Estou configurando um novo servidor CentOS 7 e preciso configurar a autenticação LDAP, ou seja, já existe um servidor que autentica usuários, que usamos para outros servidores GNU/Linux.
Por exemplo, no Windows posso consultar o nome do host e o IP do DC usando nltest /dclist:X.Y. O que retorna uma lista de servidores DC que posso confirmar que estão corretos.
Quando testo a conexão com esses servidores DC usando ldapsearcho servidor CentOS 7, ele funciona:
ldapsearch -H ldap://<DCSERVER> -D <user>@X.Y -w
A saída é uma longa lista de informações, incluindo informações de DN.
No entanto, ao usar getent passwd, não há saída e vejo um erro em /var/log/messages:
Nov 24 16:09:37 XXXXXXXX nslcd[22440]: [16e9e8] <passwd(all)> ldap_result() failed: Operations error: 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580
getent passwordfunciona bem em outros servidores CentOS 6, mas eles estão usando o BeyondTrust, do qual desejo migrar e não era o administrador no momento da instalação.
Arquivos de configuração relevantes:
/etc/openldap/ldap.confcontém:
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/pki/tls/certs
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
URI ldap://<DCSERVER>
BASE DC=X,DC=Y
/etc/nsswitch.confcontém:
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files ldap
shadow: files ldap
group: files ldap
#initgroups: files
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files sss
aliases: files nisplus
/etc/nslcd.confcontém:
# This is the configuration file for the LDAP nameservice
# switch library's nslcd daemon. It configures the mapping
# between NSS names (see /etc/nsswitch.conf) and LDAP
# information in the directory.
# See the manual page nslcd.conf(5) for more information.
# The user and group nslcd should run as.
uid nslcd
gid ldap
# The uri pointing to the LDAP server to use for name lookups.
# Multiple entries may be specified. The address that is used
# here should be resolvable without using LDAP (obviously).
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldap://<DCSERVER>
# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3
# The distinguished name of the search base.
base DC=X,DC=Y
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com
Agradeço antecipadamente por sua ajuda.
Responder1
Há uma incompatibilidade: se você verificar os logs sssd, estará usando o daemon sssd. Mas então você deve configurá-lo no arquivo:
/etc/sssd/sssd.conf
não em /etc/nslcd.conf (bom para o daemon pam-ldapd).
Além disso:
- a sintaxe de sssd.conf e nslcd.conf é muito diferente;
- em /etc/nsswitch.conf, o daemon sssd é referenciado com a chave 'sss' (não 'ldap').
Responder2
Não consegui resolver isso completamente.
No entanto, a inspeção do /var/log/sssd/sssd_DOMAIN.logrevelou que o SSS está funcionando, mas provavelmente há problema com DN especificado incorretamente?
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: sh[0x7fc9553ddde0], connected[1], ops[0x7fc9553ed2c0], ldap[0x7fc9553d0cb0]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090724, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0
No final, optei por usar o PBIS de código aberto da Beyond Trust. Funcionou em poucos minutos.
http://www.beyondtrust.com/Resources/OpenSourceDocumentation/