[Hardy][LDAP]client authentication broken

[fidel]

System:
Ubuntu 8.04.2
Release: 8.04

Possible Packages causing the problem:
libpam-ldap, libnss-ldap

Situation:
The affected machine should connect to a ldap server:

/etc/ldap/ldap.conf:
BASE dc=hektor,dc=nigel
URI ldap://hektor.nigel
TLS_CACERT /etc/ldap/ssl/hektor.pem
TLS_REQCERT never

/etc/ldap.conf:
host 192.168.0.1
base dc=hektor,dc=nigel
uri ldap://hektor.nigel/
ldap_version 3
rootbindn cn=admin,dc=hektor,dc=nigel
port 389
bind_policy soft
pam_password crypt
ssl start_tls
tls_checkpeer no
tls_cacertfile /etc/ldap/ssl/hektor.pem
nss_base_passwd ou=People,dc=hektor,dc=nigel
nss_base_shadow ou=People,dc=hektor,dc=nigel
nss_base_group ou=Group,dc=hektor,dc=nigel
nss_base_hosts ou=Hosts,dc=hektor,dc=nigel
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,daemon,dhcp,games,gdm,gnats,haldaemon,hplip,irc,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,polkituser,proxy,pulse,root,sshd,statd,sync,sys,syslog,uucp,www-data

/etc/pam.d/common-account:
account sufficient pam_ldap.so
account required pam_unix.so

/etc/pam.d/common-auth:
auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure use_first_pass

/etc/pam.d/common-password:
password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 md5

/etc/pam.d/common-session:
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/
session optional pam_ldap.so
session optional pam_foreground.so

Problem:
The mapped users / groups do not make sense, ldap authentication does not work:

$ id | grep users
uid=1001(mirjam) gid=1001(mirjam) Gruppen=4(adm),6(disk),10(wheel),11(floppy),18(audio),19(cdrom),20(dialout),24(cdrom),25(floppy),27(video),29(audio),30(dip),44(video),46(plugdev),60(mysql),80(cdrw),85(usb),100(users),107(fuse),109(lpadmin),115(admin),442(plugdev),1001(mirjam)
$ ls -lh | grep bilder
drwxrwx--- 21 fidel users 4.0K 2008-10-22 12:50 bilder
$ ls bilder
... Permission denied

Reproducable: Always

[Adam Sommer (asommer)]

Thank you for reporting this bug and helping make Ubuntu better. Can you post the contents of /etc/nsswitch.conf?

For LDAP authentication you will need to have entries similar to:

 passwd: files ldap
 group: files ldap
 shadow: files ldap

Thanks,
Adam

[fidel (fidel-daniels)]

Thanks for your reply!
This is exactly what /etc/nsswitch.conf contains! LDAP authentication
works on this ldap server with Gentoo Linux and Fedora 10 without
trouble. To be precise, the affected system is Ubuntu Hardy (8.04)
Tell me whatever you need, I will do my best to provide you with any
needed information!

Thanks!

Greets
Dave

Am Freitag, den 06.03.2009, 14:40 +0000 schrieb Adam Sommer:
> Thank you for reporting this bug and helping make Ubuntu better. Can
> you post the contents of /etc/nsswitch.conf?
>
> For LDAP authentication you will need to have entries similar to:
>
> passwd: files ldap
> group: files ldap
> shadow: files ldap
>
>
> Thanks,
> Adam
>

[Adam Sommer (asommer)]

Can you post the relevant lines of /var/log/auth.log when trying to login as a LDAP user?

[fidel (fidel-daniels)]

Hi
with pleasure, even though there is nothing relevant to ldap
authentication:

Mar 6 17:50:20 medulis sshd[4928]: Server listening on :: port 22.
Mar 6 17:50:21 medulis sshd[4928]: error: Bind to port 22 on 0.0.0.0
failed: Address already in use.
Mar 6 17:55:59 medulis sudo: root : TTY=unknown ; PWD=/ ;
USER=mirjam ; COMMAND=/usr/bin/gconftool
--get /system/http_proxy/use_http_proxy
Mar 6 17:55:59 medulis sudo: pam_unix(sudo:session): session opened for
user mirjam by (uid=0)
Mar 6 17:55:59 medulis sudo: pam_unix(sudo:session): session closed for
user mirjam
Mar 6 17:56:00 medulis sudo: root : TTY=unknown ; PWD=/ ;
USER=mirjam ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/host
Mar 6 17:56:00 medulis sudo: pam_unix(sudo:session): session opened for
user mirjam by (uid=0)
Mar 6 17:56:00 medulis sudo: pam_unix(sudo:session): session closed for
user mirjam
Mar 6 17:56:00 medulis sudo: root : TTY=unknown ; PWD=/ ;
USER=mirjam ; COMMAND=/usr/bin/gconftool --get /system/http_proxy/port
Mar 6 17:56:00 medulis sudo: pam_unix(sudo:session): session opened for
user mirjam by (uid=0)
Mar 6 17:56:00 medulis sudo: pam_unix(sudo:session): session closed for
user mirjam
Mar 6 18:17:01 medulis CRON[12599]: pam_unix(cron:session): session
opened for user root by (uid=0)
Mar 6 18:17:01 medulis CRON[12599]: pam_unix(cron:session): session
closed for user root
Mar 6 18:17:17 medulis gdm[5712]: pam_unix(gdm:session): session opened
for user mirjam by (uid=0)
Mar 6 19:09:15 medulis sshd[18307]: Accepted password for fidel from
192.168.0.50 port 52652 ssh2
Mar 6 19:09:15 medulis sshd[18313]: pam_unix(sshd:session): session
opened for user fidel by (uid=0)
Mar 6 19:09:20 medulis sudo: fidel : TTY=pts/0 ; PWD=/home/fidel ;
USER=root ; COMMAND=/bin/su -
Mar 6 19:09:20 medulis sudo: pam_unix(sudo:session): session opened for
user root by fidel(uid=0)
Mar 6 19:09:20 medulis sudo: pam_unix(sudo:session): session closed for
user root
Mar 6 19:09:20 medulis su[18385]: Successful su for root by root
Mar 6 19:09:20 medulis su[18385]: + pts/0 root:root
Mar 6 19:09:20 medulis su[18385]: pam_unix(su:session): session opened
for user root by fidel(uid=0)

