<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)"> <style>  </style>  </head> <body lang=PT link=blue vlink=purple> <div class=Section1> <o:p> </o:p> Hello,<o:p></o:p> <o:p> </o:p> I am currently using OpenLDAP for authentication and seems I’m having some troubles explaining PAM what it should be doing. I get this error when trying to login with an ldap user trough ssh:<o:p></o:p> <o:p> </o:p> Apr 8 16:38:16 rh01 sshd[11045]: debug1: userauth-request for user myuser service ssh-connection method password<o:p></o:p> Apr 8 16:38:16 rh01 sshd[11045]: debug1: attempt 1 failures 1<o:p></o:p> Apr 8 16:38:17 rh01 sshd[11044]: pam_unix(sshd:auth): check pass; user unknown<o:p></o:p> Apr 8 16:38:17 rh01 sshd[11044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=rh01.localdomain<o:p></o:p> Apr 8 16:38:17 rh01 sshd[11044]: pam_succeed_if(sshd:auth): error retrieving information about user myuser<o:p></o:p> Apr 8 16:38:19 rh01 sshd[11044]: debug1: PAM: password authentication failed for an illegal user: User not known to the underlying authentication module<o:p></o:p> Apr 8 16:38:19 rh01 sshd[11044]: Failed password for invalid user myuser from 127.0.0.1 port 42064 ssh2<o:p></o:p> <o:p> </o:p> So it seems he just doesn’t recognize the user (stored in LDAP directory). I had this working before but then I made some changes to try to make the pam files more readable and now they never got back to working … :)<o:p></o:p> <o:p> </o:p> Here is my system-auth file in /etc/pam.d<o:p></o:p> #%PAM-1.0<o:p></o:p> # This file is auto-generated.<o:p></o:p> # User changes will be destroyed the next time authconfig is run.<o:p></o:p> auth required pam_env.so<o:p></o:p> auth sufficient pam_unix.so nullok try_first_pass<o:p></o:p> auth requisite pam_succeed_if.so uid >= 500 quiet<o:p></o:p> auth sufficient /lib/security/pam_ldap.so use_first_pass<o:p></o:p> auth required pam_deny.so<o:p></o:p> <o:p> </o:p> account required pam_unix.so broken_shadow<o:p></o:p> account sufficient pam_localuser.so<o:p></o:p> account sufficient pam_succeed_if.so uid < 500 quiet<o:p></o:p> account [default=bad success=ok user_unknown=ignore] /lib/security/pam_ldap.so<o:p></o:p> account required pam_permit.so<o:p></o:p> <o:p> </o:p> password requisite pam_cracklib.so try_first_pass retry=3<o:p></o:p> password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok<o:p></o:p> password sufficient /lib/security/pam_ldap.so use_authtok<o:p></o:p> password required pam_deny.so<o:p></o:p> <o:p> </o:p> session optional pam_keyinit.so revoke<o:p></o:p> session required pam_limits.so<o:p></o:p> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<o:p></o:p> session required pam_unix.so<o:p></o:p> session optional /lib/security/pam_ldap.so<o:p></o:p> <o:p> </o:p> And here is sshd file in the same directory<o:p></o:p> #%PAM-1.0<o:p></o:p> auth sufficient /lib/security/pam_ldap.so<o:p></o:p> auth include system-auth<o:p></o:p> account sufficient /lib/security/pam_ldap.so<o:p></o:p> account required pam_nologin.so<o:p></o:p> account include system-auth<o:p></o:p> password required /lib/security/pam_ldap.so<o:p></o:p> password include system-auth<o:p></o:p> <o:p> </o:p> session sufficient /lib/security/pam_ldap.so<o:p></o:p> <o:p> </o:p> password sufficient pam_unix.so ssha shadow nullok try_first_pass use_authtok<o:p></o:p> <o:p> </o:p> <o:p> </o:p> session optional pam_keyinit.so force revoke<o:p></o:p> session include system-auth<o:p></o:p> session required pam_loginuid.so<o:p></o:p> <o:p> </o:p> As part of the “file clean-up” I was only using the “include” directives but since it stopped working I reverted back to explicitly telling what module to use… still doesn’t work though. Can anyone see why SSH doesn’t even try to authenticate against the OpenLDAP directory? <o:p></o:p> <o:p> </o:p> Thank you,<o:p></o:p> Nuno<o:p></o:p> <o:p> </o:p> </div> </body> </html>