Hi Folks,
I've install 389 Directory Server on a Centos 7.0 server. Over the last two days I've been trying to connect a MacBook running 10.10.5 to the server as a client and I'm having only partial success.
I've "Joined" to my network Account Server, and set my LDAP Mappings to RFC2307.
With these settings, I'm able to look at the "Directory Editor" (located within the Directory Utility) and see the postfix groups / users I've created on the 389-ds server. (so success!)
Similarly, when using the Mac OS dscl command, and "cd-ing" int LDAPv3/FQDN_of_server/Users, I see the RecordNames of the users (or the shortname uid). (success again!)
The command
dscl /LDAPv3/FQDN_of_server -read Users/testuser
appears to pull up the correct information for the user. For example, the above command yields the following user information:
sh-3.2# dscl /LDAPv3/FQDN_of_server -read Users/testuser
dsAttrTypeNative:gecos: Ethan Hawke; Test User
dsAttrTypeNative:givenName: Test
dsAttrTypeNative:mail: testuser@xxx.xxx.edu
dsAttrTypeNative:memberOf:
cn=group1,ou=Groups,dc=example,dc=edu
cn=group2,ou=Groups,dc=example,dc=edu
dsAttrTypeNative:objectClass: top person organizationalPerson
inetorgperson posixAccount inetuser
dsAttrTypeNative:sn: User
AppleMetaNodeLocation: /LDAPv3/FQDN_of_server
AppleMetaRecordName:
uid=testuser,ou=People,dc=example,dc=edu
NFSHomeDirectory: /home/testuser
PrimaryGroupID: 1100
RealName: Test User
RecordName: testuser
RecordType: dsRecTypeStandard:Users
UniqueID: 2000
UserShell: /bin/tcsh
As root on the Mac system, I can "su" to an LDAP test user and create files. The ownership and group of the created files look correct. For example:
sh-3.2# su - testuser
[macbook:~] testuser% touch testfile
[macbook:~] testuser% ls -l testfile
-rw-r----- 1 testuser group1 0 Aug 22 14:47 testfile
I can also "change" the user's password by doing the following from the macbook:
sh-3.2# ldappasswd -ZZ -H ldap://xxx.xx.xx.4 -D "uid=testuser,ou=People,dc=example,dc=edu" -W -S -A
Old password: (current ldap passwd)
Re-enter old password: (current ldap passwd)
New password: (some new password)
Re-enter new password: (that same new password)
Enter LDAP Password: <--- this is the user's origional LDAP password before changing.
sh-3.2#
When I then try to login to a ldap client linux box, the user can successfully login with the new password.
However, I have an issue where I apparently can't ssh into the mac as testuser, login to the console, or "su" to an LDAP user from an unprivileged account. NOTE: I did verify that under "Users & Groups" I am allowing "all" network users to login at the login window.
The error I'm seeing in the system.log file when I try to ssh into the localhost as the test user is the following:
..... sshd<XXX>: error: PAM: authentication error for testuser ....
I believe the problem is with the authorization, sshd, and login files in the /etc/pam.d directory of the mac, butI've tried several changes to correct for the error, and nothing seems to work. I also tried setting UsePAM yes in the sshd_config file, but that didn't make a difference.
Has anyone else run across this issue? any suggestions would be appreciated. I've been fighting with this problem for two days now. Slaving into the directory server was easy, but this part has me puzzled.
Thanks,
==================
NOTE1: Error in the system.log file. What I'm seeing from an ldap user login (testuser) compared to a local user (localuser):
Aug 23 11:32:59 macbook com.apple.xpc.launchd[1] (com.openssh.sshd.F2962412-B0D7-4CBE-A82D-7D623E5484C7): Service instances do not support events yet.
Aug 23 11:33:04 macbook sshd[860]: error: PAM: authentication error for testuser from localhost via ::1
Aug 23 11:33:09 macbook sshd[860]: Connection closed by ::1 [preauth]
Aug 23 11:33:20 macbook com.apple.xpc.launchd[1] (com.openssh.sshd.05932857-258A-4DA3-8ACB-8724C9F660C3): Service instances do not support events yet.
Aug 23 11:33:24 macbook sshd[867]: Accepted keyboard-interactive/pam for localuser from ::1 port 50035 ssh2
Aug 23 11:33:24 macbook sshd: localuser [priv][867]: USER_PROCESS: 871 ttys004
NOTE2: I did modify the MacBook's /etc/openldap/ldap.conf file to be:
sh-3.2# cat /etc/openldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
BASE dc=example,dc=edu
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
URI ldap://xxx.xx.xx.4/
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
### changed TLS_REQCERT demand to allow
##TLS_REQCERT demand
TLS_REQCERT never
ssl start_tls
I added the ssl start_tls line so that I could use the following command from the mac:
ldapsearch -ZZ -x 'uid=testuser,ou=People,dc=example,dc=edu'