<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)">  <title>Access.conf issue</title> <style>  </style>  </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> Is your user a part of the groupname or groupname2 group? <o:p></o:p> <o:p> </o:p> And, is “UsePAM yes” and set in your sshd_config?<o:p></o:p> <o:p> </o:p> Although, I am not sure that the pam_member_attribute uniquemember is going to work in this situation. Pam is looking to evaluate that the user is a member of the group that you specify for “pam_groupdn” in ldap.conf.<o:p></o:p> <o:p> </o:p> Based on what you are saying, you are simply using pam_access to control ssh access to the server. But instead of the pam_access line being in system_auth, I have it in /etc/pam.d/sshd, which it looks like yours is also based on the error messages.<o:p></o:p> <o:p> </o:p> What exactly are you trying to accomplish?<o:p></o:p> <o:p> </o:p> Robert<o:p></o:p> <o:p> </o:p> <div> Robert M. Tidwell | System Engineer/Architect/Administrator<o:p></o:p> Acxiom Distributed Systems Central Arkansas<o:p></o:p> 00-1-501-342-4127 office | 00-1-501-908-2790 cell | 00-1-501-342-3932 fax 301East Dave Ward Drive | Conway, AR 72032 | USA | <a href="http://www.acxiom.com">www.acxiom.com</a><o:p></o:p> </div> <img border=0 width=305 height=68 id="Picture_x0020_1" src="cid:image001.gif@01CA6840.716CC5B0" alt="Acxiom_logo-18200993150"><o:p></o:p> <div> <div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'> From: fedora-directory-users-bounces@redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Prashanth Sundaram Sent: Wednesday, November 18, 2009 11:06 AM To: fedora-directory-users@redhat.com Subject: [389-users] Access.conf issue<o:p></o:p> </div> </div> <o:p> </o:p> All, I have setup the ldapserver with PAM PassThrough and need help in figuring out the access.conf without use of netgroups. Can I simply use the groups with access.conf? I am only able to ssh as root, but not with any ldap account. I was able to ssh before making changes for the pam_access. Here are the files I edited. /etc/ldap.conf pam_member_attribute uniquemember (since 389-ds uses uniquemember for group membership) uri ldap://ldap.domain.com:389/ tls_checkpeer yes ssl start_tls tls_cacertdir /etc/openldap/cacerts pam_password md5 tls_cacertfile /etc/pki/tls/certs/ca-cert.crt /etc/security/access.conf + : root : ALL + : @groupname : ALL + : @groupname2 : ALL - : ALL : ALL authconfig --enableldap --enableldapauth --disablenis --enablecache --ldapserver=ldap.domain.com --ldapbasedn=dc=ldapdomain,dc=com --enableldaptls --disablekrb5 --krb5kdc=AD.ADdomain.com --krb5adminserver=AD.ADdomain.com --krb5realm=ADDOMAIN.COM --enablekrb5kdcdns --enablekrb5realmdns --enablepamaccess --enablemkhomedir --enablelocauthorize —updateall /etc/pam.d/system-auth : account required pam_access.so accessfile=/etc/security/access.conf : Here’s the error message I got. I see that krb5 is succeeding my password but pam_access is blocking me. pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.12.0.95 user=psundaram Nov 18 11:01:44 wgldap01 sshd[8995]: pam_krb5[8995]: authentication succeeds for 'psundaram' (<a href="psundaram@ADDOMAIN.COM">psundaram@ADDOMAIN.COM</a>) Nov 18 11:01:45 wgldap01 sshd[8995]: pam_access(sshd:account): access denied for user `psundaram' from `10.12.0.95' Nov 18 11:01:45 wgldap01 sshd[8995]: pam_access(sshd:account): access denied for user `psundaram' from `10.12.0.95' Nov 18 11:01:45 wgldap01 sshd[8996]: fatal: Access denied for user psundaram by PAM account configuration Thanks, Prashanth <o:p></o:p> </div> <pre>*************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. **************************************************************************** </pre></body> </html>