On 05/05/2015 06:47 PM, Gordon Messmer wrote: > On 05/05/2015 03:02 AM, Ulrich Hiller wrote: >> /etc/openldap/ldap.conf contains the line: >> ------------------------------------------ >> pam_check_host_attr yes > > /etc/openldap/ldap.conf is the configuration file for openldap clients. > It is not used for system authentication or name service. > >> 'pam_check_host_attr yes' is in /etc/openldap/ldap.conf. /etc/ldap.conf >> is a softlink to that file. > > Those two files have completely different syntax and are used by > different software. Don't symlink them. i deleted the link now. /etc/ldap.conf was not present before. I gave openldap > >> /etc/sssd/sssd.conf: >> -------------------- > > If you're using sssd, then you're not using (or shouldn't be using) the > PADL nss module. In that case, /etc/ldap.conf shouldn't even be present. > >> [domain/default] >> access_provider = ldap >> ldap_access_filter = memberOf=ou=YYYY,o=XXXX >> ldap_access_order = host > > ldap_access_filter should be an LDAP filter, not an OU. However, it's > only used when ldap_access_order=filter. When using > ldap_access_order=host, it should not be present. > ldap_access_filter is now commented out. >> in /etc/nscd.conf: > > nscd is also not used when using sssd. > >> /etc/nsswitch.conf: >> ................... >> passwd: files sss ldap >> shadow: files sss ldap >> group: files sss ldap > > This is wrong. Don't use sss and ldap together. It's redundant. At > best it will cause performance problems. > > Get rid of the ldap module and see if the system starts working > correctly with just sssd. It's possible that right now sssd is > correctly filtering users, but the PADL ldap module is providing them. > This was a good hint (i should have got the idea myself). Now i set passwd: files ldap shadow: files ldap group: files ldap and got "pam_unix(sshd:auth): check pass; user unknown" the same when i set in sssd.conf services = pam So, does it mean only the NSS is providing the ldap user information, and sssd cannot read the pam information? So pam is not set up correctly? I am confused about what to do now. Do i have to configure anything else in /etc/pam.d apart from system-auth? With kind regards, ulrich