one more thing: firewalld service and selinux are deactivated. On 05/11/2015 07:06 PM, Ulrich Hiller wrote:> Hmmm...., i have made now a complete new install but the problem > persists: ldap authentication works, but the host attribute is ignored. > > I have installed CentOS7 64bit with KDE. > I did not do any 'yum update' or install of extra packages so far. > > these pam and ldap packages are installed: > openldap-devel-2.4.39-6.el7.x86_64 > openssh-ldap-6.6.1p1-11.el7.x86_64 > openldap-2.4.39-6.el7.x86_64 > python-ldap-2.4.15-2.el7.x86_64 > compat-openldap-2.3.43-5.el7.x86_64 > openldap-clients-2.4.39-6.el7.x86_64 > fprintd-pam-0.5.0-4.0.el7_0.x86_64 > gnome-keyring-pam-3.8.2-10.el7.x86_64 > pam-1.1.8-12.el7.x86_64 > > > I ran authconfig-tui and set "use ldap", "use md5 password", "use shadow > password", "use ldap authentication", "use tls", > "server=ldap://myldapserver.com", "basedn=o=XXX" > > my /etc/openldap/ldap.conf: > BASE o=XXX > URI ldap://myldapserver.com/ > TLS_CACERTDIR /etc/ssl/certs > SASL_NOCANON on > > My /etc/sssd/sssd.conf: > [domain/default] > ldap_uri = ldap://myldapserver.com/ > ldap_search_base = ou=YYY,o=XXX > ldap_schema = rfc2307bis > id_provider = ldap > ldap_user_uuid = entryuuid > ldap_group_uuid = entryuuid > ldap_id_use_start_tls = True > enumerate = False > cache_credentials = False > ldap_tls_cacertdir = /etc/openldap/cacerts/ > chpass_provider = ldap > auth_provider = ldap > ldap_tls_reqcert = never > ldap_user_search_base = ou=YYY,o=XXX > access_provider = ldap > ldap_access_order = host > ldap_user_authorized_host = host > autofs_provider = ldap > > [sssd] > services = nss, pam, autofs > config_file_version = 2 > domains = default > > [nss] > > [pam] > > [sudo] > > [autofs] > > [ssh] > > > > My /etc/pam.d/system-auth > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 200 quiet_success > auth sufficient pam_sss.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_succeed_if.so uid < 2000 quiet > account [default=bad success=ok user_unknown=ignore] pam_sss.so > account required pam_permit.so > > password requisite pam_pwquality.so try_first_pass > local_users_only retry=3 authtok_type> password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient pam_sss.so use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > -session optional pam_systemd.so > session [success=1 default=ignore] pam_succeed_if.so service in > crond quiet use_uid > session required pam_unix.so > session optional pam_sss.so > > My /etc/pam.d/password-auth: > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 200 quiet_success > auth sufficient pam_sss.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_succeed_if.so uid < 2000 quiet > account [default=bad success=ok user_unknown=ignore] pam_sss.so > account required pam_permit.so > > password requisite pam_pwquality.so try_first_pass > local_users_only retry=3 authtok_type> password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient pam_sss.so use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > -session optional pam_systemd.so > session [success=1 default=ignore] pam_succeed_if.so service in > crond quiet use_uid > session required pam_unix.so > session optional pam_sss.so > > > My /etc/nsswitch.conf: > passwd: files sss > shadow: files sss > group: files sss > hosts: files dns > bootparams: nisplus [NOTFOUND=return] files > ethers: files > netmasks: files > networks: files > protocols: files > rpc: files > services: files sss > netgroup: files sss > publickey: nisplus > automount: files sss > aliases: files nisplus > > nscd is NOT installed > > apart from the uid boundary interval in /etc/pam-d i left the files in > this directory as they were created by authconfig. I did not copy > anything from other systems. > > ldapsearch can read the user information. The user can again login, no > matter of the contence of the ldap's host attribute. > > I feel a bit embarrassed now. but ... does anybody have another idea? > > With kind regards, ulrich > > > > > >
I am still not understanding why your using MD5? Is it because everyone in InfoSec declared that everyone finally went from md5 to sha512 or what? -----Original Message----- From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of Ulrich Hiller Sent: Monday, May 11, 2015 1:40 PM To: CentOS mailing list Subject: Re: [CentOS] ldap host attribute is ignored one more thing: firewalld service and selinux are deactivated. On 05/11/2015 07:06 PM, Ulrich Hiller wrote:> Hmmm...., i have made now a complete new install but the problem > persists: ldap authentication works, but the host attribute is ignored. > > I have installed CentOS7 64bit with KDE. > I did not do any 'yum update' or install of extra packages so far. > > these pam and ldap packages are installed: > openldap-devel-2.4.39-6.el7.x86_64 > openssh-ldap-6.6.1p1-11.el7.x86_64 > openldap-2.4.39-6.el7.x86_64 > python-ldap-2.4.15-2.el7.x86_64 > compat-openldap-2.3.43-5.el7.x86_64 > openldap-clients-2.4.39-6.el7.x86_64 > fprintd-pam-0.5.0-4.0.el7_0.x86_64 > gnome-keyring-pam-3.8.2-10.el7.x86_64 > pam-1.1.8-12.el7.x86_64 > > > I ran authconfig-tui and set "use ldap", "use md5 password", "use > shadow password", "use ldap authentication", "use tls", > "server=ldap://myldapserver.com", "basedn=o=XXX" > > my /etc/openldap/ldap.conf: > BASE o=XXX > URI ldap://myldapserver.com/ > TLS_CACERTDIR /etc/ssl/certs > SASL_NOCANON on > > My /etc/sssd/sssd.conf: > [domain/default] > ldap_uri = ldap://myldapserver.com/ > ldap_search_base = ou=YYY,o=XXX > ldap_schema = rfc2307bis > id_provider = ldap > ldap_user_uuid = entryuuid > ldap_group_uuid = entryuuid > ldap_id_use_start_tls = True > enumerate = False > cache_credentials = False > ldap_tls_cacertdir = /etc/openldap/cacerts/ chpass_provider = ldap > auth_provider = ldap ldap_tls_reqcert = never ldap_user_search_base = > ou=YYY,o=XXX access_provider = ldap ldap_access_order = host > ldap_user_authorized_host = host autofs_provider = ldap > > [sssd] > services = nss, pam, autofs > config_file_version = 2 > domains = default > > [nss] > > [pam] > > [sudo] > > [autofs] > > [ssh] > > > > My /etc/pam.d/system-auth > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 200 quiet_success > auth sufficient pam_sss.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_succeed_if.so uid < 2000 quiet > account [default=bad success=ok user_unknown=ignore] pam_sss.so > account required pam_permit.so > > password requisite pam_pwquality.so try_first_pass > local_users_only retry=3 authtok_type> password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient pam_sss.so use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > -session optional pam_systemd.so > session [success=1 default=ignore] pam_succeed_if.so service in > crond quiet use_uid > session required pam_unix.so > session optional pam_sss.so > > My /etc/pam.d/password-auth: > #%PAM-1.0 > # This file is auto-generated. > # User changes will be destroyed the next time authconfig is run. > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > auth requisite pam_succeed_if.so uid >= 200 quiet_success > auth sufficient pam_sss.so use_first_pass > auth required pam_deny.so > > account required pam_unix.so broken_shadow > account sufficient pam_succeed_if.so uid < 2000 quiet > account [default=bad success=ok user_unknown=ignore] pam_sss.so > account required pam_permit.so > > password requisite pam_pwquality.so try_first_pass > local_users_only retry=3 authtok_type> password sufficient pam_unix.so md5 shadow nullok try_first_pass > use_authtok > password sufficient pam_sss.so use_authtok > password required pam_deny.so > > session optional pam_keyinit.so revoke > session required pam_limits.so > -session optional pam_systemd.so > session [success=1 default=ignore] pam_succeed_if.so service in > crond quiet use_uid > session required pam_unix.so > session optional pam_sss.so > > > My /etc/nsswitch.conf: > passwd: files sss > shadow: files sss > group: files sss > hosts: files dns > bootparams: nisplus [NOTFOUND=return] files > ethers: files > netmasks: files > networks: files > protocols: files > rpc: files > services: files sss > netgroup: files sss > publickey: nisplus > automount: files sss > aliases: files nisplus > > nscd is NOT installed > > apart from the uid boundary interval in /etc/pam-d i left the files in > this directory as they were created by authconfig. I did not copy > anything from other systems. > > ldapsearch can read the user information. The user can again login, no > matter of the contence of the ldap's host attribute. > > I feel a bit embarrassed now. but ... does anybody have another idea? > > With kind regards, ulrich > > > > > >_______________________________________________ CentOS mailing list CentOS at centos.org http://lists.centos.org/mailman/listinfo/centos
Ok, i deactivated md5 in authconfig. And the problem persists. But i do not see the relation to my problem. The authentication works like charm. It is only the ldap's host attribute which is ignored. With kind regards, ulrich On 05/11/2015 07:48 PM, Conley, Matthew M CTR GXM wrote:> I am still not understanding why your using MD5? Is it because everyone in InfoSec declared that everyone finally went from md5 to sha512 or what? > > > -----Original Message----- > From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of Ulrich Hiller > Sent: Monday, May 11, 2015 1:40 PM > To: CentOS mailing list > Subject: Re: [CentOS] ldap host attribute is ignored > > one more thing: firewalld service and selinux are deactivated. > > > On 05/11/2015 07:06 PM, Ulrich Hiller wrote: >> Hmmm...., i have made now a