<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)">  <style>  </style>  </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> I attempted to use the same config as listed below and I am still running into issues. I do not see anything in /var/log/secure or /var/log/messages. Here is the auth. part of my ssh debug log:<o:p></o:p> <o:p> </o:p> [snippet ]<o:p></o:p> <o:p> </o:p> debug1: PAM: initializing for "lyork"<o:p></o:p> debug3: Normalising mapped IPv4 in IPv6 address<o:p></o:p> debug3: Trying to reverse map address 127.0.0.1.<o:p></o:p> debug1: PAM: setting PAM_RHOST to "cent-os-2"<o:p></o:p> debug1: PAM: setting PAM_TTY to "ssh"<o:p></o:p> debug2: monitor_read: 46 used once, disabling now<o:p></o:p> debug3: mm_request_receive entering<o:p></o:p> debug3: monitor_read: checking request 3<o:p></o:p> debug3: mm_answer_authserv: service=ssh-connection, style=<o:p></o:p> debug2: monitor_read: 3 used once, disabling now<o:p></o:p> debug3: mm_request_receive entering<o:p></o:p> debug3: monitor_read: checking request 4<o:p></o:p> debug3: mm_answer_authrole: role=<o:p></o:p> debug2: monitor_read: 4 used once, disabling now<o:p></o:p> debug3: mm_request_receive entering<o:p></o:p> debug1: userauth-request for user lyork service ssh-connection method publickey<o:p></o:p> debug1: attempt 1 failures 1<o:p></o:p> debug2: input_userauth_request: try method publickey<o:p></o:p> debug1: test whether pkalg/pkblob are acceptable<o:p></o:p> debug3: mm_key_allowed entering<o:p></o:p> debug3: mm_request_send entering: type 21<o:p></o:p> debug3: monitor_read: checking request 21<o:p></o:p> debug3: mm_answer_keyallowed entering<o:p></o:p> debug3: mm_answer_keyallowed: key_from_blob: 0x80983b8<o:p></o:p> debug1: temporarily_use_uid: 3000/3000 (e=0/0)<o:p></o:p> debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED<o:p></o:p> debug3: mm_request_receive_expect entering: type 22<o:p></o:p> debug3: mm_request_receive entering<o:p></o:p> debug1: trying public key file /home/lyork/.ssh/authorized_keys<o:p></o:p> debug1: restore_uid: 0/0<o:p></o:p> debug1: temporarily_use_uid: 3000/3000 (e=0/0)<o:p></o:p> debug1: trying public key file /home/lyork/.ssh/authorized_keys2<o:p></o:p> debug1: restore_uid: 0/0<o:p></o:p> debug3: Normalising mapped IPv4 in IPv6 address<o:p></o:p> Failed publickey for lyork from 127.0.0.1 port 1199 ssh2<o:p></o:p> debug3: mm_answer_keyallowed: key 0x80983b8 is disallowed<o:p></o:p> debug3: mm_request_send entering: type 22<o:p></o:p> debug3: mm_request_receive entering<o:p></o:p> debug2: userauth_pubkey: authenticated 0 pkalg ssh-rsa<o:p></o:p> debug1: userauth-request for user lyork service ssh-connection method password<o:p></o:p> debug1: attempt 2 failures 2<o:p></o:p> debug2: input_userauth_request: try method password<o:p></o:p> debug3: mm_auth_password entering<o:p></o:p> debug3: mm_request_send entering: type 11<o:p></o:p> debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD<o:p></o:p> debug3: mm_request_receive_expect entering: type 12<o:p></o:p> debug3: mm_request_receive entering<o:p></o:p> debug3: monitor_read: checking request 11<o:p></o:p> debug3: PAM: sshpam_passwd_conv called with 1 messages<o:p></o:p> debug3: PAM: sshpam_passwd_conv called with 1 messages<o:p></o:p> debug1: PAM: password authentication failed for lyork: Authentication failure<o:p></o:p> debug3: mm_answer_authpassword: sending result 0<o:p></o:p> debug3: mm_request_send entering: type 12<o:p></o:p> Failed password for lyork from 127.0.0.1 port 1199 ssh2<o:p></o:p> [end snippet]<o:p></o:p> <o:p> </o:p> <div> <div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'> From: pam-list-bounces@redhat.com [mailto:pam-list-bounces@redhat.com] On Behalf Of Whittier, Kevin CTR 63134 Sent: Monday, September 22, 2008 2:22 PM To: Pluggable Authentication Modules Subject: RE: Authentication problems with ldap<o:p></o:p> </div> </div> <o:p> </o:p> <div id=idOWAReplyText73252> <div> This works for my environment:<o:p></o:p> </div> <div> <o:p></o:p> </div> <div> auth required pam_env.so auth sufficient pam_unix.so audit auth sufficient pam_ldap.so use_first_pass<o:p></o:p> </div> <div> # pam_ldap acct verifies host in ldap user's ACL and returns IGNORE if non-ldap. # pam_unix acct succeeds w/o checking ACL if put 1st as pam_ldap auth would # have already retrieved user's passwd and shadow info. account required pam_ldap.so ignore_unknown_user ignore_authinfo_unavail account required pam_tally.so deny=3 no_magic_root reset account sufficient pam_unix.so audit<o:p></o:p> </div> <div> password requisite pam_cracklib.so retry=3 minlen=14 lcredit=-2 ocredit=-2 ucredit=-2 dcredit=-2 password sufficient pam_ldap.so use_authtok password sufficient pam_unix.so use_authtok shadow md5 audit<o:p></o:p> </div> <div> # pam_ldap session, pam_sm_open_session(), closes any remaining ldap connection. session required pam_limits.so session required pam_mkhomedir.so skel=/etc/skel umask=0022 session required pam_unix.so audit session required pam_ldap.so<o:p></o:p> </div> </div> <div> Kevin<o:p></o:p> <div class=MsoNormal align=center style='text-align:center'> <hr size=2 width="100%" align=center> </div> From: Lynn York Sent: Mon 9/22/2008 11:02 AM To: Pluggable Authentication Modules Subject: RE: Authentication problems with ldap<o:p></o:p> </div> <div><pre style='WORD-WRAP: break-word'>_______________________________________________<o:p></o:p></pre><pre>Pam-list mailing list<o:p></o:p></pre><pre>Pam-list@redhat.com<o:p></o:p></pre><pre>https://www.redhat.com/mailman/listinfo/pam-list<o:p></o:p></pre></div> </div> </body> </html>