From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <john@rmts.donpac.ru>
Message-ID: <407E6671.3060309@rmts.donpac.ru>
Date: Thu, 15 Apr 2004 14:39:45 +0400
From: Eugene Prokopiev <john@rmts.donpac.ru>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; ru-RU;
	rv:1.5b) Gecko/20031007 Thunderbird/0.3a
X-Accept-Language: ru-ru, ru
MIME-Version: 1.0
To: community@altlinux.ru
Content-Type: text/plain; charset=KOI8-R; format=flowed
Content-Transfer-Encoding: 8bit
Subject: [Comm] /etc/passwd -> ldap: =?koi8-r?b?y8HLINrBxMHU2CDQwdLPzNg/?=
X-BeenThere: community@altlinux.ru
X-Mailman-Version: 2.1.4
Precedence: list
Reply-To: community@altlinux.ru
List-Id: Mailing list for ALT Linux users <community.altlinux.ru>
List-Unsubscribe: <http://lists.altlinux.ru/mailman/listinfo/community>,
	<mailto:community-request@altlinux.ru?subject=unsubscribe>
List-Archive: <http://lists.altlinux.ru/pipermail/community>
List-Post: <mailto:community@altlinux.ru>
List-Help: <mailto:community-request@altlinux.ru?subject=help>
List-Subscribe: <http://lists.altlinux.ru/mailman/listinfo/community>,
	<mailto:community-request@altlinux.ru?subject=subscribe>
X-List-Received-Date: Thu, 15 Apr 2004 10:37:48 -0000
Archived-At: <http://lore.altlinux.org/community/407E6671.3060309@rmts.donpac.ru/>
List-Archive: <http://lore.altlinux.org/community/>
List-Post: <mailto:mandrake-russian@linuxteam.iplabs.ru>

Здравствуйте!

Имеем openldap, nss_ldap и pam_ldap, сконфигурированные так:

# grep ^[a-z] /etc/openldap/slapd.conf
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/dhcp.schema
include /etc/openldap/schema/internet-access.schema
pidfile         /var/run/slapd.pid
argsfile        /var/run/slapd.args
database        ldbm
suffix          "dc=myserver,dc=myprovider,dc=ru"
rootdn          "cn=manager,dc=myserver,dc=myprovider,dc=ru"
rootpw  secret
directory       /var/lib/ldap/bases
loglevel -1
index objectClass,uid,uidNumber,gidNumber     eq
index cn,mail,surname,givenname               eq,subinitial
index dhcpHWAddress                           eq
index dhcpClassData                           eq

# grep ^[a-z] /etc/ldap.conf
host 127.0.0.1
base dc=myserver,dc=myprovider,dc=ru
bindpw secret
rootbinddn cn=manager,dc=myserver,dc=myprovider,dc=ru

# grep ^[a-z] /etc/nsswitch.conf
passwd:     files ldap nisplus nis
shadow:     tcb ldap files nisplus nis
group:      files ldap nisplus nis
hosts:      files nisplus nis dns
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files
bootparams: nisplus [NOTFOUND=return] files
netgroup:   nisplus
publickey:  nisplus
automount:  files nisplus
aliases:    files nisplus

Делаем следующее:

$ ldapadd -x -D "cn=manager,dc=myserver,dc=myprovider,dc=ru" -w "secret" 
-f users.ldif
adding new entry "dc=myserver, dc=myprovider, dc=ru"
adding new entry "cn=Users, dc=myserver, dc=myprovider, dc=ru"
adding new entry "cn=vasya, cn=Users, dc=myserver, dc=myprovider, dc=ru"

$ ldapsearch -LL -H ldap://localhost -b "dc=myserver,dc=myprovider,dc=ru"
version: 1

dn: dc=myserver, dc=myprovider, dc=ru
objectClass: top

dn: cn=Users, dc=myserver, dc=myprovider, dc=ru
objectClass: top

dn: cn=vasya, cn=Users, dc=myserver, dc=myprovider, dc=ru
objectClass: posixAccount
objectClass: shadowAccount
cn: vasya
uid: vasya
uidNumber: 1000
gidNumber: 10
homeDirectory: /home/vasya
loginShell: /bin/bash
userPassword:: e21kNX0kMSRJT040U0lJSSRFWXlHRWVZdDRnMmhFZTl0aklDYWMu

$ ldappasswd -x -D "cn=manager,dc=myserver,dc=myprovider,dc=ru" -w 
"secret" -s "1" "cn=vasya, cn=Users, dc=myserver, dc=myprovider, dc=ru"
Result: Success (0)

И вот теперь пытаемся подключиться:

$ su - vasya
Password:

вводим 1

su: Authentication failure

# tail /var/log/messages
Apr 15 14:16:25 john-ws pam_tcb[23262]: su: Authentication failed for 
vasya from john(uid=501)

Если сделать то же под рутом, то, никаких паролей спрашивать не станут, 
пустят сразу.

Что я сделал не так?

-- 
С уважением, Прокопьев Евгений