Do you have nscd running? If so, try stopping and starting that.
Cheers,
Cliff
On Thu, Feb 21, 2013 at 12:50 PM, Wes Modes <wmodes@xxxxxxxx> wrote:
> I am trying to configure NIS, PAM, & LDAP on a CentOS 6.2 host. I've
> previously installed a similar configuration on RHEL4, but CentOS now
> uses nss-pam-ldapd and nslcd instead of nss_ldap, so the configurations
> are a little different.
>
> Currently, local users and groups are showing up but not LDAP users.
> When I do a /getent passwd/ and/getent group/ I don't get LDAP users.
>
> When I do a listing of a share directory that should have user and group
> ownership determined by LDAP, I get the uidNumbers and gidNumbers rather
> than the UIDs and GIDs.
>
> [root@edgar2 openldap]# ls -l /data/home | tail
> drwx------. 2 30634 30080 4096 Mar 18 2009 userdir1
> drwx------. 33 30548 30075 4096 Jan 29 15:20 userdir2
> drwx------. 3 30554 30075 4096 Jan 26 2009 userdir3
> drwx------. 12 30467 30075 4096 Jun 21 2012 userdir4
> drwx------. 4 30543 30075 4096 Oct 21 2008 userdir5
> drwx------. 8 30555 30075 4096 Oct 31 10:36 userdir5
>
> Other details: centos 6.2, smbldap-tools 0.9.6, openldap 2.4.23
>
> I've fussed with /etc/nsswitch.conf, /etc/pam_ldap.conf,
> /etc/nslcd.conf, /etc/pam.d/system-auth, and /etc/sysconfig/authconfig.
> And selinux is off.
>
> I know the machine is successfully connecting to LDAP. An ldapsearch
> works from this machine, and I can even connect to a samba share with an
> ldap login through smbclient.
>
> Relevant parts of /etc/nsswitch:
>
> passwd: files ldap
> shadow: files ldap
> group: files ldap
>
> #hosts: db files nisplus nis dns
> hosts: files dns
>
> bootparams: nisplus [NOTFOUND=return] files
>
> ethers: files
> netmasks: files
> networks: files
> protocols: files ldap
> rpc: files
> services: files ldap
>
> netgroup: nisplus ldap
> #netgroup: ldap
>
> publickey: nisplus
>
> automount: files nisplus ldap
> #automount: files ldap
> aliases: files nisplus
>
> Relevant parts of /etc/pam_ldap.conf (everything else is commented out):
>
> host dir1.ourdomain.com
> base dc=.ourdomain,dc=com
> #uri ldaps://dir1.ourdomain.com
> uri ldap://dir1.ourdomain.com
>
> # basic auth config
> binddn cn=admin,dc=ourdomain,dc=com
> rootbinddn cn=admin,dc=ourdomain,dc=com
>
> # random stuff
> #timelimit 120
> #bind_timelimit 120
> #bind_policy hard
> # brought these times down wmodes Aug 11, 2008
> timelimit 30
> bind_timelimit 30
> bind_policy soft
> idle_timelimit 3600
> nss_initgroups_ignoreusers root,ldap
>
> # pam config
> #pam_password md5
> pam_password md5
>
> # config for nss
> nss_base_passwd ou=people,dc=ourdomain,dc=com?one
> nss_base_shadow ou=people,dc=ourdomain,dc=com?one
> nss_base_group ou=group,dc=ourdomain,dc=com?one
>
> # OpenLDAP SSL mechanism
> # start_tls mechanism uses the normal LDAP port, LDAPS typically 636
> ssl no
>
> # OpenLDAP SSL options
> # Require and verify server certificate (yes/no)
> #tls_checkpeer yes
>
> # CA certificates for server certificate verification
> tls_cacertfile /etc/openldap/cacerts/cacert.pem
> tls_cacertdir /etc/openldap/cacerts
>
> # Client certificate and key
> tls_cert /etc/openldap/cacerts/servercert.pem
> tls_key /etc/openldap/cacerts/serverkey.pem
>
> Relevant parts of /etc/pam.d/system-auth:
>
> auth required pam_env.so
> auth sufficient pam_fprintd.so
> auth sufficient pam_unix.so nullok try_first_pass
> auth requisite pam_succeed_if.so uid >= 500 quiet
> auth sufficient pam_ldap.so use_first_pass
> auth required pam_deny.so
>
> account required pam_unix.so
> account sufficient pam_localuser.so
> account sufficient pam_succeed_if.so uid < 500 quiet
> account [default=bad success=ok user_unknown=ignore] pam_ldap.so
> account required pam_permit.so
>
> password requisite pam_cracklib.so try_first_pass retry=3 type=
> password sufficient pam_unix.so sha512 shadow nullok
> try_first_pass use_authtok
> password sufficient pam_ldap.so use_authtok
> password required pam_deny.so
>
> session optional pam_keyinit.so revoke
> session required pam_limits.so
> session [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session required pam_unix.so
> session optional pam_ldap.so
> session optional pam_mkhomedir.so skel=/etc/skel umask=077
>
> And the only line in /etc/sysconfig/authconfig I changed was:
>
> USELDAP=yes
>
> Any thoughts? For those who are experienced with nis and pam, I'm sure
> this is a no brainer, but I could sure use the little bit of your brain
> that knows how to fix this.
>
> Wes
>
> --
> Wes Modes
> Systems Designer, Developer, and Administrator
> University Library ITS
> University of California, Santa Cruz
>
> _______________________________________________
> CentOS mailing list
> CentOS@xxxxxxxxxx
> http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
