DSEE 6.3 - LDAP and netgroup problem

Question

All
I need your assistance or guidance with regards to my current situation with ldap and netgroups
Let me explain
I have configure ldap user authentication and need to group the user with netgroup
The problem I'm having is that when netgroup is disabled (client /etc/passwd and /etc/nsswitch.conf change back to normal) I can login with the ldap user but as soon as I enable netgroup restart the nscd I cannot login
The weird thing is I have gone through all the docs that was suggested in this forum with regards to ldap and netgroup but I'm still having a problem
The netgroup behavior is, I can do a # getent passwd username with success, # id username successful and I can even # su to that user with success but when I want to login as that user I get permission denied BTW I cannot do # passwd -r ldap username - Permission denied
See below My config
Hope this wil help as I,m sure that I have missed something small
Regards
*# /etc/nsswitch.ldap*
# An example file that could be copied over to /etc/nsswitch.conf; it
# uses LDAP in conjunction with files.
# "hosts:" and "services:" in this file are used only if the
# /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
# LDAP service requires that svc:/network/ldap/client:default be enabled
# and online.
# the following two lines obviate the "+" entry in /etc/passwd and /etc/group.
#passwd: ldap files
#group: ldap files
passwd: compat
passwd_compat: ldap
group: compat
group_compat: ldap
more /etc/pam.conf
# Authentication management
# login service (explicit because of pam_dial_auth)
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
tail -1 /etc/passwd
+@nidgroup:x:::::
more /var/ldap/ldap_client_cred
# Do not edit this file manually; your changes will be lost.Please use ldapclien
t (1M) instead.
NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=nid,dc=domain,dc=co,dc=za
NS_LDAP_BINDPASSWD= {NS1}a10952b9857c6016
more /var/ldap/ldap_client_file
# Do not edit this file manually; your changes will be lost.Please use ldapclien
t (1M) instead.
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= nisldap01.domain.co.za
NS_LDAP_SEARCH_BASEDN= dc=nid,dc=domain,dc=co,dc=za
NS_LDAP_AUTH= simple
NS_LDAP_SEARCH_REF= FALSE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_SERVER_PREF= nisldap01.domain.co.za
NS_LDAP_CACHETTL= 43200
NS_LDAP_PROFILE= kobus
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=people,dc=nid,dc=domain,dc=co,dc=za?one
NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=people,dc=nid,dc=domain,dc=co,dc=za?one
NS_LDAP_SERVICE_SEARCH_DESC= group:ou=Group,dc=nid,dc=domain,dc=co,dc=za?one
NS_LDAP_SERVICE_SEARCH_DESC= netgroup:ou=netgroup,dc=nid,dc=domain,dc=co,dc=za?one
NS_LDAP_BIND_TIME= 10
NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple
NS_LDAP_SERVICE_AUTH_METHOD= keyserv:tls:simple
NS_LDAP_SERVICE_AUTH_METHOD= passwd-cmd:tls:simpl
ldaplist -l netgroup
dn: cn=linuxgroup,ou=netgroup,dc=nid,dc=domain,dc=co,dc=za
nisNetgroupTriple: (,kobusj,)
objectClass: nisNetgroup
objectClass: top
cn: linuxgroup
dn: cn=nidgroup,ou=netgroup,dc=nid,dc=domain,dc=co,dc=za
nisNetgroupTriple: (,kobusj,)
objectClass: nisNetgroup
objectClass: top
cn: nidgroup
ldaplist -l passwd kobusj
dn: uid=kobusj,ou=People,dc=nid,dc=domain,dc=co,dc=za
givenName: kobus
sn: kobusj
loginShell: /usr/bin/bash
uidNumber: 130
gidNumber: 100
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: kobusj
cn: kobusj
homeDirectory: /home/kobusj
userPassword: {crypt}rnR9/Cv1oV1l6
*# getent passwd kobusj*
kobusj:x:130:100::/home/kobusj:/usr/bin/bash
*# id kobusj*
uid=130(kobusj) gid=100(nis)
*# passwd -r ldap kobusj*
Enter kobusj's password:
New Password:
Re-enter new Password:
Permission denied

