Go Premium for a chance to win a PS4. Enter to Win


Using Openldap to authenticate Linux / NT users

Posted on 2001-06-20
Medium Priority
Last Modified: 2013-12-06
Ok, here's the deal.  I have a network consisting of 13 Linux boxes (RH and Debian), and 4 NT Servers.  I run Sendmail for e-mail, BIND for DNS, CVS, and NT / SAMBA for filesharing.  I would like to setup an LDAP server to handle (primarily) authentication to all network resources, and (secondary) as a company-wide address book, central location for  DNS Configs, and anything else that I could use it for.  I've been working on this for about 2 weeks now, and have been able to get teh OS installed (no prob), and I've been able to get slapd running.  The problem that I am having is that when I try to use RPM's (since I'm using RH, I usually try it their way first), I get a bunch of dependancy errors (liblber.so.1 and libldap.so.1), and the only source that I can find is openldap-2.0.11, which will require the new version of openssl and openssh across the board (a move I'm not ready to make yet).  At any rate, the basic question (for the 200 points) is how do I configure openldap and 1 RH Linux 7.0 client so that users can authenticate to both boxes off of the LDAP database without having an account (in /etc/passwd) on either box.  I may not have asked the question properly, and would be more than glad to offer any details that I could for some assistance on this.  Below are the packages (RPMS) that I have to work with currently, and the source that I have to work with currently.  I would prefer to either use all source, or all RPM's (except on the Debian boxes) if possible, and can download additional packages / source if necessary:

openldap-1.2.11-15.rpm (I had to install this first to satisfy a dependancy)
openldap-2.07.rpm (this is the version that I can use with my current openssl / openssh config)


openldap-2.0.11.tgz (requires updated openssl / openssh)
pam_ldap.tgz (the version available currently from padl.com)
nss_ldap.tgz (the version available currently from padl.com)

I also have one of the Linux boxes setup as a domain controller in the NT domain, if that helps.
Question by:nunderwood
  • 2

Accepted Solution

grepster earned 600 total points
ID: 6232244

We have done just that here at work and what you will need to do is install :
Kerberos5 protocol

get that authenticating etc etc.  There are plents of modules out there for other great things like to import

Author Comment

ID: 6232355
I still seem to be missing something.  I have the following installed via rpm (I believe this is all that I need):


The test that I'm using is the following:

Created a user in the ldap tree:

(user doesn't exist in /etc/passwd)

Edited /etc/nsswitch.conf:
     passwd:     ldap files
     shadow:     ldap files
     group:      ldap files

Tried to login via SecureCRT using test & password - failed
Tried to login at terminal using test & password - failed

I'm monitoring /var/log/messages, /var/log/ldap, and /var/log/secure while I'm making these attempts.  The only log that generates an entry is /var/log/secure.  The contents are below:

Jun 27 12:58:06 ldap sshd[32118]: PAM pam_set_item: NULL pam handle passed
Jun 27 12:58:16 ldap sshd[32118]: PAM pam_set_item: NULL pam handle passed
Jun 27 12:58:16 ldap sshd[32118]: Failed password for illegal user test from port 3317
Jun 27 12:58:25 ldap sshd[32118]: Unknown message during authentication: type 4
Jun 27 12:58:25 ldap sshd[32118]: Failed bad-auth-msg-4 for illegal user test from port 3317

Author Comment

ID: 6235021
First off, I apologize for not figuring my mistake out sooner, once I updated the Cyrus-SASL and Kerberos packages,( and edited the /etc/nsswitch.conf on the client machine) I was able to authenticate from a remote machine, to the LDAP server.  With this in mind, I'm going to close this question, but I'll probably be opening another one soon, once I start building the LDAP directory to better suit my organizations (questions will include, how to say uid=x can log onto this server, but not that server, like on the mail server [users do not have a shell, or home directory on the mail server]).  In case anyone else is trying to figure this out, maybe the information below will lead you in the right direction:

RPMs Installed:
  (I installed all of these, with the exception of openldap-servers, on the machines that would participate in LDAP)

I edited the /etc/ldap.conf, and added the BASE and HOST of my LDAP server
I edited the /etc/openldap/ldap.conf to reflect the same
I edited /etc/nsswitch.conf, and added ldap to passwd, shadow, and group
I edited the files in /etc/pam.d, and added LDAP support for the services that I will be using LDAP for
Since it's Red Hat, and becasue I was curious, I ran authconfig just to make sure that everything showed up

Hope this helps, and grepster, thanks for pointing out the two that I missed.  I hope that I can call on you if I get in another pinch trying to get the directory setup.

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With User Account Control (UAC) enabled in Windows 7, one needs to open an elevated Command Prompt in order to run scripts under administrative privileges. Although the elevated Command Prompt accomplishes the task, the question How to run as script…
In the first part of this tutorial we will cover the prerequisites for installing SQL Server vNext on Linux.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Suggested Courses
Course of the Month11 days, 21 hours left to enroll

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question