Hi Everyone.
I am doing some LDAP testing. I have setup a 389 Directory Server on CentOS 5 and using the default schema I have populated it with a couple of users. I then did the configuration on the client that I thought was needed to make it authenticate.
To test this I expected to be able to use id <uidNumber> of a user I had defined. But I get id: 1001: No such user id: 5001: No such user
I then thought perhaps it was an LDAP permissions problem so I tried binding to the LDAP server using a user I know has full rights using these entries in /etc/openldap/ldap.conf there was no change.
BINDDN cn=admin,dc=scms,dc=waikato,dc=ac,dc=nz BINDPW LDAPt3st
I can query these users from a desktop that I want to use the LDAP server as an authentication source.
Using
* ldapsearch -x -H ldap://distilled.scms.waikato.ac.nz -b dc=scms,dc=waikato,dc=ac,dc=nz uid=LDilks* # extended LDIF # # LDAPv3 # base <dc=scms,dc=waikato,dc=ac,dc=nz> with scope subtree # filter: uid=LDilks # requesting: ALL #
# LDilks, People, scms.waikato.ac.nz dn: uid=LDilks,ou=People, dc=scms, dc=waikato, dc=ac, dc=nz givenName: LDAP-Clint sn: Dilks telephoneNumber: 4546 loginShell: /bin/bash gidNumber: 1001 uidNumber: 1001 mail: clintd@scms.waikato.ac.nz objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: LDilks gecos: A Test LDAP account cn: LDAP-Clint Dilks homeDirectory: /home/LDAP-clint
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
*[root@distilled2 ~]# ldapsearch -x -H ldap://distilled.scms.waikato.ac.nz -b dc=scms,dc=waikato,dc=ac,dc=nz uid=BBuilder* # extended LDIF # # LDAPv3 # base <dc=scms,dc=waikato,dc=ac,dc=nz> with scope subtree # filter: uid=BBuilder # requesting: ALL #
# BBuilder, scms.waikato.ac.nz dn: uid=BBuilder,dc=scms, dc=waikato, dc=ac, dc=nz givenName: Bob sn: Builder loginShell: /bin/bash uidNumber: 5001 gidNumber: 5001 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: BBuilder gecos: Got to love Cartoons cn: Bob Builder homeDirectory: /home/bob
# search result search: 2 result: 0 Success
# numResponses: 2 # numEntries: 1
The three files config files I am aware of are
cat /etc/openldap/ldap.conf # # LDAP Defaults #
# See ldap.conf(5) for details # This file should be world readable but not world writable.
#BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://distilled.scms.waikato.ac.nz BASE dc=scms.dc=waikato,dc=ac,dc=nz #BINDDN cn=admin,dc=scms,dc=waikato,dc=ac,dc=nz #BINDPW LDAPt3st TLS_CACERTDIR /etc/openldap/cacerts
cat /etc/nsswitch.conf | grep -v '^#' | grep -v '^$' passwd: files ldap shadow: files ldap group: files ldap hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: files ldap publickey: nisplus automount: files ldap aliases: files nisplus
cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so
account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so
session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so
Can anyone give me any pointers as to where I am going wrong ?? And can anyone confirm or deny that by default I should be able to bind anonymously and get the required authentication information ?
Thank you for any help you can offer.