Cannot ID LDAP User On LDAP Client

[revzalot]

I've setup an Ubuntu 10.10 LDAP Client to authenticate off my LDAP server. I've install the following:

sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils pam_ccreds


Here's my /etc/nsswitch.conf:
passwd: files ldap [NOTFOUND=return] db

group: files ldap [NOTFOUND=return] db

shadow: files ldap

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files
I can nss_updatedb ldap succssfully:
# nss_updatedb ldap
passwd... done.
group... done.

I can getent passwd, getent passwd shadow, getent group just fine and they all show all my ldap users.


However, I cannot do an id ldapuser

ex:
$ id tony
id: tony: No such user

Here's my auth.log:
Dec 1 21:08:17 webdev120 sshd[14765]: pam_unix(sshd:auth): check pass; user unknown
Here's my syslog:
sshd[14648]: Libgcrypt warning: missing initialization - please fix the application
Here's my /etc/pam.d/commoun-auth:

auth [success=4 default=ignore] pam_unix.so nullok_secure
auth [success=3 default=ignore] pam_ldap.so use_first_pass
auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 action=validate use_first_pass
auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
#auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
#auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_ccreds.so minimum_uid=1000 action=store
# end of pam-auth-update config
Here's my /etc/pam.d/common-account:
# here are the per-package modules (the "Primary" block)
account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
ID works just fine with my local users on my local machine so somehow it's not able to read the ldap users.


Any insights appreciated.

Here's my test on my ldap user 'tony'
root@webtest111:/etc/pam.d# id tony
id: tony: No such user
root@webtest111:/etc/pam.d# getent passwd tony
root@webtest111:/etc/pam.d# getent passwd |grep tony
tony:x:1005:10000:Tony Montana:/home/tony:/bin/bash
root@webtest111:/etc/pam.d# /etc/init.d/nscd stop
* Stopping Name Service Cache Daemon nscd [ OK ]
root@webtest111:/etc/pam.d# getent passwd |grep tony
tony:x:1005:10000:Tony Montana:/home/tony:/bin/bash
root@webtest111:/etc/pam.d# getent passwd tony
root@webtest111:/etc/pam.d# id tony
id: tony: No such user

SOLVED: I added ldapns.schema to enable host based authentication and the users before the schema upgrade caused this caching to stop. I added a new after the schema upgrade and all is well.

[TSJason]

Do you have nscd running? What does your /etc/ldap.conf (or /etc/ldap/ldap.conf) look like?

[revzalot]

Yes I have ncsd running and then disabled but still id does not work.

Here's my /etc/ldap.conf:

cat /etc/ldap.conf | grep -v ^# | grep -v ^$
base dc=example,dc=com
uri ldapi:///10.112.18.2
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
bind_policy soft
pam_check_host_attr yes
pam_password md5

[TSJason]

You might try defining nss_base_passwd, nss_base_shadow, and nss_base_group in your ldap.conf. And keep nscd running :-)

[revzalot]

Ok I turned ncsd back on but id still doesn't work.


cat /etc/ldap.conf | grep -v ^# | grep -v ^$
base dc=example,dc=com
uri ldap://10.112.18.2
ldap_version 3
bindpw secret
rootbinddn cn=admin,dc=example,dc=com
bind_policy soft
pam_check_host_attr yes
pam_password md5
nss_base_passwd ou=People,dc=example,dc=com
nss_base_shadow ou=People,dc=example,dc=com?one
nss_base_group ou=Groups,dc=example,dc=com?one
On another machine, tried this howto after purging the above above packages.

http://www.opinsys.fi/en/setting-up-openldap-on-ubuntu-10-04-alpha2

sudo apt-get install libnss-ldapd libpam-ldapd

Still the same outcome. I can ldapsearch, getent, etc. but id cannot show the ldap users.

