RE: [389-users] Access.conf issue

["Tidwell Robert - rtidwe" <Robert.Tidwell@xxxxxxxxxx>]

Title: Access.conf issue

Is your user a part of the groupname or groupname2 group?

 

 And, is “UsePAM yes” and set in your sshd_config?

 

Although, I am not sure that the pam_member_attribute uniquemember is going to work in this situation.  Pam is looking to evaluate that the user is a member of the group that you specify for “pam_groupdn” in ldap.conf.

 

 Based on what you are saying, you are simply using pam_access to control ssh access to the server.  But instead of the pam_access line being in system_auth, I have it in /etc/pam.d/sshd, which it looks like yours is also based on the error messages.

 

What exactly are you trying to accomplish?

 

Robert

 

Robert M. Tidwell  | System Engineer/Architect/Administrator

Acxiom Distributed Systems Central Arkansas

00-1-501-342-4127 office | 00-1-501-908-2790 cell | 00-1-501-342-3932 fax
301East Dave Ward Drive | Conway, AR 72032 | USA | www.acxiom.com

From: fedora-directory-users-bounces@xxxxxxxxxx [mailto:fedora-directory-users-bounces@xxxxxxxxxx] On Behalf Of Prashanth Sundaram
Sent: Wednesday, November 18, 2009 11:06 AM
To: fedora-directory-users@xxxxxxxxxx
Subject: [389-users] Access.conf issue

 

All,

I have setup the ldapserver with PAM PassThrough and need help in figuring out the access.conf without use of netgroups. Can I simply use the groups with access.conf?

I am only able to ssh as root, but not with any ldap account. I was able to ssh before making changes for the pam_access.

Here are the files I edited.

/etc/ldap.conf
pam_member_attribute uniquemember  (since 389-ds uses uniquemember for group membership)
uri ldap://ldap.domain.com:389/
tls_checkpeer yes
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
pam_password md5
tls_cacertfile /etc/pki/tls/certs/ca-cert.crt

/etc/security/access.conf
+ : root : ALL
+ : @groupname : ALL
+ : @groupname2 : ALL
- : ALL : ALL

authconfig  --enableldap --enableldapauth --disablenis --enablecache --ldapserver=ldap.domain.com --ldapbasedn=dc=ldapdomain,dc=com --enableldaptls --disablekrb5 --krb5kdc=AD.ADdomain.com --krb5adminserver=AD.ADdomain.com --krb5realm=ADDOMAIN.COM --enablekrb5kdcdns --enablekrb5realmdns --enablepamaccess --enablemkhomedir --enablelocauthorize —updateall

/etc/pam.d/system-auth
:
account     required   pam_access.so accessfile=/etc/security/access.conf
:

Here’s the error message I got. I see that krb5 is succeeding my password but pam_access is blocking me.
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.12.0.95  user=psundaram
Nov 18 11:01:44 wgldap01 sshd[8995]: pam_krb5[8995]: authentication succeeds for 'psundaram' (psundaram@xxxxxxxxxxxx)
Nov 18 11:01:45 wgldap01 sshd[8995]: pam_access(sshd:account): access denied for user `psundaram' from `10.12.0.95'
Nov 18 11:01:45 wgldap01 sshd[8995]: pam_access(sshd:account): access denied for user `psundaram' from `10.12.0.95'
Nov 18 11:01:45 wgldap01 sshd[8996]: fatal: Access denied for user psundaram by PAM account configuration


Thanks,
Prashanth

***************************************************************************
The information contained in this communication is confidential, is
intended only for the use of the recipient named above, and may be legally
privileged.

If the reader of this message is not the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited.

If you have received this communication in error, please resend this
communication to the sender and delete the original message or any copy
of it from your computer system.

Thank You.
****************************************************************************

--
389 users mailing list
389-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users