Joshua M. Miller wrote:
> Hi John,
> 
> The issue here is that a RHEL 3.8 host is having trouble authenticating 
> and a CentOS 3.8 host with an identical configuration is authenticating 
> perfectly against the same LDAP server.  Both hosts have identical:
> 
>   /etc/ldap.conf
>   /etc/openldap/ldap.conf
>   /etc/pam.d/system-auth
>   /etc/nsswitch.conf
> 
> It doesn't make any sense at all...  I'm comparing packages right now to 
> make sure that they have all of the same packages installed.
> 
> (I do have SSL/TLS enabled on the LDAP server as a requirement, I just 
> disabled it momentarily to make sure that wasn't the problem.)
> 
> Thanks, your help is much appreciated!
> -- 
> Joshua M. Miller - RHCE,VCP
> 
> 
> John Haxby wrote:
>> Joshua M. Miller wrote:
>>> Turns out the problem is with the ACL on the ldap server.  For some 
>>> reason RHEL 3.8 attempts to bind to the LDAP server to retrieve the 
>>> password anonymously unlike the other Linux distros that we use 
>>> configured the exact same way.
>>>
>>> Anyone know why this might be?
>>>
>> I don't know why, but I know that you can configure an authenticated 
>> bind in /etc/ldap.conf (I think that's the file that pam_ldap uses, I 
>> don't have it installed here to check, sorry).
>>
>> I don't think pam_ldap retrieves the password though, I think it 
>> searches for the user according to the filter specified in 
>> /etc/ldap.conf and then does an authenticated bind with the resulting 
>> DN.  It then does an authenticated bind with the user's DN and if 
>> successful, you're in.  (This is all from reading the code from 
>> memory, sorry.)   pam_ldap also retrieves other information from the 
>> user's entry in the LDAP server and uses that to determine, for 
>> example, whether the account is locked in the account phase.
>>
>> Anyway, what's failing is the anonymous search and you can configure 
>> that in /etc/ldap.conf.  You might also want to turn on TLS because at 
>> some stage chances are its sending the user's password in cleartext 
>> across the net.  TLS might be enabled by default or it might be up to 
>> /etc/openldap/ldap.conf to enable it.
>>
>> If that's not enough I can be more definitve when I'm on my normal 
>> work machine, sorry.
>>
>> jch
>>
>> -- 
>> Taroon-list mailing list
>> [email protected]
>> https://www.redhat.com/mailman/listinfo/taroon-list
>>
> 
> -- 
> Taroon-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/taroon-list
> 

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list