[CentOS] ldap host attribute is ignored

Mon May 11 18:23:50 UTC 2015

Ok, i deactivated md5 in authconfig. And the problem persists.
But i do not see the relation to my problem. The authentication works
like charm. It is only the ldap's host attribute which is ignored.

With kind regards, ulrich

On 05/11/2015 07:48 PM, Conley, Matthew M CTR GXM wrote:
> I am still not understanding why your using MD5? Is it because everyone in InfoSec declared that everyone finally went from md5 to sha512 or what?
> 
> 
> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of Ulrich Hiller
> Sent: Monday, May 11, 2015 1:40 PM
> To: CentOS mailing list
> Subject: Re: [CentOS] ldap host attribute is ignored
> 
> one more thing: firewalld service and selinux are deactivated.
> 
> 
> On 05/11/2015 07:06 PM, Ulrich Hiller wrote:
>> Hmmm...., i have made now a complete new install but the problem
>> persists: ldap authentication works, but the host attribute is ignored.
>>
>> I have installed CentOS7 64bit with KDE.
>> I did not do any 'yum update' or install of extra packages so far.
>>
>> these pam and ldap packages are installed:
>> openldap-devel-2.4.39-6.el7.x86_64
>> openssh-ldap-6.6.1p1-11.el7.x86_64
>> openldap-2.4.39-6.el7.x86_64
>> python-ldap-2.4.15-2.el7.x86_64
>> compat-openldap-2.3.43-5.el7.x86_64
>> openldap-clients-2.4.39-6.el7.x86_64
>> fprintd-pam-0.5.0-4.0.el7_0.x86_64
>> gnome-keyring-pam-3.8.2-10.el7.x86_64
>> pam-1.1.8-12.el7.x86_64
>>
>>
>> I ran authconfig-tui and set "use ldap", "use md5 password", "use 
>> shadow password", "use ldap authentication", "use tls", 
>> "server=ldap://myldapserver.com", "basedn=o=XXX"
>>
>> my /etc/openldap/ldap.conf:
>> BASE o=XXX
>> URI ldap://myldapserver.com/
>> TLS_CACERTDIR /etc/ssl/certs
>> SASL_NOCANON    on
>>
>> My /etc/sssd/sssd.conf:
>> [domain/default]
>> ldap_uri = ldap://myldapserver.com/
>> ldap_search_base = ou=YYY,o=XXX
>> ldap_schema = rfc2307bis
>> id_provider = ldap
>> ldap_user_uuid = entryuuid
>> ldap_group_uuid = entryuuid
>> ldap_id_use_start_tls = True
>> enumerate = False
>> cache_credentials = False
>> ldap_tls_cacertdir = /etc/openldap/cacerts/ chpass_provider = ldap 
>> auth_provider = ldap ldap_tls_reqcert = never ldap_user_search_base = 
>> ou=YYY,o=XXX access_provider = ldap ldap_access_order = host 
>> ldap_user_authorized_host = host autofs_provider = ldap
>>
>> [sssd]
>> services = nss, pam, autofs
>> config_file_version = 2
>> domains = default
>>
>> [nss]
>>
>> [pam]
>>
>> [sudo]
>>
>> [autofs]
>>
>> [ssh]
>>
>>
>>
>> My /etc/pam.d/system-auth
>> #%PAM-1.0
>> # This file is auto-generated.
>> # User changes will be destroyed the next time authconfig is run.
>> auth        required      pam_env.so
>> auth        sufficient    pam_unix.so nullok try_first_pass
>> auth        requisite     pam_succeed_if.so uid >= 200 quiet_success
>> auth        sufficient    pam_sss.so use_first_pass
>> auth        required      pam_deny.so
>>
>> account     required      pam_unix.so broken_shadow
>> account     sufficient    pam_succeed_if.so uid < 2000 quiet
>> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
>> account     required      pam_permit.so
>>
>> password    requisite     pam_pwquality.so try_first_pass
>> local_users_only retry=3 authtok_type=
>> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
>> use_authtok
>> password    sufficient    pam_sss.so use_authtok
>> password    required      pam_deny.so
>>
>> session     optional      pam_keyinit.so revoke
>> session     required      pam_limits.so
>> -session     optional      pam_systemd.so
>> session     [success=1 default=ignore] pam_succeed_if.so service in
>> crond quiet use_uid
>> session     required      pam_unix.so
>> session     optional      pam_sss.so
>>
>> My /etc/pam.d/password-auth:
>> #%PAM-1.0
>> # This file is auto-generated.
>> # User changes will be destroyed the next time authconfig is run.
>> auth        required      pam_env.so
>> auth        sufficient    pam_unix.so nullok try_first_pass
>> auth        requisite     pam_succeed_if.so uid >= 200 quiet_success
>> auth        sufficient    pam_sss.so use_first_pass
>> auth        required      pam_deny.so
>>
>> account     required      pam_unix.so broken_shadow
>> account     sufficient    pam_succeed_if.so uid < 2000 quiet
>> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
>> account     required      pam_permit.so
>>
>> password    requisite     pam_pwquality.so try_first_pass
>> local_users_only retry=3 authtok_type=
>> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
>> use_authtok
>> password    sufficient    pam_sss.so use_authtok
>> password    required      pam_deny.so
>>
>> session     optional      pam_keyinit.so revoke
>> session     required      pam_limits.so
>> -session     optional      pam_systemd.so
>> session     [success=1 default=ignore] pam_succeed_if.so service in
>> crond quiet use_uid
>> session     required      pam_unix.so
>> session     optional      pam_sss.so
>>
>>
>> My /etc/nsswitch.conf:
>> passwd:     files sss
>> shadow:     files sss
>> group:      files sss
>> hosts:      files dns
>> bootparams: nisplus [NOTFOUND=return] files
>> ethers:     files
>> netmasks:   files
>> networks:   files
>> protocols:  files
>> rpc:        files
>> services:   files sss
>> netgroup:   files sss
>> publickey:  nisplus
>> automount:  files sss
>> aliases:    files nisplus
>>
>> nscd is NOT installed
>>
>> apart from the uid boundary interval in /etc/pam-d i left the files in 
>> this directory as they were created by authconfig. I did not copy 
>> anything from other systems.
>>
>> ldapsearch can read the user information. The user can again login, no 
>> matter of the contence of the ldap's host attribute.
>>
>> I feel a bit embarrassed now. but ... does anybody have another idea?
>>
>> With kind regards, ulrich
>>
>>
>>
>>
>>
>>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
> 
> 
> 
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
> 