complete new install but the problem >> persists: ldap authentication works, but the host attribute is ignored. >> >> I have installed CentOS7 64bit with KDE. >> I did not do any 'yum update' or install of extra packages so far. >> >> these pam and ldap packages are installed: >> openldap-devel-2.4.39-6.el7.x86_64 >> openssh-ldap-6.6.1p1-11.el7.x86_64 >> openldap-2.4.39-6.el7.x86_64 >> python-ldap-2.4.15-2.el7.x86_64 >> compat-openldap-2.3.43-5.el7.x86_64 >> openldap-clients-2.4.39-6.el7.x86_64 >> fprintd-pam-0.5.0-4.0.el7_0.x86_64 >> gnome-keyring-pam-3.8.2-10.el7.x86_64 >> pam-1.1.8-12.el7.x86_64 >> >> >> I ran authconfig-tui and set "use ldap", "use md5 password", "use >> shadow password", "use ldap authentication", "use tls", >> "server=ldap://myldapserver.com", "basedn=o=XXX" >> >> my /etc/openldap/ldap.conf: >> BASE o=XXX >> URI ldap://myldapserver.com/ >> TLS_CACERTDIR /etc/ssl/certs >> SASL_NOCANON on >> >> My /etc/sssd/sssd.conf: >> [domain/default] >> ldap_uri = ldap://myldapserver.com/ >> ldap_search_base = ou=YYY,o=XXX >> ldap_schema = rfc2307bis >> id_provider = ldap >> ldap_user_uuid = entryuuid >> ldap_group_uuid = entryuuid >> ldap_id_use_start_tls = True >> enumerate = False >> cache_credentials = False >> ldap_tls_cacertdir = /etc/openldap/cacerts/ chpass_provider = ldap >> auth_provider = ldap ldap_tls_reqcert = never ldap_user_search_base = >> ou=YYY,o=XXX access_provider = ldap ldap_access_order = host >> ldap_user_authorized_host = host autofs_provider = ldap >> >> [sssd] >> services = nss, pam, autofs >> config_file_version = 2 >> domains = default >> >> [nss] >> >> [pam] >> >> [sudo] >> >> [autofs] >> >> [ssh] >> >> >> >> My /etc/pam.d/system-auth >> #%PAM-1.0 >> # This file is auto-generated. >> # User changes will be destroyed the next time authconfig is run. >> auth required pam_env.so >> auth sufficient pam_unix.so nullok try_first_pass >> auth requisite pam_succeed_if.so uid >= 200 quiet_success >> auth sufficient pam_sss.so use_first_pass >> auth required pam_deny.so >> >> account required pam_unix.so broken_shadow >> account sufficient pam_succeed_if.so uid < 2000 quiet >> account [default=bad success=ok user_unknown=ignore] pam_sss.so >> account required pam_permit.so >> >> password requisite pam_pwquality.so try_first_pass >> local_users_only retry=3 authtok_type>> password sufficient pam_unix.so md5 shadow nullok try_first_pass >> use_authtok >> password sufficient pam_sss.so use_authtok >> password required pam_deny.so >> >> session optional pam_keyinit.so revoke >> session required pam_limits.so >> -session optional pam_systemd.so >> session [success=1 default=ignore] pam_succeed_if.so service in >> crond quiet use_uid >> session required pam_unix.so >> session optional pam_sss.so >> >> My /etc/pam.d/password-auth: >> #%PAM-1.0 >> # This file is auto-generated. >> # User changes will be destroyed the next time authconfig is run. >> auth required pam_env.so >> auth sufficient pam_unix.so nullok try_first_pass >> auth requisite pam_succeed_if.so uid >= 200 quiet_success >> auth sufficient pam_sss.so use_first_pass >> auth required pam_deny.so >> >> account required pam_unix.so broken_shadow >> account sufficient pam_succeed_if.so uid < 2000 quiet >> account [default=bad success=ok user_unknown=ignore] pam_sss.so >> account required pam_permit.so >> >> password requisite pam_pwquality.so try_first_pass >> local_users_only retry=3 authtok_type>> password sufficient pam_unix.so md5 shadow nullok try_first_pass >> use_authtok >> password sufficient pam_sss.so use_authtok >> password required pam_deny.so >> >> session optional pam_keyinit.so revoke >> session required pam_limits.so >> -session optional pam_systemd.so >> session [success=1 default=ignore] pam_succeed_if.so service in >> crond quiet use_uid >> session required pam_unix.so >> session optional pam_sss.so >> >> >> My /etc/nsswitch.conf: >> passwd: files sss >> shadow: files sss >> group: files sss >> hosts: files dns >> bootparams: nisplus [NOTFOUND=return] files >> ethers: files >> netmasks: files >> networks: files >> protocols: files >> rpc: files >> services: files sss >> netgroup: files sss >> publickey: nisplus >> automount: files sss >> aliases: files nisplus >> >> nscd is NOT installed >> >> apart from the uid boundary interval in /etc/pam-d i left the files in >> this directory as they were created by authconfig. I did not copy >> anything from other systems. >> >> ldapsearch can read the user information. The user can again login, no >> matter of the contence of the ldap's host attribute. >> >> I feel a bit embarrassed now. but ... does anybody have another idea? >> >> With kind regards, ulrich >> >> >> >> >> >> > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > > > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >