I am running 14.04 servers that I have install the ldap authentication package ldap-auth-client on and configured to connect to our LDAP servers. I have the authentication part working as well as the user lookup. I can log in using an ldap account and password. I can use id to find ids of ldap users.

I have also configured the pam_groupdn option in the ldap.conf file to limit which accounts can log into the server, but that functionality is not working. So far I am testing with SSH. I verified that sshd_config has PAM enabled and I am testing with an account not in the pam_groupdn group, it is binding to ldap and authenticating, but not attempt is made to validate the dn in the groupdn list. I used wireshark to sniff out all the ldap traffic and verified no search was made for the groupdn object.

Sounds like something on the account validation side is not getting triggered, my common-account file is the default:

# here are the per-package modules (the "Primary" block)
account [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so
account [success=1 default=ignore]  pam_ldap.so
# here's the fallback if no module succeeds
account requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

Any help with the config or ideas on how to further debug this is appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.