[TSJason]

well comparing your setup to mine (I'm using 10.04), I also setup the pam session file as well. My config file looks like this:


[open_ldap]
nss_passwd=passwd: files ldap
nss_group=group: files ldap
nss_shadow=shadow: files ldap
nss_netgroup=netgroup: ldap files
nss_sudoers=sudoers: ldap files
pam_auth=auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_group.so use_first_pass
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
pam_account=account sufficient pam_unix.so
account sufficient pam_ldap.so
account required pam_deny.so
pam_password=password sufficient pam_unix.so nullok md5 shadow
password sufficient pam_ldap.so use_first_pass
password required pam_deny.so
pam_session=session required pam_limits.so
session required pam_mkhomedir.so skel=/etc/skel/
session required pam_unix.so
session optional pam_ldap.so

I apply it with:


auth-client-config -a -p open_ldap

[revzalot]

Tried it but didn't budge.


root@webtest111:/etc/auth-client-config/profile.d# auth-client-config -a -p open_ldap
root@webtest111:/etc/auth-client-config/profile.d# id tony
id: tony: No such user
root@webtest111:/etc/auth-client-config/profile.d# nss_updatedb ldap
passwd... done.
group... done.
root@webtest111:/etc/auth-client-config/profile.d# getent passwd | grep tony
tony:x:1005:10000:Tony Montana:/home/tony:/bin/bash
root@webtest111:/etc/auth-client-config/profile.d# id tony
id: tony: No such user
root@webtest111:/etc/auth-client-config/profile.d#

[revzalot]

NSCD daemon is the culprit. Here's the error when I do id tony:


nscd -d
Thu 02 Dec 2010 02:18:18 PM PST - 14248: handle_request: request received (Version = 2) from PID 14257
Thu 02 Dec 2010 02:18:18 PM PST - 14248: GETFDPW
Thu 02 Dec 2010 02:18:18 PM PST - 14248: provide access to FD 5, for passwd
Thu 02 Dec 2010 02:18:18 PM PST - 14248: handle_request: request received (Version = 2) from PID 14257
Thu 02 Dec 2010 02:18:18 PM PST - 14248: GETPWBYNAME (tony)
Thu 02 Dec 2010 02:18:18 PM PST - 14248: Haven't found "tony" in password cache!
Thu 02 Dec 2010 02:18:24 PM PST - 14248: Reloading "nslcd" in password cache!
Thu 02 Dec 2010 02:18:39 PM PST - 14248: remove GETPWBYNAME entry "tony"
Thu 02 Dec 2010 02:18:50 PM PST - 14248: handle_request: request received (Version = 2) from PID 14258

Here's my nscd.conf file:



cat /etc/nscd.conf | grep -v ^# | grep -v ^$
debug-level 0
paranoia no
enable-cache passwd yes
positive-time-to-live passwd 600
negative-time-to-live passwd 20
suggested-size passwd 211
check-files passwd yes
persistent passwd yes
shared passwd yes
max-db-size passwd 33554432
auto-propagate passwd yes
enable-cache group yes
positive-time-to-live group 3600
negative-time-to-live group 60
suggested-size group 211
check-files group yes
persistent group yes
shared group yes
max-db-size group 33554432
auto-propagate group yes
enable-cache hosts no
positive-time-to-live hosts 3600
negative-time-to-live hosts 20
suggested-size hosts 211
check-files hosts yes
persistent hosts yes
shared hosts yes
max-db-size hosts 33554432
enable-cache services yes
positive-time-to-live services 28800
negative-time-to-live services 20
suggested-size services 211
check-files services yes
persistent services yes
shared services yes
max-db-size services 33554432

[luvshines]

But when nscd was off, still id command didn't work, right ?

So that can't be a possible culprit :)

Since you have rootbinddn mentioned in /etc/ldap.conf file, did you also put in the root bind passwd in /etc/ldap.secret ?

[revzalot]

But when nscd was off, still id command didn't work, right ?

So that can't be a possible culprit :)

Since you have rootbinddn mentioned in /etc/ldap.conf file, did you also put in the root bind passwd in /etc/ldap.secret ?

Yes to all the above. After making a new user id worked on that ldap user. Somehow the schema install prevent id from working with my old users. :)