I am running 14.04 servers that I have install the ldap authentication package
ldap-auth-client on and configured to connect to our LDAP servers. I have the authentication part working as well as the user lookup. I can log in using an ldap account and password. I can use id to find ids of ldap users.
I have also configured the
pam_groupdn option in the
ldap.conf file to limit which accounts can log into the server, but that functionality is not working. So far I am testing with SSH.
I verified that
sshd_config has PAM enabled and I am testing with an account not in the
pam_groupdn group, it is binding to ldap and authenticating, but not attempt is made to validate the dn in the groupdn list. I used wireshark to sniff out all the ldap traffic and verified no search was made for the groupdn object.
Sounds like something on the account validation side is not getting triggered, my common-account file is the default:
# here are the per-package modules (the "Primary" block) account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so account [success=1 default=ignore] pam_ldap.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config
Any help with the config or ideas on how to further debug this is appreciated.