[CentOS] LDAP / PAM -- Invalid Credentials Error

Wed Sep 19 22:19:07 UTC 2007
Von Landfried <von.landfried at eyestreet.com>

Hello,

I am having a small issue with LDAP, and I hope someone here might be  
able to provide a few tips.

I am unable to authenticate as user 'testuser' on server 'storage'  
and the following errors appear in /var/log/messages on server 'storage'

	Sep 19 16:56:17 storage sshd(pam_unix)[3124]: check pass; user unknown
	Sep 19 16:56:17 storage sshd(pam_unix)[3124]: authentication  
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=test-kja1
	Sep 19 16:56:17 storage sshd[3124]: pam_ldap: error trying to bind  
as user "uid=testuser,ou=People,dc=example,dc=local" (Invalid  
credentials)

I am also unable to issue this command:

	# passwd testuser
	passwd: Unknown user name 'testuser'.

but this command works fine:

	# finger testuser
	Login: testuser                            Name: Test User
	Directory: /home/testuser                  Shell: /bin/bash
	Never logged in.
	No mail.
	No Plan.

The server 'storage' is the LDAP host server, and there are about 9  
other servers configured to use 'storage' to authenticate users. All  
9 of them allow 'testuser' to login and also for him to change his  
password.

Issuing this command:

# ldapsearch -x -b 'uid=testuser,ou=People,dc=example,dc=local'  
'(objectclass=*)'


# extended LDIF
#
# LDAPv3
# base <uid=testuser,ou=People,dc=example,dc=local> with scope sub
# filter: (objectclass=*)
# requesting: ALL
#

# testuser, People, example.local
dn: uid=testuser,ou=People,dc=example,dc=local
uid: testuser
cn: Sean Cook
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 547
gidNumber: 500
homeDirectory: /home/testuser

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1


I think the issue might be with PAM, because comparing all files I  
can think of doesnt point me to any differences except /etc/pam.d/ 
system-auth

The LDAP server 'storage' has WINBIND turned on, as follows:

auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        sufficient    /lib/security/$ISA/pam_winbind.so  
use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid <  
100 quiet
account     [default=bad success=ok user_unknown=ignore] /lib/ 
security/$ISA/pam_ldap.so
account     [default=bad success=ok user_unknown=ignore] /lib/ 
security/$ISA/pam_winbind.so
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok  
use_authtok md5 shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    sufficient    /lib/security/$ISA/pam_winbind.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so


And the server 'phoenix' (which allows 'testuser' to login fine) does  
not;

# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid <  
100 quiet
account     [default=bad success=ok user_unknown=ignore] /lib/ 
security/$ISA/pam_ldap.so
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok  
use_authtok md5 shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so


I tried disabling WINBIND but the issue still occurs even after  
restarting ldap and sshd.

Please help!!


-- 
Von Landfried | System Administrator
Eye Street Software Corporation
1-888-252-2085 x 3052
von.landfried at eyestreet.com