Verbindung mit ldap nicht möglich

Ich habe einen offenen LDAP-Server:

IP: 192.168.0.70 (Dell)

DIT:

(gesehen durch ldapphpadmin)

Und für Patricia Duchesne:

dn cn=patricia duchesne,ou=users,dc=memorandum,dc=pro cn patricia duchesne gidnumber 501 givenname patricia homedirectory /home/users/pduchesne loginshell /bin/bash objectclass inetOrgPerson | posixAccount | top sn duchesne uid pduchesne uidnumber 1000 userpassword eFI0F0... 

Dann habe ich einen LDAP-Client:

IP: 192.168.0.60 (pb)

NSSWitch ist konfiguriert:

$cat /etc/nsswitch.conf  passwd: files ldap group: files ldap shadow: files ldap gshadow: files  hosts: files mdns4_minimal [NOTFOUND=return] dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis 

so ist ldap-auth:

$ cat /etc/auth-client-config/profile.d/ldap-auth-config [lac_ldap] nss_passwd=passwd: files ldap nss_group=group: files ldap nss_shadow=shadow: files ldap nss_netgroup=netgroup: nis 

und libnss:

$ cat /etc/libnss-ldap.conf uri ldap://192.168.0.70 base dc=memorandum,dc=pro 

Ich kann die ldap-Benutzerinformationen erreichen:

$ getent passwd | tail -n 1 pduchesne:*:1000:501:patricia duchesne:/home/users/pduchesne:/bin/bash 

Ich kann aber keine Verbindung herstellen:

Von IP: 192.168.0.80

$ ssh pduchesne@192.168.0.60 pduchesne@192.168.0.60's password: Permission denied, please try again. pduchesne@192.168.0.60's password: Permission denied, please try again. pduchesne@192.168.0.60's password: Permission denied (publickey,password). 

Was vermisse ich ?

Ich habe mir hunderte von Webseiten angesehen, ohne einen Weg zu finden, all das einzurichten :( https://help.ubuntu.com/community/LDAPClientAuthentication https://askubuntu.com/questions/127389/how-to-configure-ubuntu- as-an-ldap-client https://www.digitalocean.com/community/tutorials/how-to-authenticate-client-computers- using-ldap-on-an-ubuntu-12-04-vps

So finden Sie diese Seite: https://www.vincentliefooghe.net/content/openldap-gestion-des-logs Mir wurde klar, dass ich nicht weiß, wo sich die LDAP-Protokolle befinden :-(

BEARBEITEN

Folgendes: https://help.ubuntu.com/community/LDAPClientAuthentication

PAM-Konfiguration an 192.168.0.60:

$ cat /usr/share/pam-configs/my_mkhomedir Name: activate mkhomedir Default: yes Priority: 900 Session-Type: Additional Session: required pam_mkhomedir.so umask=0022 skel=/etc/skel 

Update:

$ sudo pam-auth-update [sudo] password for romain: LDAP Password: 

Die Datei

$ cat /etc/security/group.conf 

ist voll kommentiert

Ich habe nscd nicht benutzt:

$ /etc/init.d/nscd stop [....] Stopping nscd (via systemctl): nscd.service==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units === Authentication is required to stop 'nscd.service'. Authenticating as: romain,,, (romain) Password: LDAP Password: ==== AUTHENTICATION COMPLETE === . ok 

Ich habe den Absatz [LDAP-Hostzugriffsberechtigung] nicht verwendet. Sollte ich ?

BEARBEITEN 2

Verbose ssh:

romain@Mac:~$ ssh -v pduchesne@pb OpenSSH_6.9p1, LibreSSL 2.1.8 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 20: Applying options for * debug1: /etc/ssh/ssh_config line 102: Applying options for * debug1: Connecting to pb [192.168.0.60] port 22. debug1: Connection established. debug1: identity file /Users/romain/.ssh/id_rsa type 1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_rsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_dsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_dsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_ecdsa type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_ecdsa-cert type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_ed25519 type -1 debug1: key_load_public: No such file or directory debug1: identity file /Users/romain/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.9 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.1 pat OpenSSH* compat 0x04000000 debug1: Authenticating to pb:22 as 'pduchesne' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:OIiYKNK9FOdhlu2sVahXFoXYCjxmxTQ7NrZtA75Vwps debug1: Host 'pb' is known and matches the ECDSA host key. debug1: Found key in /Users/romain/.ssh/known_hosts:18 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /Users/romain/.ssh/id_rsa debug1: Authentications that can continue: publickey,password debug1: Trying private key: /Users/romain/.ssh/id_dsa debug1: Trying private key: /Users/romain/.ssh/id_ecdsa debug1: Trying private key: /Users/romain/.ssh/id_ed25519 debug1: Next authentication method: password pduchesne@pb's password: debug1: Authentications that can continue: publickey,password Permission denied, please try again. pduchesne@pb's password: debug1: Authentications that can continue: publickey,password Permission denied, please try again. pduchesne@pb's password: debug1: Authentications that can continue: publickey,password debug1: No more authentication methods to try. Permission denied (publickey,password). 

BEARBEITEN 3

Benutzer pwd-Hash auf dem LDAP-Server hinzufügen (siehe Benutzerabbild am Anfang)

BEARBEITEN 4

Folgendem @ grawity-Vorschlag habe ich libpam-ldapd installiert:

romain@pb$ sudo apt-get install libpam-ldapd [sudo] password for romain: LDAP Password: The following packages were automatically installed and are no longer required: auth-client-config ldap-auth-config Use 'sudo apt autoremove' to remove them. The following packages will be REMOVED: libpam-ldap The following NEW packages will be installed: libpam-ldapd Do you want to continue? [Y/n] Y (...) Setting up libpam-ldapd:amd64 (0.9.6-3) ... 

Dann habe ich das konfiguriert, /etc/nslcd.confbei dem ich feststellte, dass ich nicht genau angegeben habe, ob ldap Version3 verwendet werden soll (ich weiß nicht, welche Version standardmäßig ist?):

romain@pb$ sudo cat /etc/nslcd.conf | grep "^[^#]" uid nslcd gid nslcd uri ldap://192.168.0.70 base dc=memorandum,dc=pro ldap_version 3 tls_cacertfile /etc/ssl/certs/ca-certificates.crt 

Neustart von nslcd:

romain@pb$ sudo service nslcd restart 

und versuchte von meinem Mac aus eine Verbindung herzustellen:

romain@Mac:~$ ssh pduchesne@pb 

was funktionierte ... irgendwie:

romain@Mac:~$ ssh pduchesne@pb pduchesne@pb's password: Welcome to Ubuntu 16.04.1 LTS (GNU/Linux 4.4.0-53-generic x86_64)  * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage  197 packages can be updated. 4 updates are security updates.  *** System restart required *** Last login: Fri Jan 13 11:12:23 2017 from 192.168.0.80 romain@pb:~$ pwd /home/users/pduchesne romain@pb:~$ whoami romain 

Neue Frage (für Edit 4)

Warum wechsle ich nicht den Benutzer? Ich habe erwartet, mich bei 'pb' als 'pduchesne' anzumelden: - /

Alte Frage (vor Edit 4)

Ich weiß nicht, welche Dateien geprüft werden müssen.