☰

我有一個開放的 LDAP 伺服器：

tag-icon • tag-icon linux ubuntu authentication ldap openldap
我有一個開放的 LDAP 伺服器：

我有一個開放的 LDAP 伺服器：

IP：192.168.0.70（戴爾）

數字：

在此輸入影像描述

（透過ldappphpadmin看到）

對於帕特里夏·杜謝內來說：

dn  cn=patricia duchesne,ou=users,dc=memorandum,dc=pro
cn  patricia duchesne
gidnumber   501
givenname   patricia
homedirectory   /home/users/pduchesne
loginshell  /bin/bash
objectclass inetOrgPerson | posixAccount | top
sn  duchesne
uid pduchesne
uidnumber   1000
userpassword    {MD5}eFI0F0...

然後我有一個 LDAP 客戶端：

IP：192.168.0.60（PB）

NSSwitch 已配置：

$cat /etc/nsswitch.conf

passwd: files ldap
group: files ldap
shadow: files ldap
gshadow:        files

hosts:          files mdns4_minimal [NOTFOUND=return] dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup: nis

ldap-auth 也是如此：

$ cat /etc/auth-client-config/profile.d/ldap-auth-config
[lac_ldap]
nss_passwd=passwd: files ldap
nss_group=group: files ldap
nss_shadow=shadow: files ldap
nss_netgroup=netgroup: nis

和 libnss ：

$ cat /etc/libnss-ldap.conf
uri ldap://192.168.0.70
base dc=memorandum,dc=pro

我可以存取 ldap 使用者資訊：

$ getent passwd | tail -n 1
pduchesne:*:1000:501:patricia duchesne:/home/users/pduchesne:/bin/bash

但我無法連線：

來自IP：192.168.0.80

$ ssh [email protected]
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied, please try again.
[email protected]'s password:
Permission denied (publickey,password).

我缺什麼？

我查看了數百個網頁，但沒有找到設定所有這些的方法:( https://help.ubuntu.com/community/LDAPClientAuthentication https://askubuntu.com/questions/127389/how-to-configure-ubuntu-as-an-ldap-client https://www.digitalocean.com/community/tutorials/how-to-authenticate-client-computers-using-ldap-on-an-ubuntu-12-04-vps

找到這個頁面：https://www.vincentliefoghe.net/content/openldap-gestion-des-logs 我意識到我不知道 ldap 日誌在哪裡:-(

編輯

下列的 ：https://help.ubuntu.com/community/LDAPClientAuthentication

192.168.0.60 上的 PAM 配置：

$ cat /usr/share/pam-configs/my_mkhomedir
Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
        required                        pam_mkhomedir.so umask=0022 skel=/etc/skel

更新 ：

$ sudo pam-auth-update
[sudo] password for romain:
LDAP Password:

在此輸入影像描述

文件

$ cat /etc/security/group.conf

已完整評論

我沒有使用 nscd ：

$ /etc/init.d/nscd stop
[....] Stopping nscd (via systemctl): nscd.service==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to stop 'nscd.service'.
Authenticating as: romain,,, (romain)
Password:
LDAP Password:
==== AUTHENTICATION COMPLETE ===
. ok

我沒有使用[LDAP主機存取授權]段落。我是不是該 ？

編輯2

詳細 ssh ：

romain@Mac:~$ ssh -v pduchesne@pb
OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 20: Applying options for *
debug1: /etc/ssh/ssh_config line 102: Applying options for *
debug1: Connecting to pb [192.168.0.60] port 22.
debug1: Connection established.
debug1: identity file /Users/romain/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/romain/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.1
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to pb:22 as 'pduchesne'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client [email protected] <implicit> none
debug1: kex: client->server [email protected] <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:OIiYKNK9FOdhlu2sVahXFoXYCjxmxTQ7NrZtA75Vwps
debug1: Host 'pb' is known and matches the ECDSA host key.
debug1: Found key in /Users/romain/.ssh/known_hosts:18
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/romain/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /Users/romain/.ssh/id_dsa
debug1: Trying private key: /Users/romain/.ssh/id_ecdsa
debug1: Trying private key: /Users/romain/.ssh/id_ed25519
debug1: Next authentication method: password
pduchesne@pb's password:
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
pduchesne@pb's password:
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
pduchesne@pb's password:
debug1: Authentications that can continue: publickey,password
debug1: No more authentication methods to try.
Permission denied (publickey,password).

編輯3

在 ldap 伺服器中新增使用者密碼雜湊（請參閱開頭的使用者轉儲）

編輯4

根據 @grawity 的建議，我安裝了 libpam-ldapd：

romain@pb$ sudo apt-get install libpam-ldapd
[sudo] password for romain:
LDAP Password:
The following packages were automatically installed and are no longer required:
  auth-client-config ldap-auth-config
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  libpam-ldap
The following NEW packages will be installed:
  libpam-ldapd
Do you want to continue? [Y/n] Y
(...)
Setting up libpam-ldapd:amd64 (0.9.6-3) ...

然後我配置了/etc/nslcd.conf我注意到我沒有指定精確使用 ldap version3 （我不知道預設是哪個版本？）：

romain@pb$ sudo cat /etc/nslcd.conf | grep "^[^#]"
uid nslcd
gid nslcd
uri ldap://192.168.0.70
base dc=memorandum,dc=pro
ldap_version 3
tls_cacertfile /etc/ssl/certs/ca-certificates.crt

重新啟動 nslcd：

romain@pb$ sudo service nslcd restart

並嘗試從我的 mac 進行連接：

romain@Mac:~$ ssh pduchesne@pb

這有效......有點：

romain@Mac:~$ ssh pduchesne@pb
pduchesne@pb's password:
Welcome to Ubuntu 16.04.1 LTS (GNU/Linux 4.4.0-53-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

197 packages can be updated.
4 updates are security updates.

*** System restart required ***
Last login: Fri Jan 13 11:12:23 2017 from 192.168.0.80
romain@pb:~$ pwd
/home/users/pduchesne
romain@pb:~$ whoami
romain

新問題（編輯 4）

為什麼我不更改使用者？我本來希望以“pduchesne”身份登入“pb”：-/

舊問題（編輯4之前）

我不知道要檢查哪些文件 - 歡迎任何建議。

答案1

您顯示的配置實際上並未提及任何可用於身份驗證的內容；即沒有方法檢查輸入的密碼。

您的 nsswitch 1配置確實有shadow: ldap，但您的使用者物件轉儲實際上並未提及任何「影子」屬性 - 所以有是沒有可以檢索的資訊getent shadow。雖然這沒什麼問題，因為無論如何透過 LDAP 公開影子資訊都不太安全。

相反，您應該設定pam_ldap(libpam-ldapd)，它嘗試使用給定的密碼對 LDAP 伺服器進行身份驗證（綁定）。為此，有必要將 LDAP 格式的密碼雜湊放入使用者的userPassword屬性中（轉儲中也缺少該屬性）。

請注意，儘管獨立的 libnss-ldap （和 libpam-ldap）有幾個缺點，並且大部分已經過時 - 您將使用 nslcd + libnss-ldap 獲得更可靠的配置d+ libpam-ldapd 代替。

1 “名稱服務開關”，而不是“NSS 的女巫”

相關內容