I just had those users in there because I didn't want to attempt to hit ldap for known local users.<br><br>Peter<br><br><div class="gmail_quote">On Wed, Dec 16, 2009 at 12:58 PM, Craig White <span dir="ltr"><<a href="mailto:craigwhite@azapple.com">craigwhite@azapple.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><div></div><div class="h5">On Wed, 2009-12-16 at 13:44 -0700, Craig White wrote:<br>
> On Wed, 2009-12-16 at 12:39 -0800, Peter Serwe wrote:<br>
> > I think not as well. The tactest user has been blown back out. I can<br>
> > re-add it from ldif again.<br>
> ><br>
> > [root@ldap home]# getent passwd | grep example<br>
> > [root@ldap home]#<br>
> ><br>
> > [root@ldap home]# cat /etc/nsswitch.conf | grep -v \#<br>
> ><br>
> ><br>
> > passwd: files ldap<br>
> > shadow: files ldap<br>
> > group: files ldap<br>
> ><br>
> > hosts: files dns<br>
> ><br>
> ><br>
> > bootparams: nisplus [NOTFOUND=return] files<br>
> ><br>
> > ethers: files<br>
> > netmasks: files<br>
> > networks: files<br>
> > protocols: files<br>
> > rpc: files<br>
> > services: files<br>
> ><br>
> > netgroup: nisplus<br>
> ><br>
> > publickey: nisplus<br>
> ><br>
> > automount: files nisplus<br>
> > aliases: files nisplus<br>
> ><br>
> > [root@ldap home]# cat /etc/pam.d/system-auth<br>
> > #%PAM-1.0<br>
> > # This file is auto-generated.<br>
> > # User changes will be destroyed the next time authconfig is run.<br>
> > auth required pam_env.so<br>
> > auth sufficient pam_unix.so nullok try_first_pass<br>
> > auth requisite pam_succeed_if.so uid >= 500 quiet<br>
> > auth sufficient pam_ldap.so use_first_pass<br>
> > auth required pam_deny.so<br>
> ><br>
> > account required pam_unix.so broken_shadow<br>
> > account sufficient pam_localuser.so<br>
> > account sufficient pam_succeed_if.so uid < 500 quiet<br>
> > account [default=bad success=ok user_unknown=ignore] pam_ldap.so<br>
> > account required pam_permit.so<br>
> ><br>
> > password requisite pam_cracklib.so try_first_pass retry=3<br>
> > password sufficient pam_unix.so md5 shadow nullok try_first_pass<br>
> > use_authtok<br>
> > password sufficient pam_ldap.so use_authtok<br>
> > password required pam_deny.so<br>
> ><br>
> > session optional pam_keyinit.so revoke<br>
> > session required pam_limits.so<br>
> > session optional pam_mkhomedir.so<br>
> > session [success=1 default=ignore] pam_succeed_if.so service in<br>
> > crond quiet use_uid<br>
> > session required pam_unix.so<br>
> > session optional pam_ldap.so<br>
> ><br>
> > [root@ldap home]# cat /etc/ldap.conf | grep -v \#<br>
> ><br>
> ><br>
> > BASE dc=tncionline, dc=net<br>
> > URI ldap://MailScanner warning: numerical links are often malicious:<br>
> > 127.0.0.1<br>
> > port 389<br>
> ><br>
> > SIZELIMIT 12<br>
> > TIMELIMIT 15<br>
> > DEREF never<br>
> > timelimit 600<br>
> > bind_timelimit 600<br>
> > bind_policy soft<br>
> > idle_timelimit 3600<br>
> ><br>
> > nss_initgroups_ignoreusers<br>
> > pserwe,dgates,root,ldap,named,avahi,haldaemon,dbus<br>
> > base dc=tncionline, dc=net<br>
> > pam_password md5<br>
> ----<br>
> here's a big problem... /etc/ldap.conf<br>
><br>
> you need to add...(assuming this is where you have People/Groups)<br>
><br>
> nss_base_passwd ou=People,tncionline,dc=net?one<br>
> nss_base_shadow ou=People,tncionline,dc=net?one<br>
> nss_base_group ou=Groups,tncionline,dc=net?one<br>
><br>
> take the space out of base...<br>
> base dc=tncionline,dc=net<br>
><br>
> I'd also add (until you can deal)...<br>
> ssl no<br>
</div></div>----<br>
oh...<br>
<div class="im"><br>
nss_initgroups_ignoreusers<br>
pserwe,dgates,root,ldap,named,avahi,haldaemon,dbus<br>
<br>
</div>you can remove pserwe,dgates from the list unless you have daemon services running as those users prior to LDAP start (highly unlikely)<br>
<br>
and if the above doesn't work, it is because your slapd.conf ACL's are blocking anonymous binds at the indicated dn's<br>
<br>
So you might want to either simplify your ACL's, permit anonymous binds to the 'people/groups' or let us see what you've got for ACL's<br>
<br>
these are some rules that I've found good to have in /etc/openldap/slapd.conf - YMMV<br>
<br>
allow bind_anon_dn<br>
<br>
access to attrs=userPassword,sambaNTPassword,sambaLMPassword<br>
by self write<br>
by anonymous auth<br>
by * none<br>
<br>
access to dn.regex="^uid=([^,]+)ou=People,dc=azapple,dc=com$$"<br>
by self read<br>
by anonymous auth<br>
by * none<br>
<br>
# a bottom catchall rule...<br>
access to *<br>
by anonymous read<br>
by * read<br>
<br>
access to dn.base="cn=Subschema" by * read<br>
<div><div></div><div class="h5"><br>
Craig<br>
<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
_______________________________________________<br>
CentOS mailing list<br>
<a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br>
<a href="http://lists.centos.org/mailman/listinfo/centos" target="_blank">http://lists.centos.org/mailman/listinfo/centos</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Peter Serwe<br><a href="http://truthlightway.blogspot.com/">http://truthlightway.blogspot.com/</a><br>