On Tue, 12 Apr 2011, Alain Péan wrote:
In fact, I solved the problem using the authconfig command, but I wonder if it is really correct, as I mixed kerberos and ldap. Here is the authconfig command for my test domain :
Using kerberos and ldap is a perfectly reasonable thing to want to do, but you need to be sure you're doing what you want.
# authconfig --enablekrb5 --krb5kdc=pc-2003-test.test-lpp.local,dc1-test.test-lpp.local --krb5adminserver=pc-2003-test.test-lpp.local --krb5realm=TEST-LPP.LOCAL --enablekrb5kdcdns --enablekrb5realmdns --enableldap --enableldapauth --ldapserver=pc-2003-test.test-lpp.local,dc1-test.test-lpp.local --ldapbasedn="dc=test-lpp,dc=local" --enablemkhomedir --update
I'd have thought you want kerberos authentication and ldap user information. --enableldapauth I suspect is wrong. You've switched your kerberos REALM from the original file you mailed.
My /etc/krb5.conf is then the following : ]# cat /etc/krb5.conf [logging] default = FILE:/var/log/krb5lib.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] ticket_lifetime = 24000 default_realm = TEST-LPP.LOCAL default_tk_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc dns_lookup_realm = true dns_lookup_kdc = true
[realms] TEST-LPP.LOCAL = { kdc = pc-2003-test.test-lpp.local kdc = dc1-test.test-lpp.local admin_server = pc-2003-test.test-lpp.local default_domain = TEST-LPP.LOCAL kpasswd_server = pc-2003-test.test-lpp.local kdc = * }
[domain_realm] .test-lpp.local = TEST-LPP.LOCAL test-lpp.local = TEST-LPP.LOCAL
[kdc] profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false }
That now looks plausible given what you mailed for the keytab (i.e. the realms match now).
But both kerberos and ldap appear in /etc/pam.d/system-auth-ac :
That's because you enabled ldap auth. You probably don't want that.
I tried to remove the lines with pam_ldap.so and adding in /etc/krb5.conf, as you suggested : [appdefaults] pam = { novalidate = true }
But it failed.
Assuming the keytab setup is the same is was before, you shouldn't need to bother with that. I think it should have been validate = false rather than novalidate = true, I'd misunderstood the manpage.
But if you leave that off, what fails now?
jh