I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't find the ldap user into the directory. When I try to login with an ldap user it says bad login, and when I try to login with a local users it asks me a password, and then the LDAP password.
Server
1) I first installed ldap-utils libldap-2.4-2 libldap-2.4-2-dbg slapd slapd-dbg
2) In the file /etc/ldap/ldap.conf :
BASE dc=example,dc=com
URI ldap://192.168.1.254/
3)
dpkg-reconfigure slapd
I check that the informations about the domain are right : correct.
4)
ldapsearch -x
It fits with what I chose before.
5) I create the .ldif files for the directory and the users
structure.ldif :
dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
u: users
description: users
dn: ou=computers,dc=example,dc=com
objectClass: organizationalUnit
ou: computers
description: computers
dn: ou=sale,ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: sale
description: sale
dn: ou=direction,ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: direction
description: direction
dn: cn=sale,ou=sale,ou=users,dc=example,dc=com
objectClass: posixGroup
gidNumber: 501
cn: sale
description: Sale group
dn: cn=direction,ou=direction,ou=users,dc=example,dc=com
objectClass: posixGroup
gidNumber: 502
cn: direction
description: Direction group
dn: cn=pauldupont,cn=direction,ou=direction,ou=users,dc=newsoft,dc=ch
cn=pauldupont,cn=direction,ou=direction,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
uid: pauldupont
userPassword: pauldupont
cn: pauldupont
uidnumber: 1050
gidnumber: 501
homeDirectory: /home/profils/pauldupont
sn: pauldupont
adduseringroup.ldif :
dc: cn=sale,ou=sale,ou=users,dc=example,dc=com
changetype: modify
add: memberuid
memberuid: uid=pauldupont,cn=direction,ou=direction,ou=users,dc=example,dc=com
6) I send the files into the directory :
ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f file.ldif
6)
ldapsearch -x
The informations are there.
Client
1) I installed ldap-utils libldap-2.4-2 libldap-2.4-2-dbg slapd slapd-dbg libnss-ldap libpam-ldap libpam-modules libpam-cracklib nscd
2) libnss-ldap configuration : server ip : 192.168.1.254, dc=example,dc=com
3) libpam-ldap configuration : no that the LDAP admin is like local user, no that the LDAP server asks for informations before making queries
4) dpkg-reconfigure libnss-ldap
The informations are correct.
5) In the file /etc/ldap/ldap.conf
BASE dc=example,dc=com
URI ldap://192.168.1.254/
6) In the file /etc/nsswitch.conf
passwd: compat ldap
group: compat ldap
shadow: compat ldap
7) In the file /etc/libnss-ldap.conf
base dc=example,dc=com
uri ldap://192.168.1.254/
ldap_version 3
rootbinddn cn=admin,dc=example,dc=com
8) In the file /etc/libnss-ldap.secret
ldap password
9) In the file /etc/pam_ldap.conf :
base dc=example,dc=com
uri ldap://192.168.1.254/
rootbinddn cn=admin,dc=example,dc=com
port 389
scope sub
bind_timelimit 30
idle_timelimit 3600
pam_filter objectClass=posixAccount
pam_login_attribute uid
10) In files /etc/pam.d/common-auth & common-account & common-session I added at the bottom :
auth sufficient pam_ldap.so
11) In the file /etc/pam.d/common-password I added at the bottom :
password sufficient pam_ldap.so use_first_pass
12)
getent passwd && getent group
Only shows local users and groups.
13) The client seems to contact the server :
ldapsearch -x -H "ldap://192.168.1.254" -b "dc=example,dc=com" dn
gives me back the dn entries
14) getent passwd pauldupont
Gives me back nothing and when I check in /var/log/auth.log :
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: failed to bind to LDAP server ldap:///192.168.1.254/: Invalid credentials
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: reconnecting to LDAP server...
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: failed to bind to LDAP server ldap:///192.168.1.254/: Invalid credentials
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: reconnecting to LDAP server...
May 12 10:43:37 CLI1-DIR-DEB nscd: nss_ldap: failed to bind to LDAP server ldap:///192.168.1.254/: Invalid credentials
May 12 10:43:37 CLI1-DIR-DEB nscd: nss_ldap: could not search LDAP server - Server is unavailable
It seems the credentials are wrong. I checked all the configuration files above and I can't find any mistakes.
Does anybody know where the problem is ?
Thank you for your help.
I'm using Debian Jessie 8.0 AMD64 for the client and the server
uname -a : Linux SRV1-DEB 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt9-3~deb8u1 (2015-04-24) x86_64 GNU/Linux
OpenLDAP 2.4
EDIT : Once I added the password in the /etc/ldap.secret file and I do a getent passwd, I get the ldap users but I still can't connect.
Once I tried to connect I have this in the log file :
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_mail(login:session): user unknown
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_loginuid(login:session): error_ log for user-name'pauldupont' does not exist
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_unix(login:session): session opened for user pauldupont by LOGIN(uid=0)
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_systemd(login:session): Failed to get user data
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_systemd(login:session): Failed to get user data
May 18 09:09:53 CLI1-DIR-DEB login[904]: User not known to the underlying authentication module
