Otdfbt

I have this error when I ssh to my LDAP client using the login name on the LDAP server
my LDAP client's running Ubuntu 9.10 Karmic
my LDAP server is Fedora Core 4 and running Fedora Directory Server

ssh billyduc@ldap-client.mydomain.com
cat /var/log/auth.log //on the client
Dec 18 10:24:17 ubuntu-ltsp sshd[4527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=billyhost.local user=billyduc
Dec 18 10:24:17 ubuntu-ltsp sshd[4527]: pam_ldap: error trying to bind as user "uid=billyduc,dc=mydomain,dc=com" (Invalid credentials)
Dec 18 10:24:18 ubuntu-ltsp sshd[4527]: Failed password for billyduc from 192.168.5.121 port 51449 ssh2

Here's my /etc/pam.d/sshd

cat /etc/pam.d/sshd
auth [success=1 default=ignore] pam_unix.so
auth required pam_ldap.so use_first_pass
auth required pam_permit.so
account sufficient pam_permit.so

I also edit my /etc/ssh/sshd_config in both client and Server

PasswordAuthentication yes

So I think something wrong with the password when the ssh server do checking

This looks like a problem with pam_ldap, not your PAM setup for ssh.

The logs indicate that the configuration translated the username billyduc into the LDAP DN uid=billyduc,dc=mydomain,dc=com but encountered an Invalid credentials error when using the password provided to authenticate to that account.

You should check:

• That this is indeed the right DN for user billyduc in the LDAP server. If not, change the pam_ldap configuration on the client.


• That the server is configured to allow that DN to bind. Check this using a simple LDAP client, like ldapsearch on the command line or Apache Directory Studio.

If this doesn't help, you should add your pam_ldap configuration and your LDAP server configuration to the question.

On my case if it could help, I forgot to add the ldap module into /etc/nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: compat ldap
group: compat ldap
shadow: compat ldap
gshadow: files ldap