Re: FreeBSD 7.0, Open LDAP, PAM, TLS and NSS, howto?


There should be an nss_ldap.conf and pam_ldap.conf in /usr/local/etc . You need to set a variety of settings there. What do they look like?

Remember: pkg_info -L pam_ldap nss_ldap!

Also, not sure about the TCP FIN_2 issue -- probably just the usual shakes and bangs with -current. ~BAS


On Fri, 28 Sep 2007, O. Hartmann wrote:

Thank you for responding.
So, I'll feel free reporting my bad luck. This is a reference page I consulted for some hints, but without success:

http://www.cultdeadsheep.org/FreeBSD/docs/Quick_and_dirty_FreeBSD_5_x_and_nss_ldap_mini-HOWTO.html

First, OS ist the most recent FreeBSD 7.0.
OpenLDAP is openldap-server-2.3.38, standard config, no SASL support or anything else apart from default
PAM_LDAP
NSS_LDAP

I renamed cached.conf to nscd.conf as suggested (for your information).
In /etc/nsswitch.conf I changed
#
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: src/etc/nsswitch.conf,v 1.1 2006/05/03 15:14:47 ume Exp $
#
group: files ldap
group_compat: nis
hosts: files dns
networks: files
passwd: files ldap
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

I also changed /etc/pam.d/sshd to this:

#
# $FreeBSD: src/etc/pam.d/sshd,v 1.16 2007/06/10 18:57:20 yar Exp $
#
# PAM configuration for the "sshd" service
#

# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn try_first_pass
auth sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass
auth sufficient pam_ssh.so no_warn try_first_pass
auth required pam_unix.so no_warn try_first_pass

# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so

# session
#session optional pam_ssh.so
session required pam_permit.so

# password
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_pass

Both configuration files for nss_ldap and pam_ldap respective got linked to /usr/localetc/openldap/ldap.conf, which looks like this:

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE dc=foo,dc=org
#URI ldapi:///
URI ldapi://%2fvar%2frun%2fopenldap%2fldapi/

#SSL start_tls

#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never

#TLS_CACERT #TLS_CERT #TLS_KEY #TLS_REQCERT allow
#TLS_REQCERT demand
#TLS_CHECKPEER yes

My /etc/rc.conf.local file has the following OpenLDAP specific entry:

###########################################################
### OpenLDAP Server ###
###########################################################
slapd_enable="YES"
#slapd_flags='-d 3 -4 -s 4 -h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap:/// ldaps:///"'
slapd_flags='-4 -s 4 -h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://192.168.2.210 ldaps://192.168.2.210"'
slapd_sockets="/var/run/openldap/ldapi"


My OpenLDAP config file has SSL-certificates disabled.

After the installation of nss_ldap the slapd server takes several decades of seconds to start. But it starts well and after it has initiated itself, I can do on the server a simple 'slapcat' and receive.

But I can't access the LDAP server. Doing an 'id testuser' results in 'id not found'.

On the console, I receive massively errors like this:

TCP: [127.0.0.1]:389 to [127.0.0.1]:63896 tcpflags 0x18<PUSH,ACK>; tcp_do_segment: FIN_WAIT_2: Received data after socket was closed, sending RST and removing tcpcb

Well, I checked sockstat for a listening slapd and I found slapd listening on both loopback, local NIC adn on both ports 389 and 636.

So what is wrong ?

Regards,
a desperate Oliver




Brian A. Seklecki wrote:
FreeBSD 5.x and 6.x work fine with both PAM and NSS -> LDAP w/ TLS
(PKI). All other services (RADIUS, Apache ((mod_ldap, mod_pam_auth), PHP,
interactive shell, SFTP, etc.) can be tied into LDAP either directly or
via PAM.

As for password change, I don't know if anyone has a passwd(1) binary
that properly changes the LDAP password attribute -- if there is and its
out there, it requires ACL insanity. Like Oracle, you can either
understand OpenLDAP ACLs, or you have real work to do >:}

Check the nss_pam.conf and nss_ldap.conf configs in local/etc/*
-- set to "debug 1" to get debugging info. Feel free to share
error messages.

~BAS

On Fri, 2007-09-28 at 10:54 +0000, O. Hartmann wrote:

Hello out there,
I have a problem with setting up an FreeBSD box as OpenLDAP server with several services, like SAMBA, NFS.

The intention is to have a FreeBSD 7.0 fileserver (NFS, SAMBA) also acting as OpenLDAP server. So far. OpenLDAP is up and running, using TLS/SSL certificate. SAMBA is also up and running - but it never connects to the OpenLDAP server due to an connection error, but this shouldn't be the subject here, I have more basic questions about what FreeBSD already has and what to install additionally.

I want customers to log in on the FBSD box, so they sould log in (authenticated via OpenLDAP), change their passwords and shells and those user specifica should be updated on the LDAP server.

I already installed pam_ldap-port but ran into trouble because FreeBSD's nss obviously does not have a tag 'ldap' to refere to an OpenLDAP server (and not files).
Well, I'm confused and not very firm with OpenLDAP/PAM/NSS stuff, especially if SSL/TLS come into play and I would like to ask those herein administering those setups, especially within a hybrid NFS/SAMBA fileservicing environment, where to find up to date informationes/howto/tipps.

Most websites and HowTo's I found were Linux related or, if related to FreeBSD, outdated.

Sorry beeing so unspecific, but the problem is complex (to me) so I would better ask for those who are willing to help or give hints and tips.

Thanks in advance and for your patience,
Oliver

_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"












l8*
-lava (Brian A. Seklecki - Pittsburgh, PA, USA)
http://www.spiritual-machines.org/

"Guilty? Yeah. But he knows it. I mean, you're guilty.
You just don't know it. So who's really in jail?"
~Maynard James Keenan

_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: FreeBSD 7.0, Open LDAP, PAM, TLS and NSS, howto?
    ... Obviously, this did not work (again: I already installed successfully OpenLDAP, nss_ldap and pam_ldap!). ... The problem at the moment is, when nss_ldap running, login as root on console takes several minutes. ... When logged in on console, I can do a simple slapcatand get a lot of definitions, so tis shows a running and resping OpenLDAP server. ... Other tutorials around the web targetting mostly outdated environments (FreeBSD 5.1, older OpenLDAP versions or strange Linux setups). ...
    (freebsd-questions)
  • Re: FreeBSD 7.0, Open LDAP, PAM, TLS and NSS, howto?
    ... OpenLDAP is openldap-server-2.3.38, standard config, no SASL support or anything else apart from default ... # nsswitch.conf- name service switch configuration file ... passwd: files ldap ... I have a problem with setting up an FreeBSD box as OpenLDAP server with several services, like SAMBA, NFS. ...
    (freebsd-questions)
  • Re: LDAP Question
    ... Are they impossible to extract/get to the OpenLDAP? ... > If you are asking, will AD use the OpenLDAP users and passwords, the answer is ... > no. AD uses kerberos for auth, not LDAP. ... >> I have an OpenLdap Server were all my account creation, ...
    (microsoft.public.windows.server.active_directory)
  • Re: openLDAP question
    ... >unanswered questions, but I will start with one. ... "/etc/openldap/ldap.conf" is the OpenLDAP server configuration file, ... whereas "/etc/ldap.conf" is read by processes that want to use LDAP, ... I would just install the OpenLDAP server RPMs, ...
    (Fedora)
  • openldap, pam_ldap and nss_ldap
    ... I am having difficulties setting up openldap user authentication using ... (but he was using the native sun ldap clients) ... # with Netscape Directory Server) ... # Netscape SDK SSL options ...
    (SunManagers)