Frozen Fido : RU.LINUX : nss

ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Anton Gorlov                         2:5059/37      22 Mar 2005  21:25:58
 To : Aleksey Barabanov
 Subject : nss_ldap
 --------------------------------------------------------------------------------

 
 21 марта 2005 года (а было тогда 23:36:36)
 Aleksey Barabanov в своем письме к Anton Gorlov писал:
 
 >> Какая-то непонятная проблема с nss_ldap или его окружении. Под рутом
 >> делаю id vasya -всё наместе. Делаю тоже самое под простым
 >> пользователем id vasya
 AB> Кстати, если nscd запустить от рута, то все заработает ;)
 Hеа. Проблема оказалась в /etc/ldap.conf
 Там в одном месте в конце оказался пробел и ещё надо было заккоментировать
 ==== заливка "Windows Clipboard" ====
 # The credentials to bind with.
 # Optional: default is no credential.
 bindpw 123456
 ==== конец "Windows Clipboard" ====
 Теперь работает всё, окромя ssh.
 Здесь уже "ничё не понимаю"
 
 При попытке залогинится получаю по зубам:
 ==== заливка "Windows Clipboard" ====
 Mar 22 07:42:44 vmstalker pam_tcb[3036]: sshd: Authentication failed for
 tstuser from (uid=0)
 Mar 22 07:42:46 vmstalker pam_tcb[3036]: sshd: Authentication failed for
 tstuser from (uid=0)
 Mar 22 07:42:46 vmstalker sshd[3037]: Failed password for tstuser from
 127.0.0.1 port 1142 ssh2
 ==== конец "Windows Clipboard" ====
 
 При этом при входе пользователя, живущего не в ldap:
 
 ==== заливка "Windows Clipboard" ====
 Mar 22 07:44:12 vmstalker pam_tcb[3057]: sshd: Authentication failed for
 stalker from (uid=0)
 Mar 22 07:44:14 vmstalker pam_tcb[3057]: sshd: Authentication passed for
 stalker from (uid=0)
 Mar 22 07:44:14 vmstalker sshd[3058]: Accepted password for stalker from
 192.168.198.2 port 2346 ssh2
 Mar 22 07:44:14 vmstalker pam_limits[3064]: checking if stalker is in group
 root
 ==== конец "Windows Clipboard" ====
 
 Вот содержание /etc/pam.d/sshd
 
 ==== заливка "Windows Clipboard" ====
 auth     sufficient     pam_ldap.so
 auth     required       pam_userpass.so
 auth     required       pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
 nodelay blank_nolog use_first_pass
 auth     required       pam_nologin.so
 account  include        system-auth
 password include        system-auth
 session  include        system-auth
 ==== конец "Windows Clipboard" ====
 
 Вот что пишется в лог slapd (при входе пользователя из ldap)
 ==== заливка "Windows Clipboard" ====
 Mar 22 07:42:43 vmstalker slapd[1877]: conn=114 fd=37 ACCEPT from
 IP=127.0.0.1:1143 (IP=127.0.0.1:389)
 Mar 22 07:42:43 vmstalker slapd[1942]: conn=114 op=0 BIND
 dn="cn=admin,dc=samba" method=128
 Mar 22 07:42:43 vmstalker slapd[1942]: conn=114 op=0 BIND
 dn="cn=admin,dc=samba" mech=SIMPLE ssf=0
 Mar 22 07:42:43 vmstalker slapd[1942]: conn=114 op=0 RESULT tag=97 err=0 text=
 Mar 22 07:42:43 vmstalker slapd[2184]: conn=114 op=1 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=posixAccount)(uid=tstuser))"
 Mar 22 07:42:43 vmstalker slapd[2184]: conn=114 op=1 SRCH attr=uid userPassword
 uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
 Mar 22 07:42:43 vmstalker slapd[2184]: conn=114 op=1 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:43 vmstalker slapd[2184]: conn=114 op=1 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:43 vmstalker slapd[1877]: conn=114 fd=37 closed
 Mar 22 07:42:44 vmstalker slapd[1877]: conn=115 fd=37 ACCEPT from
 IP=127.0.0.1:1144 (IP=127.0.0.1:389)
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=0 BIND
 dn="cn=admin,dc=samba" method=128
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=0 BIND
 dn="cn=admin,dc=samba" mech=SIMPLE ssf=0
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=0 RESULT tag=97 err=0 text=
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=115 op=1 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=posixAccount)(uid=tstuser))"
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=115 op=1 SRCH attr=uid userPassword
 uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=115 op=1 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=115 op=1 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=2 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=shadowAccount)(uid=tstuser))"
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=2 SRCH attr=uid userPassword
 shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire
 shadowFlag
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=2 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=115 op=2 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:44 vmstalker slapd[1877]: conn=115 fd=37 closed
 Mar 22 07:42:44 vmstalker slapd[1877]: conn=116 fd=37 ACCEPT from
 IP=127.0.0.1:1145 (IP=127.0.0.1:389)
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=0 BIND
 dn="cn=admin,dc=samba" method=128
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=0 BIND
 dn="cn=admin,dc=samba" mech=SIMPLE ssf=0
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=0 RESULT tag=97 err=0 text=
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=116 op=1 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=posixAccount)(uid=tstuser))"
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=116 op=1 SRCH attr=uid userPassword
 uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=116 op=1 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:44 vmstalker slapd[1942]: conn=116 op=1 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=2 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=shadowAccount)(uid=tstuser))"
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=2 SRCH attr=uid userPassword
 shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire
 shadowFlag
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=2 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:44 vmstalker slapd[2184]: conn=116 op=2 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:44 vmstalker slapd[1877]: conn=116 fd=37 closed
 Mar 22 07:42:46 vmstalker slapd[1877]: conn=117 fd=37 ACCEPT from
 IP=127.0.0.1:1146 (IP=127.0.0.1:389)
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=0 BIND
 dn="cn=admin,dc=samba" method=128
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=0 BIND
 dn="cn=admin,dc=samba" mech=SIMPLE ssf=0
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=0 RESULT tag=97 err=0 text=
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=117 op=1 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=posixAccount)(uid=tstuser))"
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=117 op=1 SRCH attr=uid userPassword
 uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=117 op=1 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=117 op=1 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=2 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=shadowAccount)(uid=tstuser))"
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=2 SRCH attr=uid userPassword
 shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire
 shadowFlag
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=2 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=117 op=2 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:46 vmstalker slapd[1877]: conn=117 fd=37 closed
 Mar 22 07:42:46 vmstalker slapd[1877]: conn=118 fd=37 ACCEPT from
 IP=127.0.0.1:1147 (IP=127.0.0.1:389)
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=0 BIND
 dn="cn=admin,dc=samba" method=128
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=0 BIND
 dn="cn=admin,dc=samba" mech=SIMPLE ssf=0
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=0 RESULT tag=97 err=0 text=
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=118 op=1 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=posixAccount)(uid=tstuser))"
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=118 op=1 SRCH attr=uid userPassword
 uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=118 op=1 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:46 vmstalker slapd[1942]: conn=118 op=1 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=2 SRCH
 base="ou=Users,dc=samba" scope=1
 filter="(&(objectClass=shadowAccount)(uid=tstuser))"
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=2 SRCH attr=uid userPassword
 shadowLastChange shadowMax shadowMin shadowWarning shadowInactive shadowExpire
 shadowFlag
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=2 ENTRY
 dn="uid=tstuser,ou=Users,dc=samba"
 Mar 22 07:42:46 vmstalker slapd[2184]: conn=118 op=2 SEARCH RESULT tag=101
 err=0 nentries=1 text=
 Mar 22 07:42:46 vmstalker slapd[1877]: conn=118 fd=37 closed
 ==== конец "Windows Clipboard" ====
 При этом у людей с моим же конфигом взлетело без проблем.... Подохреваю что
 где-то опять проблел лишний. Вопрос -в каком месте и какого конфига искать?
 
 Hа всякий случай ещё кое-что:
 ==== заливка "system-auth" ====
 #%PAM-1.0
 #auth     required      pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
 #account  required      pam_tcb.so shadow fork
 #password required      pam_passwdqc.so min=disabled,24,12,8,7 max=40
 passphrase=3 match=4 similar=deny random=42 enforce=users retry=3
 #password required      pam_tcb.so use_authtok shadow fork prefix=$2a$ count=8
 write_to=tcb
 #session  required      pam_tcb.so
 #session  required      pam_limits.so
 auth sufficient /lib/security/pam_tcb.so shadow fork prefix=$2a$  count=8
 nullok
 auth required /lib/security/pam_ldap.so use_first_pass
 account sufficient /lib/security/pam_tcb.so shadow fork
 account required /lib/security/pam_ldap.so
 password required /lib/security/pam_passwdqc.so min=disabled,24,12,8,7 max=40
 passphrase=3 match=4 similar=deny random=42 enforce=users retry=3
 password sufficient /lib/security/pam_ldap.so use_authok
 password required /lib/security/pam_tcb.so use_authtok shadow fork prefix=$2a$
 count=8 write_to=tcb
 session required /lib/security/pam_limits.so
 account    sufficient   /lib/security/pam_ldap.so
 session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0077
 session sufficient /lib/security/pam_ldap.so
 ==== конец "system-auth" ====
 ==== заливка "system-auth-use_first_pass" ====
 #%PAM-1.0
 #auth     required      pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
 use_first_pass
 #password required      pam_tcb.so use_authtok shadow fork prefix=$2a$ count=8
 write_to=tcb
 auth sufficient /lib/security/pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
 use_first_pass
 auth required /lib/security/pam_ldap.so use_first_pass
 password sufficient /lib/security/pam_ldap.so use_authok
 password required /lib/security/pam_tcb.so use_authtok shadow fork prefix=$2a$
 count=8 write_to=tcb
 ==== конец "system-auth-use_first_pass" ====
                      С уважением. Anton aka Stalker
 
   np: Иван Человеков
 [#*TEAM:*#] [#_Злой СисОп_#] [*Heavy Metal-лyчший дpyг, этo знaют вce вoкpyг!*]
 --- GoldED+/W32 1.1.5-041013
  * Origin: Cogito, ergo sum... (2:5059/37)

Вернуться к списку тем, сортированных по: возрастание даты уменьшение даты тема автор

Тема:	Автор:	Дата:
nss_ldap	Anton Gorlov	21 Mar 2005 21:56:20
nss_ldap	Anton Gorlov	21 Mar 2005 22:19:00
Re: nss_ldap	Aleksey Barabanov	22 Mar 2005 00:36:03
nss_ldap	Anton Gorlov	22 Mar 2005 21:25:58
Re: nss_ldap	Aleksey Barabanov	22 Mar 2005 23:30:34
nss_ldap	Anton Gorlov	23 Mar 2005 21:00:28

Архивное /ru.linux/114214240571c.html, оценка 2 из 5, голосов 10