Estoy configurando un servidor CentOS 7 nuevo y necesito configurar la autenticación LDAP, es decir, ya existe un servidor que autentica a los usuarios, que usamos para otros servidores GNU/Linux.
Por ejemplo, en Windows puedo consultar el nombre de host y la IP del DC usando nltest /dclist:X.Y. Lo que devuelve una lista de servidores DC que puedo confirmar que son correctos.
Cuando pruebo la conexión a estos servidores DC usando ldapsearchel servidor CentOS 7, funciona:
ldapsearch -H ldap://<DCSERVER> -D <user>@X.Y -w
El resultado es una larga lista de información, incluida la información del DN.
Sin embargo, cuando se usa getent passwd, no hay resultados y veo un error en /var/log/messages:
Nov 24 16:09:37 XXXXXXXX nslcd[22440]: [16e9e8] <passwd(all)> ldap_result() failed: Operations error: 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580
getent passwordfunciona bien en otros servidores CentOS 6, pero están usando BeyondTrust, del cual quiero migrar y no era el administrador en el momento de la instalación.
Archivos de configuración relevantes:
/etc/openldap/ldap.confcontiene:
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/pki/tls/certs
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
URI ldap://<DCSERVER>
BASE DC=X,DC=Y
/etc/nsswitch.confcontiene:
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files ldap
shadow: files ldap
group: files ldap
#initgroups: files
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files sss
aliases: files nisplus
/etc/nslcd.confcontiene:
# This is the configuration file for the LDAP nameservice
# switch library's nslcd daemon. It configures the mapping
# between NSS names (see /etc/nsswitch.conf) and LDAP
# information in the directory.
# See the manual page nslcd.conf(5) for more information.
# The user and group nslcd should run as.
uid nslcd
gid ldap
# The uri pointing to the LDAP server to use for name lookups.
# Multiple entries may be specified. The address that is used
# here should be resolvable without using LDAP (obviously).
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldap://<DCSERVER>
# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3
# The distinguished name of the search base.
base DC=X,DC=Y
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com
Gracias de antemano por tu ayuda.
Respuesta1
Hay una discrepancia: si verifica los registros de sssd, está utilizando el demonio sssd. Pero luego deberías configurarlo en el archivo:
/etc/sssd/sssd.conf
no en /etc/nslcd.conf (bueno para el demonio pam-ldapd).
Además:
- la sintaxis de sssd.conf y nslcd.conf es muy diferente;
- en /etc/nsswitch.conf, se hace referencia al demonio sssd con la clave 'sss' (no 'ldap').
Respuesta2
No pude resolver esto por completo.
Sin embargo, la inspección /var/log/sssd/sssd_DOMAIN.logreveló que SSS está funcionando pero probablemente haya un problema con un DN especificado incorrectamente.
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: sh[0x7fc9553ddde0], connected[1], ops[0x7fc9553ed2c0], ldap[0x7fc9553d0cb0]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090724, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0
Al final, elegí utilizar PBIS de código abierto de Beyond Trust. Funcionó en pocos minutos.
http://www.beyondtrust.com/Resources/OpenSourceDocumentation/