Making a Solaris 9 box a ldap client to 10.3 server

I have a 10.3 server running with all the updates and it a ODM with users/groups created within it's ldap domain, everything from the Mac end is working great.
What I now need to do....
We have a SunOS 9 box that is running some app that we need it to accept user/group information from the 10.3 domain for local file system rights.
For example if I have a group on the 10.3 domain called group1 and a dir on the Sun box called test, we want to be able to do (From the sun box):
chown -R :group1 test
And then set access permission based on the group.
What I was thinking was to bind the Sun box to the 10.3 domain to do this, but I'm running into the issue that I really don't know Solaris well and all the docs I find are about how to setup a client to bind to a Solaris domain and not how to setup a Solaris box as a client.
So I guess my two questions are:
1. Is what I'm thinking of doing the right way of getting this to work?
2. Any read me or help on setting up a Solaris box to be a ldap client to a 10.3 domain.
Thanks.

Have you tried walking across the building and asking Brooke?

Similar Messages

  • Solaris 10 - ldap client - tls/ssl - password change

    we have configured solaris 10 as a ldap client to sun directory server 6.3.1, on enabling tls:simple, password change operation is just failing with following error message.
    passwd -r user1
    passwd: Changing password for user1
    passwd: Sorry, wrong passwd
    Permission denied
    where user1 is just in ldap and not in unix local. this function works if the authentication mechanism is just simple, but on enabling tls:simple, we get the error message.
    any ideas will be highly appreciated.

    Not that it helps any but I am getting his same error. I am also using 6.3.1

  • Solaris 10 LDAP Client: libsldap: Status: 4

    Hi everybody.
    I changed the configuration in Solaris 10 to restrict the LDAP users who can login to the system.
    What I have done is changed the value:
    NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=people,dc=sis,dc=personal,dc=net,dc=py?sub?host=<hostname>
    Where <hostname> is the respective hostname.
    After that, everything works as I expect, but I get a lot of these messages:
    sshd[28495] libsldap: Status: 4 Mesg: Service search descriptor for service 'passwd' contains filter, which can not be used for service 'user_attr'.
    Should I ignore the messages? This is the nsswitch.conf file:
    /etc/nsswitch.conf
    # Copyright 2006 Sun Microsystems, Inc. All rights reserved.
    # Use is subject to license terms.
    # ident "@(#)nsswitch.files 1.14 06/05/03 SMI"
    # /etc/nsswitch.files:
    # An example file that could be copied over to /etc/nsswitch.conf; it
    # does not use any naming service.
    # "hosts:" and "services:" in this file are used only if the
    # /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
    passwd: files ldap
    group: files ldap
    hosts: cluster files dns
    ipnodes: files dns
    networks: files
    protocols: files
    rpc: files
    ethers: files
    netmasks: cluster files
    bootparams: files
    publickey: files
    netgroup: files
    automount: files
    aliases: files
    services: files
    printers: user files
    auth_attr: files
    prof_attr: files
    project: files
    tnrhtp: files
    tnrhdb: files
    user_attr: files
    I added user_attr to nsswitch.conf pointing to files only, refreshed ssh, but the message still appears.
    Any suggestions?

    What would I do without google?
    http://prefetch.net/blog/index.php/2005/01/
    I setup several Solaris systems to authenticate via LDAP last year, and periodically get the following error message in /var/adm/messages:
    Dec 21 08:44:17 sparky nscd[1174]: [ID 293258 user.error] libsldap: Status: 4 Mesg: Service search
    descriptor for service �passwd� contains filter, which can not be used for service �user_attr�.
    We use SSDs (service search descriptors) to tailor the search string that is sent to the directory server. This allows us to tailor who can and cannot login to our Solaris systems. After doing some digging, it looks like the following search descriptors are required to make libsldap.so happy:
    NS_LDAP_SERVICE_SEARCH_DESC= user_attr:ou=people,dc=daemons,dc=net?one?&(acctActive=yes)
    NS_LDAP_SERVICE_SEARCH_DESC= audit_user:ou=people,dc=daemons,dc=net?one?&(acctACtive=yes)
    Since we use sudo instead of RBAC, I am still researching why the secure LDAP client queries the directory server for the user_attr information. Hopefully I can find an answer in RFC 2307 ( An approach to using LDAP as a network information service), or the documentation on docs.sun.com.

