Re: pam services under LDAP

[bluethundr <bluethundr@gmail.com>]

I have created a symlink from /etc/openldap/ldap.conf to
/etc/ldap.conf... that seems to have gotten the majority of the system
communicating with PAM/LDAP. I guess that making a .ldaprc file in the
users home directory and putting those directives in there would be
about the equivalent.

The only thing eluding me currently is getting the client to listen to
sudoers which is currently working thru ldap on the ldap server
itself.

 [root@VIRCENT03:~]#cat /etc/pam.d/sudo
#%PAM-1.0
auth       include      system-auth
auth       required     pam_ldap.so
account    include      system-auth
account    required     pam_ldap.so
password   include      system-auth
password   required     pam_ldap.so
session    optional     pam_keyinit.so revoke
session    required     pam_limits.so
session    required     pam_ldap.so


AFAIK the above should get pam_ldap communicating with the LDAP server
on the behalf of sudoers. the other pam configs (such as sshd and su)
appear to be getting their info from the system auth which is
currently communicating with the LDAP server.

Does anyone have any tips on how to get sudoers working through pam /ldap?

thanks!!

On Mon, Nov 8, 2010 at 4:29 PM, Aaron Richton <richton@nbcs.rutgers.edu> wrote:
> On Mon, 8 Nov 2010, bluethundr wrote:
>
>> [root@VIRCENT03:~]#cat /etc/openldap/ldap.conf
>
> [...]
>>
>> TLS_CACERTDIR /etc/openldap/cacerts
>> sudoers_base ou=sudoers,ou=Services,dc=acadaca,dc=net
>
> I don't believe that "sudoers_base" is a recognized OpenLDAP configuration
> directive. As such, this line may belong in a file other than
> "/etc/openldap/ldap.conf" on your system.
>
>



-- 
Here's my RSA Public key:
gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9

Share and enjoy!!