mjhjmtu

I have two Debian VMs. one is running an LDAP server and I'm trying to get the other to use libpam_ldap.

The client machine is able to get users from LDAP for the GUI login screen, but I can't ssh into the VM with users that are only in LDAP. I also can't su from the root user (local) to an LDAP user, but I assume it's the same problem.

On the client machine, I can use ldapsearch to look up the user I want...

ldapsearch -x -D "cn=admin,dc=mydomain,dc=com" -W -b "uid=testuser,ou=People,dc=mydomain,dc=com"

This prompts me for the admin LDAP password, and returns my user record:

dn: uid=testuser,ou=People,dc=mydomain,dc=com
uid: testuser
cn: Test User
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: [removed for stackexchange posting ]
shadowLastChange: 17543
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 1001
gidNumber: 1001
homeDirectory: /home/dwill
gecos: Test User,,,

(note, my domain isn't acutually "mydomain.com". I edited it for this posting)

But when I do getent passwd testuser, it doesn't return anything.

the /etc/nsswitch.conf has these lines

passwd: files ldap
group: files ldap
shadow: files ldap

It used to have compat ldap for those but I tried changing it files because that's what one of the guides I found had. It didn't work either way.

The /etc/ssh/sshd_config has UsePAM yes set.

I have followed all the guides I can find via Google and I still can't get this working.

Any suggestions?

I found the problem. One of the guides I found on Google instructed me to do

apt-get libnss-ldap libpam-ldap nslcd

I also later found an article that said that libpam-ldapd is newer than libpam-ldap and installed that instead.

libnss-ldap prompts you for some configuration and creates a /etc/libnss-ldap.conf file. Then libpam-ldap uninstalls libnss-ldap but leaves its config file behind. Apparently that config file is still meaningful because that's the one it's using and I had an error in the binddn in that file. After fixing the binddn, it worked.

I really don't know why you'd install both of those ldap modules. After getting the first client VM working, I setup another client VM using just libpam-ldapd and nslcd and it worked first time.

Ensure you have a /etc/pam.d/sshd with the following content:

auth sufficient pam_ldap.so
account sufficient pam_permit.so

Then, run sudo /usr/sbin/pam-auth-update and you restart the sshd service.