  • Some LDAP Clients Like to Talk

    I have a branch office Sun Ray server that is an S10u4 LDAP client. The LDAP server is located in our head office.
    We have noticed that the ldap client on the SRS server is very chatty(300MB/day). Other SRS servers that have the same user load at other locations don't seem to be as chatty.
    I have snooped the connection and it's all port 636 with a tiny amont of 389 traffic.
    ldap_cachemgr -g shows a lot of calls to ldapcachemgr.
    If anyone can help me out, that would be appreciated.

    We have been able to find by looking at the nscd log and the ldap server access log that there seems to be a lot of querries for ou=printers.
    why nscd is not caching the printers or why the querries are happening is the next thing to figure out.

  • LDAP client for solaris 9 with ds5.2 on other box

    Hi
    I have ds5.2 installed on Box1. I am trying to configure ldapclient on solaris 9 box. I want this to point to existing ldap server for authentication. Sun documentation is not clear about how to do that ? as some of the switches mentioned with ldapclient doesn't work. Most of the solutions I saw are on integrated solaris 9 ds server configuration. e.g idsconfig etc. I am not finding how to do basic authentication of solaris9 cient with any ldap server (ds5.2) installed on some other box.

    The syntax of ldapclient changed in Solaris 9 (at least by 9 12/03). You now specify it like this:
    # ldapclient -v init -a profileName=cn=myProfile,ou=profile,dc=example,dc=comIf you're using Proxy Authentication add the following:
    -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com -a proxyPassword=ClearTextPWYou should have been able to create a profile (storing it in the DIT) when you ran idsconfig. If you took the default name of "default" (cn=default,ou=profile,dc=example,dc=com) you might not even have to specify the profile name to ldapclient.
    To generate a new profile and store it in the DIT use:
    $ ldapclient -vgenprofile -a profileName=cn=myProfile,ou=profile,dc=example,dc=com -a defaultSearchBase=dc=example,dc=com ...With your various attributes for your profile as specified in ldapclient(1M).
    As for pam, you have to decide which you're going to use: pam_unix or pam_ldap. Note that the Solaris pam_ldap is very different from the PADL pam_ldap used under Linux and elsewhere (this makes it easy to find apparently conflicting advice).

  • Solaris 7 ldap client setup

    Hi,
    Please any one can help me in setting ldap client for solaris 7 guidelines or any website or docs help.
    Thanking you,
    Naren

    hi mukherjee,
    you can configure both solaris 8 and 9 as ldapclient to sunone 5.2 installed on solaris 9 box. make sure i think you cannot configure client on same maching on which directory server is installed.
    No my question is how to setup ldapclient on solaris 6 andsolaris 7. as both does not support ldap. like solaris 7 has no nsswitch.ldap. can you provide me details to configure solaris7 as ldap client
    PATEL

  • Patching solaris LDAP client

    i will have to patch a solaris LDAP client box. What do I expect for that? Do I have to rel-initialize the client using ldapclient command after patching?
    solaris 8 + LDAP server 5.2 unbundled version.
    Thanks

    From previous experience if your slapd is not running on your LDAP server then your clients will not boot if they are setup for ldap domain authentication. This is the same in NIS and NIS+. The only way to bring them up is to boot -s and change the nsswitch.conf file back to standalone i.e files and reboot machine.
    In short if ldap server goes down clients are too, multi ldap servers are required to prevent single point failure.