Answer 1

Hi,
can anybody show whole /etc/pam.conf with working pam_list?
The configuration below doesn't work:
cat /etc/pam.conf
+#+
+# Authentication management+
+#+
+# login service (explicit because of pam_dial_auth)+
+#+
login   auth requisite        pam_authtok_get.so.1
login   auth required         pam_dhkeys.so.1
login   auth required         pam_unix_cred.so.1
login   auth required         pam_dial_auth.so.1
login   auth binding          pam_unix_auth.so.1 server_policy
login   auth required         pam_ldap.so.1
login   auth requisite       pam_list.so.1 allow=/etc/user.allow debug
+#+
+# rlogin service (explicit because of pam_rhost_auth)+
+#+
+# rlogin auth sufficient pam_rhosts_auth.so.1+
rlogin  auth requisite        pam_authtok_get.so.1
rlogin  auth required         pam_dhkeys.so.1
rlogin  auth required         pam_unix_cred.so.1
rlogin  auth binding          pam_unix_auth.so.1 server_policy
rlogin  auth required         pam_ldap.so.1
+#+
+# rsh service (explicit because of pam_rhost_auth,+
+# and pam_unix_auth for meaningful pam_setcred)+
+#+
+# rsh auth sufficient pam_rhosts_auth.so.1+
rsh     auth required         pam_unix_cred.so.1
rsh     auth binding          pam_unix_auth.so.1 server_policy
rsh     auth required         pam_ldap.so.1
+#+
+# PPP service (explicit because of pam_dial_auth)+
+#+
ppp     auth requisite        pam_authtok_get.so.1
ppp     auth required         pam_dhkeys.so.1
ppp     auth required         pam_dial_auth.so.1
ppp     auth binding          pam_unix_auth.so.1 server_policy
ppp     auth required         pam_ldap.so.1
+#+
+# Default definitions for Authentication management+
+# Used when service name is not explicitly mentioned for authentication+
+#+
other   auth requisite        pam_authtok_get.so.1
other   auth required         pam_dhkeys.so.1
other   auth required         pam_unix_cred.so.1
other   auth binding          pam_unix_auth.so.1 server_policy
other   auth required         pam_ldap.so.1
+#+
+# passwd command (explicit because of a different authentication module)+
+#+
passwd  auth binding          pam_passwd_auth.so.1 server_policy
passwd  auth required         pam_ldap.so.1
+#+
+# cron service (explicit because of non-usage of pam_roles.so.1)+
+#+
cron    account required      pam_unix_account.so.1
+#+
+# Default definition for Account management+
+# Used when service name is not explicitly mentioned for account management+
+#+
other   account requisite     pam_roles.so.1
other   account binding       pam_unix_account.so.1
other   account required      pam_ldap.so.1
other   account requisite   pam_list.so.1 allow=/etc/user.allow debug
+#+
+# Default definition for Session management+
+# Used when service name is not explicitly mentioned for session management+
+#+
other   session required      pam_unix_session.so.1
+#+
+# Default definition for Password management+
+# Used when service name is not explicitly mentioned for password management+
+#+
other   password required     pam_dhkeys.so.1
other   password requisite    pam_authtok_get.so.1
other   password requisite    pam_authtok_check.so.1
other   password required     pam_authtok_store.so.1 server_policy
+#+
+# Support for Kerberos V5 authentication and example configurations can+
+# be found in the pam_krb5(5) man page under the "EXAMPLES" section.+
+#+
Thanks!
Edited by: ffffffffff356dfd on 14 ??? 2009 16:25
Edited by: ffffffffff356dfd on 14 ??? 2009 16:30