aioshin Posted August 8, 2006 Report Share Posted August 8, 2006 (edited) ok, I have the LDAP server reside at Centos, and client on Mandriva boxs... I am able to login from the client using the users defined at LDAP server... now I want to allow each LDAP users to change their password by the command passwd but when trying that, it just gave the below error [ldapuser3@nixbox ~]$ passwd Changing password for user ldapuser3. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: New password: Re-enter new password: LDAP password information update failed: Can't contact LDAP server passwd: Permission denied [ldapuser3@nixbox ~]$ ok, here's my /etc/openldap/slapd.conf for add info include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 loglevel 296 pidfile /var/run/slapd.pid argsfile /var/run/slapd.args # database ldbm suffix "dc=duriancity,dc=dvo" rootdn "cn=ldapadmin,dc=duriancity,dc=dvo" rootpw {SSHA}POzRnaPcqsdffejfefedlacCVNuC7N99J3+u directory /var/lib/ldap/duriancity.dvo mode 0600 # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub and here's the entries on client pc's /etc/pam.d/system-auth #/etc/pam.d/system-auth #%PAM-1.0 auth required pam_env.so auth sufficient pam_unix.so auth sufficient pam_ldap.so likeauth nullok use_first_pass auth required pam_deny.so account sufficient pam_unix.so account sufficient pam_ldap.so use_first_pass account required pam_deny.so password required pam_cracklib.so retry=3 minlen=2 dcredit=0 ucredit=0 password sufficient pam_unix.so nullok use_authtok md5 shadow password sufficient pam_ldap.so password required pam_deny.so session optional pam_mkhomedir.so skel=/etc/skel/ umask=0022 session required pam_limits.so session required pam_unix.so session optional pam_ldap.so basically, by the above setup, the Mandriva Box allows local users and LDAP users to Login. . Now, any idea what should I put on my config to allow the user to change their password using the command passwd? TIA! Edited August 11, 2006 by aioshin Quote Link to comment Share on other sites More sharing options...
ianw1974 Posted August 8, 2006 Report Share Posted August 8, 2006 Maybe try: ldappasswd instead. Quote Link to comment Share on other sites More sharing options...
aioshin Posted August 8, 2006 Author Report Share Posted August 8, 2006 it wont, I still get this when doin ldappaswd ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) actually, the server is not yet configured to use ssl... should I have to configure ldap to use ssl first before I can allow users to password change? Quote Link to comment Share on other sites More sharing options...
ianw1974 Posted August 8, 2006 Report Share Posted August 8, 2006 I think if it's trying to communicate over SSL, it would need to be able to accept that type of connection. I'm presuming it's saslauthd service, so should be some sort of option within saslauthd config or even ldap config to ensure that SSL type connections are allowed. Unfortunately, I've not used ldap extensively, but I believe this would be the cause, from when I've had similar issues trying to get mysqld to authenticate logins with my postfix server. Quote Link to comment Share on other sites More sharing options...
aioshin Posted August 8, 2006 Author Report Share Posted August 8, 2006 here's the ldap.conf on my client mandriva box, part that pertains to ssl # Netscape SDK LDAPS #ssl on # Netscape SDK SSL options #sslpath /etc/ssl/certs/cert7.db # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 #ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". #tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert thus are commented, which means, ssl or whatever above has no effect since not in use... thanks ian.. maybe I should ggogle more for an answer Quote Link to comment Share on other sites More sharing options...
ianw1974 Posted August 8, 2006 Report Share Posted August 8, 2006 Once you've removed the comments, use: netstat -tan to make sure it's listening on port 636. I think you should only need to uncomment the OpenLDAP section. The way I read it you have two options. One to use SSL on the standard port with tls, or to use SSL with ldaps. Quote Link to comment Share on other sites More sharing options...
aioshin Posted August 11, 2006 Author Report Share Posted August 11, 2006 (edited) ok, the problem has been solved :D how? its an ACL issue. on my slapd.con, I added the ff: access to attr=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=duriancity,dc=dvo" write by * none access to * by self write by dn.base="cn=Manager,dc=duriancity,dc=dvo" write by * read Details below for the ACL above, taken from openldap docs - link As this is the first database, the controls also apply to entries not held in any database (such as the Root DSE). For all applicable entries, the userPassword attribute is writable by the entry itself and by the "admin" entry. It may be used for authentication/authorization purposes, but is otherwise not readable. All other attributes are writable by the entry and the "admin" entry, but may be read by all users (authenticated or not). the on the client box, I change /etc/pam.d/passwd: original file on mandrivaLE2005 #%PAM-1.0 auth required pam_stack.so service=system-auth account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth though with the above input on /etc/pam.d/passwd, the ldap user will be able to change its password using the passwd command but it will prompt to enter the password many times which is not normal... see below [ldapuser1001@nixbox ken]$ passwd Changing password for user ldapuser1001. Enter login(LDAP) password: New UNIX password: Retype new UNIX password: New password: Re-enter new password: LDAP password information changed for ldapuser1001 passwd: all authentication tokens updated successfully. then, i found out by googling that I have to change /etc/pam.d/passwd to something like below: password sufficient pam_ldap.so password required pam_unix.so nullok obscure min=4 max=8 then when ldapuser1001 try to change its password by the passwd command: [ldapuser1001@nixbox ken]$ passwd Changing password for user ldapuser1001. Enter login(LDAP) password: New password: Re-enter new password: LDAP password information changed for ldapuser1001 passwd: all authentication tokens updated successfully. its now behaving normally.. note that its a basic install... no tls, no ssl.. so all ldap traffic uses port 389... and Im really new unto it, so basically, not yet secure :D Edited August 11, 2006 by aioshin Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.