Problem with ldap client gets me crazy

mikmik · 03-15-2013, 04:12 AM

Hi,

I'm trying to setup a debian 6 to authenticate users against an ldap server. I have another machine (also debian 6) with apparently the same config and packages, and it works (I didn't configure this machine).
I'm running out of ideas.
The principal clue is this line in /var/log/auth:

pam_ldap: ldap_simple_bind Can't contact LDAP server
pam_ldap: reconnecting to LDAP server...
ldap_simple_bind Can't contact LDAP server
sshd[2122]: pam_unix(sshd:auth): authentication failure;...

This seems to be a network or connection problem, but the 'getent passwd' command works perfectly and returns the user list at ldap server. Also, performing an ldapsearch works perfectly. Very weird.
The libnss-ldap.conf, libnss-ldap.secret and /etc/pam.d/* files are the same that the machine that is working fine.
The logs at the ldap server are very very longs and gets me confused. I don't see anything relevant.

I don't understand this.

Any help/idea is really appreciated.

Regards.

acid_kewpie · 03-15-2013, 04:26 AM

I'd guess the server is just not defined correctly in the ldap config file. I don't know how debian configures this tbh, but on rhel6+ ldap details for information is in a separate file to pam details. Run a tcpdump when logging in to see the tcp data flow... "tcpdump -vn -i eth0 port 389"

mikmik · 03-15-2013, 04:29 AM

thanks for the reply. I did that test. I can see data flow with tcpdump. Also, the getent and ldapsearch works fine

acid_kewpie · 03-15-2013, 04:49 AM

OK, so if it IS connecting, then capture the traffic and look at it in wireshark (add the options "-s0 -w somefile.cap" to store all data to a file) It will probably be very clear what the issue is as the ldap protocol level, even if you don't understand LDAP, wireshark decodes and describes things very well.

mikmik · 03-15-2013, 05:05 AM

shit. My foult. It's solved. When I tried to login, I saw traffic with tcpdump, so I supposed that there were no connectivity issues. But that flow was only to get uid or something similar, not for auth. The /etc/pam_ldap.conf was not configured properly, so the auth was not working. That's why getent and ldapsearch worked, but not auth step.

Thank you very much for your time.

Regards.