HowTO: Setup an LDAP Server CentOS 6.3

chylarides · Mar 19, 2013

Hey,

Any update on group access permissions? I added the following lines to the client's sssd.conf but it doesn't seem to work:

ldap_access_filter = memberOf=cn=operations,ou=Group,dc=example,dc=com
ldap_access_order = filter, host, authorized_service

Can anybody help out here?

minfo · Mar 22, 2013

Stratus_ss, Thanks for this awesome toutorial.

I have been searching, testing and searching more, combining guides, trying one guide to work with another when one does not work.

I tried First the one from 2012, got some errors and I read all the posts, trying it to work. Then I stompled on a URL to this updated guide. Worked like a sharm the first try. Thanks!

This got me to join this forum. This will be my first post.

C yaa around!

Stratus_ss · Mar 23, 2013

Glad you got sorted. While I (we) can't help everyone we do at least try. Sometimes my work does not afford me the time to try and debug everyone's problems so some questions do go unanswered

Anyways welcome to the forums. Many happy returns

:comp:

chhym · Apr 10, 2013

Battled with changing user passwords for a long time.
Created a password.ldif that may have helped but the main changed was with /etc/pam_ldap.conf on the client.

Added:
rootbinddn cn=manager,dc=vine,dc=local
bindpw=secret

and put the password in
/etc/pam_ldap.secret

Then a
chmod 600 /etc/pam_ldap.secret

Stratus_ss · Apr 10, 2013

thanks for posting back. Its always great when people post their own fixes in the thread to help others

marcusone · May 22, 2013

Thanks for the great guide and setup script!
I've borrowed a bunch of it and made my own guide that seems to work a bit smoother (no offense), really just the last section to enable authentication on CentOS 6.4 by just using SSSD

http://www.refamco.ca/14-centos-6-4-ldap-authentication

Stratus_ss · May 22, 2013

well I am glad you found it helpful,

Though I am not sure what you mean by "clean" using the authconfig-tui vs authconfig makes very little difference. Other than that I am advising double checking certs and ensuring that home directories are created. Very little difference from your tutorial

marcusone · May 22, 2013

Stratus_ss said:
well I am glad you found it helpful,

Though I am not sure what you mean by "clean" using the authconfig-tui vs authconfig makes very little difference. Other than that I am advising double checking certs and ensuring that home directories are created. Very little difference from your tutorial

"Clean" ? the authconfig method is just another way to do it that I found in another guide.

I just complied your guide (that is great for LDAP setup in general) with the guide(s) I found for SSSD setup (one doesn't need to install anything related to pam, etc (pam_ldap nss-pam-ldapd pam_krb5 are not needed) and the other guide i found says to not use them period.

Again, thank you for your article! I would still be stuck getting LDAP/TLS running if it were not for you!

FS9 · Jun 12, 2013

Thanks Stratus_ss

its clear, works great

Stratus_ss · Jun 12, 2013

Glad it was helpful!

mattz · Jul 8, 2013

Hey Stratus_ss,

I am currently on the ldapadd part and I get

Enter LDAP Password:

I put password since i set all my passwords to "password"

ldap_bing: Invalid credentials (49)

sukumar · Oct 18, 2013

in ldap server configuration

after running the script it is asking the password. please suggest

Enter Password or Pin for "NSS Certificate DB":
Enter Password or Pin for "NSS Certificate DB":

Stratus_ss · Oct 18, 2013

hi sukumar

The script should have set those passwords to "password", however if it did not set those passwords to something you will remember

babinlonston · Aug 26, 2014

This same steps won't work in Centos 6.5 ?, Tried several times Server setups works perfect while client side configuration done tried su - babin this gives always user not exist

Stratus_ss · Aug 26, 2014

Its hard to help you when you dont provide any meaningful output.

I know that my LDAP server is running fine on CentOS 6.5, however I did not tear it down and build it back up, its been upgraded since 6.3.

It sounds like the client is missing ldap.conf or some ldap related information. When you do an ldap search from the client what do you get?

babinlonston · Aug 26, 2014

While doing a search i got the below, and its take more than 3 minutes to get this error..

[root@client ~]# ldapsearch -x -b 'o=babin'

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

This is the log which i got from ldap server.

[root@ldap sssd]# tail -f *
==> ldap_child.log <==

==> sssd_default.log <==
(Tue Aug 26 17:03:05 2014) [sssd[be[default]]] [main] (0x0010): Could not initialize backend [22]
(Tue Aug 26 17:03:05 2014) [sssd[be[default]]] [load_backend_module] (0x0010): Error (22) in module (ldap) initialization (sssm_ldap_id_init)!
(Tue Aug 26 17:03:05 2014) [sssd[be[default]]] [be_process_init] (0x0010): fatal error initializing data providers
(Tue Aug 26 17:03:05 2014) [sssd[be[default]]] [main] (0x0010): Could not initialize backend [22]
(Tue Aug 26 17:03:07 2014) [sssd[be[default]]] [load_backend_module] (0x0010): Error (22) in module (ldap) initialization (sssm_ldap_id_init)!
(Tue Aug 26 17:03:07 2014) [sssd[be[default]]] [be_process_init] (0x0010): fatal error initializing data providers
(Tue Aug 26 17:03:07 2014) [sssd[be[default]]] [main] (0x0010): Could not initialize backend [22]
(Tue Aug 26 17:03:11 2014) [sssd[be[default]]] [load_backend_module] (0x0010): Error (22) in module (ldap) initialization (sssm_ldap_id_init)!
(Tue Aug 26 17:03:11 2014) [sssd[be[default]]] [be_process_init] (0x0010): fatal error initializing data providers
(Tue Aug 26 17:03:11 2014) [sssd[be[default]]] [main] (0x0010): Could not initialize backend [22]

