Re: nssov overlay and hostservice

[ben thielsen <btb@bitrate.net>]

On Feb 05, 2010, at 11.59, Kyle Robinson wrote:

> On Thu, Feb 4, 2010 at 7:26 PM, ben thielsen <btb@bitrate.net> wrote:
> 
>> hi
>> 
>> i'm experimenting with the nssov overlay, and am trying to get the
>> hostservice approach working as described in man 5 slapo-nssov.  i'm using
>> slapd 2.4.18 and the 0.6.11 nss-pam-ldapd stub libraries, both via ubuntu
>> packages.
>> 

...

>> 
>> ssh test:
>>> ssh luna@under.groundnoise.net hostname --fqdn
>> luna@under.groundnoise.net's password:
>> under.groundnoise.net
>> 
>> i'm hoping someone can point out what i'm missing or what i might be doing
>> wrong.
>> 
>> thanks,
>> -ben
> 
> 
> Turn on debug for pam_unix and pam_ldap in the auth section and check syslog
> to make sure it isn't actually pam_unix doing the auth via nss passwd hash.

i'm fairly confident that auth isn't happening via pam_unix / nss passwd hash.  if i remove the auth line for pam_ldap from the pam config (leaving only pam_unix), authentication fails (other users in local passwd/shadow flat files still work).  i also see, in the logs, a pam_unix failure "sshd[10978]: pam_unix(sshd:auth): authentication failure;" prior to success by the ldap module each time authentication occurs.

the debug option for the pam_ldap stub library from nss-pam-ldapd is ignored, according to the man page, and adding either debug or audit to pam_unix didn't seem to generate any additional log data.  there is plenty of activity in the slap log file, just not the compare operations that i was expecting to see, based on my interpretation of the man page for slapo-nssov.