Did you restart sshd after changing the nsswitch settings? Yang On Tue, 28 Sep 2004 17:19:37 -0400, Harry Hoffman <hhoffman@xxxxxxxxxxxxxxxx> wrote: > Hi All, > > I've done this before under Redhat but am having the damndest time with FC2. > > My LDAP server is a FC1 box with OpenLDAP/TLS (stock standard from the > distro). > I believe I have everything setup properly. I can use "getent passwd" > from the client machine and see all of the passwd entries on the ldap > server. > > In addition I can properly bind (using ldapsearch) as the user I'm > attempting to ssh into the client as. > > When I try to ssh in I get the following log errors: > Sep 26 23:16:17 mason sshd[21438]: Illegal user user from > ::ffff:192.168.4.65 > Sep 26 23:16:20 mason sshd[21438]: Failed password for illegal user user > from ::ffff:192.168.4.65 port 33553 ssh2 > > Any help would be greatly appreciated > > Thanks, > Harry > > The typical user entry looks something like this: > > dn: uid=user,ou=People,dc=domain,dc=tld > uid: user > cn: User > sn: User > mail: user@domain > mailRoutingAddress: user@domain > mailHost: smtp.fqdn > objectClass: inetLocalMailRecipient > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: hostObject > userPassword:: XXX > shadowLastChange: 12523 > shadowMax: 99999 > shadowWarning: 7 > loginShell: /bin/bash > uidNumber: 500 > gidNumber: 500 > homeDirectory: /home/user > mailLocalAddress: user@xxxxxxx > host: ldap.client.fqdn > > The server certificate is a self created CA with the proper certs on > both server and client. > > The clients ldap.conf looks like: > uri ldaps://ldap.domain.tld/ > scope sub > timelimit 30 > bind_timelimit 30 > idle_timelimit 3600 > pam_login_attribute uid > pam_check_host_attr yes > nss_base_passwd ou=People,dc=domain,dc=tld?one > nss_base_shadow ou=People,dc=domain,dc=tld?one > nss_base_group ou=Group,dc=domain,dc=tld?one > ssl on > tls_checkpeer yes > tls_cacertfile /usr/share/ssl/certs/ip-solutions.crt > pam_password md5 > > /etc/pam.d/sshd looks like this: > #%PAM-1.0 > auth required /lib/security/pam_nologin.so > auth sufficient /lib/security/pam_ldap.so > auth required /lib/security/pam_unix_auth.so try_first_pass > account sufficient /lib/security/pam_ldap.so > account required /lib/security/pam_unix_acct.so > password required /lib/security/pam_cracklib.so > password sufficient /lib/security/pam_ldap.so > password required /lib/security/pam_pwdb.so use_first_pass > session required /lib/security/pam_unix_session.so > > /etc/nsswitch.conf looks like this: > passwd: ldap [NOTFOUND=return] files > shadow: ldap [NOTFOUND=return] files > group: ldap [NOTFOUND=return] files > > -- > fedora-list mailing list > fedora-list@xxxxxxxxxx > To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list >
