ldap.conf: uri vs host

yurii · 03-25-2008, 11:36 AM

i've set up ldap authentication (authconfig(8)) in RHEL 3 (Red Hat Enterprise Linux WS release 3 (Taroon Update 5)).
the result ldap.conf is:

Code:

base                    dc=my,dc=net,dc=domain
ldap_version            3
scope                   sub

# sesision configuration
pam_password            md5
pam_filter              objectClass=posixAccount
pam_login_attribute     uid
pam_filter              !(uidNumber=0)
pam_member_attribute    memberUid

nss_base_passwd         dc=my,dc=net,dc=domain?sub?objectClass=posixAccount
nss_base_shadow         dc=my,dc=net,dc=domain?sub?objectClass=posixAccount
nss_base_group          dc=my,dc=net,dc=domain?sub?objectClass=posixGroup

ssl                     no
host                    ldap.my.net.domain

that works fine.
but when i'm using uri instead of host, i.e.:

Code:

uri                     ldap://ldap.my.net.domain/

i cannot authenticate neither via su(1), login(1) nor via ssh(1).

can anybody explain what is the difference between uri and host in ldap.conf?

gizza23 · 03-25-2008, 09:00 PM

yurii,

I must tell you that I'm very happy I ran across your post. Although I can't help you with your problem, you helped me fix mine where I couldn't log in using ssh, su, or even chown and like commands. After I edited my ldap.conf file everything fell into place. Amazing!

Thanks!!!!

gizza23 · 03-25-2008, 09:11 PM

Oh, and I don't know if this will help in your case, but you may want to edit your /etc/hosts.allow to look like the following:

Quote:

localhost
127.0.0.1

I've also seen the following

Quote:

slapd:all

From what I understand, it allows hosts to access uri addresses like the one you're referencing above

yurii · 03-26-2008, 05:31 AM

Quote:

Originally Posted by gizza23

Oh, and I don't know if this will help in your case, but you may want to edit your /etc/hosts.allow to look like the following:

I've also seen the following

From what I understand, it allows hosts to access uri addresses like the one you're referencing above

really do not understand why and how slapd:all relates to uri?
but glad to help you

gizza23 · 03-26-2008, 07:17 AM

Supposedly adding slapd:all to /etc/hosts.allow will allow hosts from any IP address to the uri address for slapd.

However, if you feel it won't help you then nevermind! Have a good one.