==> sssd.log <==
(Tue Aug 26 17:03:11 2014) [sssd] [mt_svc_exit_handler] (0x0010): Process [default], definitely stopped!
(Tue Aug 26 17:26:24 2014) [sssd] [mt_svc_sigkill] (0x0010): [default][2021] is not responding to SIGTERM. Sending SIGKILL.

==> sssd_nss.log <==
(Tue Aug 26 17:03:10 2014) [sssd[nss]] [sss_dp_init] (0x0010): Failed to connect to monitor services.
(Tue Aug 26 17:03:10 2014) [sssd[nss]] [sss_process_init] (0x0010): fatal error setting up backend connector
(Tue Aug 26 17:03:10 2014) [sssd[nss]] [sss_dp_init] (0x0010): Failed to connect to monitor services.
(Tue Aug 26 17:03:10 2014) [sssd[nss]] [sss_process_init] (0x0010): fatal error setting up backend connector

==> sssd_pam.log <==
(Tue Aug 26 17:03:10 2014) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services.
(Tue Aug 26 17:03:10 2014) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector
(Tue Aug 26 17:03:10 2014) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services.
(Tue Aug 26 17:03:10 2014) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector

But same while i have a look into client machine logs i cant see anything.

Stratus_ss · Aug 27, 2014

babinlonston said:
While doing a search i got the below, and its take more than 3 minutes to get this error..

When you get this it definitely means there is a problem with the client (or possibly a client and/or server firewall)

Does the ldap search work on the server itself?

What do your ldap files look like on the client?

Do you have iptables running?

SELinux?

babinlonston · Aug 27, 2014

Thanks for the quick response

Stratus_ss said:
When you get this it definitely means there is a problem with the client (or possibly a client and/or server firewall)

Does the ldap search work on the server itself?

What do your ldap files look like on the client?

Do you have iptables running?

SELinux?

Does the ldap search work on the server itself?

yes its search itself and working.

Does the ldap search work on the server itself?

i don't understand this question

Do you have iptables running?

yes there iptables are applied and even i have checked using a IPtables flush

Yes selinux is there too.

babinlonston · Aug 27, 2014

Hi,

Just now i have done a fresh install both ldap and one of client machine still i have the same issue, in both machines i have flushed the iptables, and disabled the selinux before starting the installation . Before 8 months back i did the same steps and its worked perfect in centos 6.3.

While Running this in Server i got the below reply

[root@ldap ~]# ldapsearch -x -b 'o=babin'
# extended LDIF
#
# LDAPv3
# base <o=babin> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 32 No such object

# numResponses: 1
[root@ldap ~]#

While the same running in Client machine i got this

[root@babin ~]# ldapsearch -x -b 'o=babin'
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

Just tried using a debug level in server

[root@ldap ~]# ldapsearch -d 1 -v -H ldaps://babin:636
ldap_url_parse_ext(ldaps://babin:636)
ldap_initialize( ldaps://babin:636/??base )
ldap_create
ldap_url_parse_ext(ldaps://babin:636/??base)
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP babin:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 210.11.232.21:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_close_socket: 3
ldap_err2string
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

Same debug level run in client and i got this

[root@client ~]# ldapsearch -d 1 -v -H ldaps://babin:636
ldap_url_parse_ext(ldaps://babin:636)
ldap_initialize( ldaps://babin:636/??base )
ldap_create
ldap_url_parse_ext(ldaps://babin:636/??base)
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP babin:636
ldap_connect_to_host: getaddrinfo failed: Name or service not known
ldap_err2string
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

I cant able to ping from both machine each other.

While looking logs in clients show the below

[root@client ~]# tail -f /var/log/sssd/*
==> /var/log/sssd/ldap_child.log <==

==> /var/log/sssd/sssd_default.log <==

==> /var/log/sssd/sssd.log <==

==> /var/log/sssd/sssd_nss.log <==

==> /var/log/sssd/sssd_pam.log <==

Ports are even open in server
-----------------------------

[root@ldap ~]# netstat -tunlp | grep 636
tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 25532/slapd
tcp 0 0 :::636 :::* LISTEN

Stratus_ss · Aug 29, 2014

This seems to be your problem:

Code:

 ldap_connect_to_host: getaddrinfo failed: Name or service not known

This indicates to me that you have a DNS issue. Try doing the search via IP

HowTO: Setup an LDAP Server CentOS 6.3

New Member

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

Overclockix Snake Charming Senior, Alt OS Content

New Member

New Member

Overclockix Snake Charming Senior, Alt OS Content

Similar threads