Quite interesting though the fact, that only xscreensaver is connected
to the ldap server:
 # netstat -patu
Aktive Internetverbindungen (Server und stehende Verbindungen)
Proto Recv-Q Send-Q Local Address Foreign Address
State PID/Program name
tcp 0 0 *:37379 *:*
LISTEN 5374/rpc.statd
tcp 0 0 *:33093 *:*
LISTEN -
tcp 0 0 medulis.nigel:mysql *:*
LISTEN 5055/mysqld
tcp 0 0 *:sunrpc *:*
LISTEN 4306/portmap
tcp 0 0 *:ipp *:*
LISTEN 5177/cupsd
tcp 0 0 medulis.nigel:35861 mimas-nxge0.switch.:www
TIME_WAIT -
tcp 0 0 medulis.nigel:48330 192.168.0.1:ldap
VERBUNDEN 13265/xscreensaver
tcp 0 0 medulis.nigel:41590 84-75-125-185.dcl:imap2
VERBUNDEN 13453/evolution
tcp 0 0 medulis.nigel:56430 ns2.whoswe.ch:imap2
V...

[Adam Sommer (asommer)]

Ya, it's probably an issue with your PAM configuration. The easiest way to configure an Ubuntu client to authenticate using LDAP, is to use ldap-auth-config. The Ubuntu Server Guide for Intrepid includes instructions, and they should work for Hardy as well:

  https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html#openldap-auth-config

Before using ldap-auth-client and auth-client-config I would recommend making a backup of /etc/pam.d, /etc/nsswitch.conf, and /etc/ldap.conf.

Can you give that a try?

Thanks

[fidel (fidel-daniels)]

Thanks a lot for your help!
I will try that tomorrow (here in Switzerland its 21.15) and I will give
you response right away!
Thanks!
Greets
Dave

Am Freitag, den 06.03.2009, 18:42 +0000 schrieb Adam Sommer:
> Ya, it's probably an issue with your PAM configuration. The easiest way
> to configure an Ubuntu client to authenticate using LDAP, is to use
> ldap-auth-config. The Ubuntu Server Guide for Intrepid includes
> instructions, and they should work for Hardy as well:
>
> https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html
> #openldap-auth-config
>
> Before using ldap-auth-client and auth-client-config I would recommend
> making a backup of /etc/pam.d, /etc/nsswitch.conf, and /etc/ldap.conf.
>
> Can you give that a try?
>
> Thanks
>

[fidel (fidel-daniels)]

Unfortunately no openldap-auth-config is found. I got openldap-utils
installed, if I look for commands starting with auth, I can find
auth-client-config, authtool and authtool-gtk.
Neither authtool nor authtool-gtk works though:

 $ sudo authtool
Traceback (most recent call last):
  File "/usr/bin/authtool", line 306, in <module>
    at = AuthtoolCLI()
  File "/usr/bin/authtool", line 183, in __init__
    self.authtools = Authtools()
  File "/var/lib/python-support/python2.5/AuthTool/authtools.py", line
264, in __init__
    self.method_cfgs[method] = obj(self.cfg)
  File "/usr/share/authtool/auth_methods/kerberos/kerberos.py", line 50,
in __init__
    default_realm = self.db.get('krb5-config/default_realm')
  File "/var/lib/python-support/python2.5/AuthTool/authtools.py", line
192, in get
    return self.db.get(item)
  File "/usr/lib/python2.5/site-packages/debconf.py", line 60, in
<lambda>
    lambda *args, **kw: self.command(command, *args, **kw))
  File "/usr/lib/python2.5/site-packages/debconf.py", line 96, in
command
    raise DebconfError(status, data)
debconf.DebconfError: (10, "krb5-config/default_realm doesn't exist")

$ gksu authtool-gtk
/usr/lib/python2.5/site-packages/apt/__init__.py:18: FutureWarning: apt
API not stable yet warnings.warn("apt API not stable yet",
FutureWarning)
reWarning: apt API not stable yet

I probably need to reinstall this machine... and probably switch to
Intrepid anyway.

Thanks for your help!
Greets
Dave

Am Freitag, den 06.03.2009, 18:42 +0000 schrieb Adam Sommer:
> Ya, it's probably an issue with your PAM configuration. The easiest way
> to configure an Ubuntu client to authenticate using LDAP, is to use
> ldap-auth-config. The Ubuntu Server Guide for Intrepid includes
> instructions, and they should work for Hardy as well:
>
> https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html
> #openldap-auth-config
>
> Before using ldap-auth-client and auth-client-config I would recommend
> making a backup of /etc/pam.d, /etc/nsswitch.conf, and /etc/ldap.conf.
>
> Can you give that a try?
>
> Thanks
>

[Adam Sommer (asommer)]

On Sat, Mar 7, 2009 at 8:26 AM, fidel <email address hidden> wrote:

> Unfortunately no openldap-auth-config is found. I got openldap-utils
> installed, if I look for commands starting with auth, I can find
> auth-client-config, authtool and authtool-gtk.
> Neither authtool nor authtool-gtk works though:
>

The package is ldap-auth-config and not "openldap-auth-config". You should
be able to find it by:

  apt-cache search ldap-auth-config

If not then you may want to double check your apt sources in
/etc/apt/sources.list.

--
Party On,
Adam

[fidel (fidel-daniels)]

Hi Adam
there is no such tool:
$ sudo aptitude search ldap-auth-config
i ldap-auth-config - Config package for LDAP
authentication
$ sudo ldap-auth-config
sudo: ldap-auth-config: command not found
$ sudo su -
# ldap-auth-config
-su: ldap-auth-config: command not found
$ cat /etc/apt/sources.list | grep "^[^#]"
deb http://ch.archive.ubuntu.com/ubuntu/ hardy main restricted
deb-src http://ch.archive.ubuntu.com/ubuntu/ hardy main restricted
deb http://ch.archive.ubuntu.com/ubuntu/ hardy-updates main restricted
deb-src http://ch.archive.ubuntu.com/ubuntu/ hardy-updates main
restricted
deb http://ch.archive.ubuntu.com/ubuntu/ hardy universe
deb-src http://ch.archive.ubuntu.com/ubuntu/ hardy universe
deb http://ch.archive.ubuntu.com/ubuntu/ hardy-updates universe
deb-src http://ch.archive.ubuntu.com/ubuntu/ hardy-updates universe
deb http://ch.archive.ubuntu.com/ubuntu/ hardy multiverse
deb-src http://ch.archive.ubuntu.com/ubuntu/ hardy multiverse
deb http://ch.archive.ubuntu.com/ubuntu/ hardy-updates multiverse
deb-src http://ch.archive.ubuntu.com/ubuntu/ hardy-updates multiverse
deb http://security.ubuntu.com/ubuntu hardy-security main restricted
deb-src http://security.ubuntu.com/ubuntu hardy-security main restricted
deb http://security.ubuntu.com/ubuntu hardy-security universe
deb-src http://security.ubuntu.com/ubuntu hardy-security universe
deb http://security.ubuntu.com/ubuntu hardy-security multiverse
deb-src http://security.ubuntu.com/ubuntu hardy-security multiverse

I give up! This might be a f..... system, I will wipe it and reinstall
another one.

Thanks for your help and your patience!

Greets
Dave

Am Samstag, den 07.03.2009, 16:56 +0000 schrieb Adam Sommer:
> On Sat, Mar 7, 2009 at 8:26 AM, fidel <email address hidden> wrote:
>
> > Unfortunately no openldap-auth-config is found. I got openldap-utils
> > installed, if I look for commands starting with auth, I can find
> > auth-client-config, authtool and authtool-gtk.
> > Neither authtool nor authtool-gtk works though:
> >
>
>
> The package is ldap-auth-config and not "openldap-auth-config". You should
> be able to find it by:
>
> apt-cache search ldap-auth-config
>
> If not then you may want to double check your apt sources in
> /etc/apt/sources.list.
>
>
> --
> Party On,
> Adam
>

[Julien Plissonneau Duquene (julien-plissonneau-duquene)]

fidel,

ldap-auth-config exists and is even installed on your system.

Please follow the instructions at:
https://help.ubuntu.com/8.10/serverguide/C/openldap-server.html#openldap-auth-config

that is, run:
sudo dpkg-reconfigure ldap-auth-config
not just:
sudo ldap-auth-config

Thanks.

Marking as incomplete.

[xteejx (xteejx)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. We are sorry that we do not always have the capacity to look at all reported bugs in a timely manner.
There have been many changes in Ubuntu since that time you reported the bug and your problem may have been fixed with some of the updates. It would help us a lot if you could test the current Ubuntu version (10.04). If you can test it, and it is still an issue, we would appreciate if you could upload updated logs by running apport-collect <bug #>, and any other logs that are relevant for this particular issue.

[xteejx (xteejx)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!