无法通过PAM和ldap登录:无法获得密码
无法通过PAM和ldap登录:无法获得密码
提问于 2015-12-04 22:43:02
我试图让OpenVPN通过LDAP将用户身份验证到Active服务器上。
下面是配置文件的相关部分：
/etc/openvpn/server.conf：
# ...
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so ldap-login/etc/nslcd.conf
uri ldap://prod-adc1.mydomain.local
base DC=MyDomain,DC=Local
uid nslcd
gid ldap/etc/pam.d/ldap-login
auth sufficient pam_ldap.so minimum_uid=1000 use_first_pass
auth required pam_deny.so
password sufficient pam_ldap.so minimum_uid=1000 use_first_pass
password required pam_deny.so当我尝试身份验证时，我会在日志中看到以下内容：
/var/log/secure
Dec 4 22:22:42 localhost openvpn[25505]: pam_ldap(ldap-login:auth): failed to get password: Authentication failure/var/log/messages
Dec 4 22:38:28 localhost openvpn[25504]: 1.2.3.4:37503 TLS: Initial packet from [AF_INET]1.2.3.4:37503, sid=c2d806cc 5c7c7ace
Dec 4 22:38:28 localhost openvpn[25504]: 1.2.3.4:37503 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Dec 4 22:38:28 localhost openvpn[25504]: 1.2.3.4:37503 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so
Dec 4 22:38:28 localhost openvpn[25504]: 1.2.3.4:37503 TLS Auth Error: Auth Username/Password verification failed for peer
Dec 4 22:38:28 localhost openvpn[25504]: 1.2.3.4:37503 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384
Dec 4 22:38:28 localhost openvpn[25504]: 1.2.3.4:37503 Peer Connection Initiated with [AF_INET]1.2.3.4:37503
Dec 4 22:38:31 localhost openvpn[25504]: 1.2.3.4:37503 PUSH: Received control message: 'PUSH_REQUEST'
Dec 4 22:38:31 localhost openvpn[25504]: 1.2.3.4:37503 Delayed exit in 5 seconds
Dec 4 22:38:31 localhost openvpn[25504]: 1.2.3.4:37503 SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
Dec 4 22:38:36 localhost openvpn[25504]: 1.2.3.4:37503 SIGTERM[soft,delayed-exit] received, client-instance exiting我配置PAM错误了吗？我的登录配置中缺少什么东西吗？
编辑:如果我做了以下操作，我就可以登录：
ldapsearch -h prod-adc1.mydomain.local -b "DC=MyDomain,DC=Local" -x -D "naftuli.kay@mydomain.com" -W如何将此映射到PAM模块以使OpenVPN登录按预期工作？
回答 2
Server Fault用户
发布于 2015-12-04 23:37:51
看起来，您需要使用/etc/nslcd.conf和bindpw配置binddn。
请参阅http://arthurdejong.org/nss-pam-ldapd/nslcd.conf.5
希望这能有所帮助！
-Byron
Server Fault用户
发布于 2015-12-13 07:22:08
工作设置示例(仅针对LDAP服务器授权用户，在我使用OpenLDAP的示例中，但在此模块openvpn-auth-ldap.so中也支持AD )：
openvpn-sc.conf：
# Authorization against LDAP
plugin /usr/lib64/openvpn-auth-ldap.so /some/path/auth-ldap.conf8月-ldap.conf：
<LDAP>
# LDAP server URL
URL ldap://server.intranet.eko-inwest.com.pl:389
# Bind DN (If your LDAP server doesn’t support anonymous binds)
# BindDN uid=administrator,ou=users,dc=x,dc=y
# BindDN uid=admin,ou=Users,dc=x,dc=y
# BindDN admin@test.com
# Network timeout (in seconds)
Timeout 15
# Enable Start TLS
TLSEnable no
# TLS CA Certificate File
# TLSCACertFile /etc/ssl/ca.x.y.crt
</LDAP>
<Authorization>
# Base DN
BaseDN "ou=users,dc=x,dc=y"
# User Search Filter
#SearchFilter "(uid=%u)"
#SearchFilter "(&(uid=%u)(objectclass=posixAccount))"
# For Samba's schema
SearchFilter "(&(uid=%u)(!(sambaAcctFlags=[DUL ])))"
# Require Group Membership
RequireGroup true
# Add non-group members to a PF table (disabled)
# PFTable vpn-users
<Group>
# Match full user DN if true, uid only if false
RFC2307bis false
BaseDN "ou=groups,dc=x,dc=y"
SearchFilter "(cn=vpn-users)"
MemberAttribute memberUid
</Group>
</Authorization>页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://serverfault.com/questions/740907
复制相关文章
相似问题
腾讯云开发者
