Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

LDAP and ssh not working anymore since upgrade to FreeBSD 7.1

0 views
Skip to first unread message

O. Hartmann

unread,
Sep 4, 2008, 5:16:02 AM9/4/08
to freebsd-...@freebsd.org
I recently updated several boxes up to FreeBSD 7.1-PRE having had a
working OpenLDAP binding. After this update, I can't log in on those
boxes connected to an LDAP server via ssh!
The boxes also run lighttpd as a webserver with remote LDAP
authentication for several user spaces and this still works as expected.
I can log in locally on the boxes in question, even with LDAP backed
users, so login works fine, also doeing a 'su - USER' as root works
fine, but no sshd connects. Only local users (stored in /etc/passwd) can
login in via ssh.

The error message on console is like this: sshd[16434]: fatal:
login_get_lastlog: Cannot find account for uid 2001

It's funny, seems that sshd never made it to LDAP although I see traffic
on the LDAP server's log.

I append, for completeness, /etc/pam.d/sshd, /etc/ssh/sshd_conf

#
# $FreeBSD: src/etc/pam.d/sshd,v 1.16 2007/06/10 18:57:20 yar Exp $
#
# PAM configuration for the "sshd" service
#

# auth
auth sufficient pam_opie.so no_warn
no_fake_prompts
#auth requisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn
try_first_pass
#auth sufficient pam_ssh.so no_warn
try_first_pass
auth sufficient /usr/local/lib/pam_ldap.so no_warn
try_first_pass ignore_authinfo_unavail
auth required pam_unix.so no_warn
try_first_pass

# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
account sufficient /usr/local/lib/pam_ldap.so
account required pam_unix.so

# session
#session optional pam_ssh.so
session optional /usr/local/lib/pam_mkhomedir.so
skel=/usr/share/skel mode=0750
session required pam_permit.so

# password
#password sufficient pam_krb5.so no_warn
try_first_pass
password sufficient /usr/local/lib/pam_ldap.so no_warn
use_authtok
password required pam_unix.so no_warn
try_first_pass

sshd_config
0 new messages