LDAP login issue

[Mirage74]

I'm trying to connect my CoreOS machine to my LDAP server. 

I get an answer when i use the command 'id'. However,  I get the following error when i trying to login with my user.

Dec 06 16:35:04 localhost systemd[1]: Started OpenSSH per-connection server daemon (x.x.x.x:60759).
Dec 06 16:35:04 localhost sshd[1637]: PAM unable to dlopen(/lib64/security/pam_ldap.so): /lib64/security/pam_ldap.so: cannot open shared object file: No such file or directory

Here is my sssd configuration:

cat /etc/sssd/sssd.conf

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam, ssh
domains = LDAP
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
[nss]
[domain/LDAP]
debug_level = 5
id_provider = ldap
auth_provider = ldap
ldap_schema = ipa
ldap_search_base = dc=mydomain,dc=co,dc=il
ldap_uri = ldap://ldap21v.mydomain.co.il
case_sensitive = false

Here is my PAM configuration:

cat /etc/pam.d/sshd 

auth      sufficient  pam_unix.so

auth      sufficient  pam_ldap.so minimum_uid=1000 use_first_pass

auth      required    pam_deny.so

account   required    pam_unix.so

account   sufficient  pam_ldap.so minimum_uid=1000

account   required    pam_permit.so

session   required    pam_unix.so

session   optional    pam_ldap.so minimum_uid=1000

password  sufficient  pam_unix.so nullok md5 shadow use_authtok

password  sufficient  pam_ldap.so minimum_uid=1000 try_first_pass

password  required    pam_deny.so

Please advise

[Brandon Philips]

Hello Mirage-

I don't think you need to edit the /etc/pam.d to add pam_ldap. Where did you find those instructions?

Thank You,

Brandon

--
You received this message because you are subscribed to the Google Groups "CoreOS User" group.
To unsubscribe from this group and stop receiving emails from it, send an email to coreos-user...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Omri W]

Hi Brandon,

I don't exactly remember. I didn't find good instruction how to setup LDAP in CoreOS, so these instructions are probably related to other Linux distribution. I guess that nothing really read that configuration file, so it's like i don't have any configuration. Isn't it?

I desperately need help with that. I stuck with that too much time :(

Since i get an answer for 'id myuser', i guess that i have some kind of connection with my LDAP server, but still not able to login due to the error i've add to my provisos message.

What is the right configuration? (the default one. I don't have any unique requirement).

The following instructions doesn't works for me:

https://coreos.com/os/docs/latest/sssd.html 

[Mirage74]

Brandon,

I've found the following conversation: 

https://groups.google.com/forum/#!searchin/coreos-user/ldap|sort:relevance/coreos-user/vwh6VcMeOs8/7YLAiwrJCQAJ 

It seems that my issue related to PAM, and as far as i understood from that conversation, PAM isn't supported in CoreOS. Isn't it? 

Please advise.

[Michael Marineau]

We do support PAM these days, but we do now ship pam_ldap as sssd
handles that functionality and the PAM configuration we ship is ready
to use sssd as-is. So to enable LDAP you only should need to configure
and start sssd as documented at
https://coreos.com/os/docs/latest/sssd.html

Perhaps those instructions didn't work because of the bad pam_ldap
config you added? Be sure to remove that before continuing with sssd.

[Matthew Garrett]

Yes, it sounds like the configuration is working correctly since id is
working. Just delete the reference to pam_ldap.

[Mirage74]

It'a still not working.

journalctl -f

Dec 11 09:56:17 localhost systemd[1]: Started OpenSSH per-connection server daemon (x.x.x.x:64704).
Dec 11 09:56:32 localhost sshd[1180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x  user=myuser
Dec 11 09:56:34 localhost sshd[1178]: PAM: Authentication failure for myuser from x.x.x.x

Here are my current PAM configuration after removing pam_ldap: 

cat /etc/pam.d/sshd
auth      sufficient  pam_unix.

so
auth      required    pam_deny.so


account   required    pam_unix.so
account   required    pam_permit.so

session   required    pam_unix.so

password  sufficient  pam_unix.so nullok md5 shadow use_authtok
password  required    pam_deny.so

Please advise

[Michael Marineau]

Delete your custom PAM configuration in /etc. The default PAM config under /usr enables sssd.

[Mirage74]

Hi Michael,

I've deleted the configuration file in etc, as you suggested, and i still not able to login. Here are the logs:

Dec 12 09:33:07 localhost sshd[3298]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x user=myuser
Dec 12 09:33:07 localhost sshd[3298]: pam_sss(sshd:auth): received for user myuser: 7 (Authentication failure)
Dec 12 09:33:11 localhost sshd[3298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x.x.x.x  user=myuser
Dec 12 09:33:14 localhost sshd[3296]: PAM: Authentication failure for myuser from x.x.x.x

Please advise.

[Mirage74]

Still need help with this. Anyone?

[Brandon Philips]

Are there logs from your LDAP server you can get access to?

[Mirage74]

Yes, i can access to the server with a local user.

I posted to log from sssd two messages above. I can post any other logs if needed.

[Brandon Philips]

I mean logs from the LDAP server to confirm you are getting the LDAP query you expect out of sssd.

[Michael Marineau]

I just remembered an issue that isn't reflected in our short documentation. Out of principal sssd refuses to authenticate over insecure connections while it will let NSS lookups. So be sure to use an ldaps:// URL I stead of plain ldap. We should add that note to the doc and change the example to include typical certificate configuration options.

To unsubscribe from this group and stop receiving emails from it, send an email to coreos-user+unsubscribe@googlegroups.com.

[Ivan]

Could you post sssd_LDAP logs for "sudo su - myuser" from CoreOS instance?

[Tarikur Rahaman]

My sssd configuration is working perfectly but unable to get sudo access.

calico-02 ~ # sudo su - tarikur.rahaman

Update Strategy: No Reboots

tarikur.rahaman@calico-02 ~ $ sudo -s

Password:

tarikur.rahaman is not in the sudoers file.  This incident will be reported.