Система RedHat 9
Настроил сервер LDAP,
Вот параметры доступа к LDAP каталогу
---------------start------------------------
# users can authenticate and change their password
access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by dn="cn=nssldap,ou=DSA,dc=idealx,dc=org" write
by self write
by anonymous auth
by * none
# some attributes need to be readable anonymously so that 'id user' can answer correctly
access to attrs=objectClass,entry,gecos,homeDirectory,uid,uidNumber,gidNumber,cn,memberUid
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by * read
# somme attributes can be writable by users themselves
access to attrs=description,telephoneNumber
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by self write
by * read
# some attributes need to be writable for samba
access to attrs=cn,sambaLMPassword,sambaNTPassword,sambaPwdLastSet,sambaLogonTime,sambaLogoffTime,sambaKickoffTime,sambaPwdCanChange,sambaPwdMustChange,sambaAcctFlags,displayName,sambaHomePath,sambaHomeDrive,sambaLogonScript,sambaProfilePath,description,sambaUserWorkstations,sambaPrimaryGroupSID,sambaDomainName,sambaSID,sambaGroupType,sambaNextRid,sambaNextGroupRid,sambaNextUserRid,sambaAlgorithmicRidBase
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by self read
by * none
# samba need to be able to create the samba domain account
access to dn.base="dc=idealx,dc=org"
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by * none
# samba need to be able to create new users account
access to dn="ou=Users,dc=idealx,dc=org"
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by * none
# samba need to be able to create new groups account
access to dn="ou=Groups,dc=idealx,dc=org"
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by * none
# samba need to be able to create new computers account
access to dn="ou=Computers,dc=idealx,dc=org"
by dn="cn=samba,ou=DSA,dc=idealx,dc=org" write
by dn="cn=smbldap-tools,ou=DSA,dc=idealx,dc=org" write
by * none
# this can be omitted but we leave it: there could be other branch
# in the directory
access to *
by self read
by * none
--------------------------end-------------------------
прописал в /etc/nsswitch.conf
-----------start-------------
passwd: files ldap
shadow: files ldap
group: files ldap
-----------end------------------
Добавил в /etc/ldap.conf
-------------start-------------------------
host 127.0.0.1
base dc=IDEALX,dc=ORG
nss_base_passwd dc=IDEALX,dc=ORG?sub
nss_base_shadow dc=IDEALX,dc=ORG?sub
nss_base_group ou=Groups,dc=IDEALX,dc=ORG?one
rootbinddn cn=nssldap,ou=DSA,dc=IDEALX,dc=ORG
ssl no
pam_password md5
---------------end--------------------------
Указал пароль nssldap в файле /etc/ldap.secret
В файл system-auth добавил строки для возможности проходить аутоинтентификацию с использованием LDAP (pam_ldap)
С помощью smbldap-tools scripts создал пользователей системы в LDAP каталоге.
Все прошло без проблем.
Далее попытался залогиниться по именем вновь созданного пользователя.
И на этом все:((
система не пускает в логах следующее:
pam_ldap: error trying to bind (Invalid credentials)
Illegal user
Вот такие грабли и где этот Invalid credentials? Помогите разобраться.
|
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
on
21-Окт-04, 13:24 (MSK)
