Hi all,
I've been struggling to setup a centralized authentication system for quite some time. It is composed by:
- openldap 2.4.43, with TLS self-signed certs (root chain is ok): ldaps://serv;
- pam 1.2.1; pambase 20150213;
- sssd 1.13.1;
- openssh 7.1.
Currently I'm trying to authenticate a LDAP user in the server that hosts openldap.
ldapsearch -x shows me stuff correctly, with TLS working. If I try to connect through the command-line, the logs show sssd getting stuff from openldap with success. But, login fails:
<log>
login[xxxx]: pam_sss(login:auth): authentication success; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=user_a
login[xxxx]: FAILED LOGIN (1) on '/dev/tty1' FOR 'UNKNOWN', Authentication failure
</log>
Also, id user_a fails, getent passwd user_a fails. Have no idea what may be wrong (if sssd, ldap DB, whatever).
sssd.conf
[sssd]
config_file_version = 2
services = pam
domains = LDAP
debug_level = 4
[nss]
[pam]
debug_level = 5
[domain/LDAP]
debug_level = 4
id_provider = ldap
auth_provider = ldap
access_provider = ldap
cache_credentials = false
ldap_uri = ldaps://server
ldap_schema = rfc2307
ldap_search_base = dc=casa,dc=lan
ldap_id_use_start_tls = true
ldap_tls_cacert = /etc/openldap/ssl/cacert.pem
ldap_tls_cacertdir = /etc/openldap/ssl
ldap_tls_reqcert = demand
tls_reqcert = demand
ldap_user_search_base = ou=People,dc=casa,dc=lan
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_search_base = ou=Group,dc=casa,dc=lan
ldap_access_filter = memberOf=ou=People,dc=casa,dc=lan
# Leave this as password
ldap_default_authtok_type = password
system-auth
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
#auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
#account sufficient pam_succeed_if.so uid < 500 quiet
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
#account [default=bad success=ok] pam_sss.so
account sufficient pam_sss.so
account required pam_permit.so