mariadb ldap auth

[mj]

Hi,

I have installed mariadb and configured pam authentication, and
configured a mysql pam module like this:

> /etc/pam.d/mysql
> auth required pam_winbind.so
> account required pam_winbind.so

which basically gives my samba winbind users access to mysql with their
windows credentials:

> root@mysqlserver:~# mysql -udomain_username -p
> Enter password: <windows_domain_password>
> Welcome to the MariaDB monitor. Commands end with ; or \g.
> Your MariaDB connection id is 6
> Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1
>
> Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
>
> Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
>
> MariaDB [(none)]>

So I was happy.

But this seems to work only from the localhost mariadb is running on.
Trying this from a remote mysql client gives:

> user@e7470 ~ $ mysql -udomain_user -p -h mysqlserver.full.address
> Enter password:
> ERROR 2059 (HY000): Authentication plugin 'dialog' cannot be loaded: /usr/lib/mysql/plugin/dialog.so: cannot open shared object file: No such file or directory

and searching for /usr/lib/mysql/plugin/dialog.so gives no results:

> user@e7470 ~ $ dpkg --search /usr/lib/mysql/plugin/dialog.so
> dpkg-query: no path found matching pattern /usr/lib/mysql/plugin/dialog.so
> user@e7470 ~ $

Anyone here with a good suggestion how to achieve this from a remote
mysql client?

MJ

[Selim T. Erdoğan]

On Thu, Sep 06, 2018 at 12:20:22PM +0200, mj wrote:
>
> But this seems to work only from the localhost mariadb is running on. Trying
> this from a remote mysql client gives:
>
> > user@e7470 ~ $ mysql -udomain_user -p -h mysqlserver.full.address
> > Enter password: ERROR 2059 (HY000): Authentication plugin 'dialog'
> > cannot be loaded: /usr/lib/mysql/plugin/dialog.so: cannot open shared
> > object file: No such file or directory
>
> and searching for /usr/lib/mysql/plugin/dialog.so gives no results:
>
> > user@e7470 ~ $ dpkg --search /usr/lib/mysql/plugin/dialog.so
> > dpkg-query: no path found matching pattern /usr/lib/mysql/plugin/dialog.so
> > user@e7470 ~ $
>
> Anyone here with a good suggestion how to achieve this from a remote mysql
> client?

I tried apt-file (on Debian 9.5 Stretch):

$ apt-file search dialog.so
...
libmariadb2: /usr/lib/x86_64-linux-gnu/mariadb/plugin/dialog.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/dialog.so
...

(No mysql in that list.)

If you don't have those two packages installed on your remote client,
try to install them. (You probably only need the client one, but I
don't really know.)

If they're already installed, you should try to figure out why your
system is trying to find the mysql version of the plugin, but as a
temporary solution, you can try to create a symlink from
/usr/lib/mysql/plugin/dialog.so to one of those files and see if it works.

[mj]

Hi Selim,

Wow thanks for teaching me about apt-file, didn't know that one!

For me, on linux mint, output looks different:

> user@e7470 ~ $ sudo apt-file search dialog.so
...> percona-server-5.6-dbg: /usr/lib/debug/usr/lib/mysql/plugin/dialog.so
> percona-server-server-5.6: /usr/lib/mysql/plugin/dialog.so
> percona-xtradb-cluster-5.6-dbg: /usr/lib/debug/usr/lib/mysql/plugin/dialog.so
> percona-xtradb-cluster-server-5.6: /usr/lib/mysql/plugin/dialog.so
...
> user@e7470 ~ $ cat /etc/debian_version
> stretch/sid

Seems linux mint doesn't have those mariadb client libs that you have.
Strange, since it's also stretch...?

> If you don't have those two packages installed on your remote client,
> try to install them. (You probably only need the client one, but I
> don't really know.)

Yeah I'll work on this a bit more.

> If they're already installed, you should try to figure out why your
> system is trying to find the mysql version of the plugin, but as a
> temporary solution, you can try to create a symlink from
> /usr/lib/mysql/plugin/dialog.so to one of those files and see if it works.

Yes, thanks for your suggestions, and for telling me about apt-file :-)

MJ