  • Ldap client in Solaris  using TLS

    I have installed an OpenLap server (version 2.2.13-2) in a Red Hat ES 4.
    My LDAP clients are
    - Linux (redhat and mandriva)
    - Solaris 8 (with the last recommended path and 10893-62 path for ldapv2)
    - Tru64 (5.1B)
    If a use simple authentification all works fine (search in LDAP,
    authentification and automount).
    However, when I use TLS the Solaris LDAP client doesn't seem to work.
    When I run the LDAP client the process freeze
    With my Linux and Tru64 clients all work fine using LS.
    I have downloaded the certificates from my LDAP server using Netscape browser.
    I have copied cert7.db and key3.db in the "/var/ldap/directory" with a
    "chmod 644" in this files.
    I can do a "ldapsearch -x -ZZ objectclass=*" and this returns data.
    The last logs of the ldap_cachemgr are:
    Mon Nov 20 09:34:46.4425 Starting ldap_cachemgr, logfile /var/ldap/cachemgr.log
    If I do a truss when I launch the client the
    result was this:
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    door_return(0x00000000, 0, 0x00000000, 0) (sleeping...)
    lwp_cond_wait(0xFF0F34F0, 0xFF0F3500, 0xFF0ECD88) (sleeping...)
    This is my ldap_client_file:
    # Do not edit this file manually; your changes will be lost.Please use
    ldapclient (1M) instead.
    NS_LDAP_FILE_VERSION= 2.0
    NS_LDAP_SERVERS= srvldap
    NS_LDAP_SEARCH_BASEDN= dc=example,dc=com
    NS_LDAP_AUTH= tls:simple
    NS_LDAP_SEARCH_REF= FALSE
    NS_LDAP_SEARCH_SCOPE= sub
    NS_LDAP_SEARCH_TIME= 30
    NS_LDAP_CACHETTL= 3600
    NS_LDAP_PROFILE= tls_profile
    NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=Users,dc=example,dc=com?one
    NS_LDAP_SERVICE_SEARCH_DESC= group: ou=Groups,dc=example,dc=com?one
    NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=Users,dc=example,dc=com?one
    NS_LDAP_SERVICE_SEARCH_DESC= auto_home:
    automountMapName=auto_home,ou=Sun,ou=AutoFS,dc=example,dc=com?one
    NS_LDAP_SERVICE_SEARCH_DESC= auto_master:
    automountMapName=auto_master,ou=Sun,ou=AutoFS,dc=example,dc=com?one
    NS_LDAP_SERVICE_SEARCH_DESC= auto.home:
    nisMapName=auto.home,ou=Sun,ou=AutoFS,dc=example,dc=com?one
    NS_LDAP_SERVICE_SEARCH_DESC= auto.master:
    nisMapName=auto.master,ou=Sun,ou=AutoFS,dc=example,dc=com?one
    NS_LDAP_BIND_TIME= 10
    I have launched ethereal so see network communications with my Solaris 8 client and the LDAP server.
    And with this configuration the Solaris box only communicates with the LDAP server using LDAP port 389 and not LDAPS port 636.
    I have done the same test with a linux and tru64 box and they use LDAPS port 636 to communicate with my LDAP server.
    Does anyone have an idea on getting Solaris using TLS/SSL?
    Thanks.

    LDAP Setup and Configuration Guide
    Solaris 8 2/04 Update Collection > LDAP Setup and Configuration Guide > 1. Overview > Solaris Name Services
    [http://docs.sun.com/app/docs/doc/806-5580/6jej518ou?l=en&a=view&q=solaris+8+ldap]
    Download this book in PDF (557 KB)
    [http://dlc.sun.com/pdf/806-5580/806-5580.pdf]

  • Proxy agent in solaris ldap client

    Since ldap service provides naming service, that is supposed to be accessed by anyone who needs it, I don't know why we need a proxy agent when we set up solaris ldap client. The anoymous credential level is enough.
    Also in order to use proxy agent, this agent needs to have at least read access to all naming entries, including userPassword, encrypted or clear-text. This adds some sort of in-security. While service authentication method "simple" will simply bind to the ldap server using provided password. Of course, you can still add another layer of security by using TLS.
    So, can anyone explain this design a little more?
    Thanks.

    My input on this subject may seem a bit paranoid, but that's what I get paid for, so take this with a gain of salt 8-)
    The proxy agent does not need to have read access to the userPassword attribute if you configure your clients to use pam_ldap instead of pam_unix. pam_unix retrieves the userPassword attribute by making a call to getspnam. With pam_ldap, the user dn and password are sent to the directory server in an auth structure, and the directory server will return success or failure to the client for that login attempt. More info on this can be found at http://docs.sun.com, or in the book "LDAP in the Solaris Operating Environment, Deploying Secure Directory Services" by Michael Hains and Tom Bialaski (ISBN 0-13-145693-8) pgs 177-179.
    Use of the proxy agent can actually increase the level of security for your directory server. With the proper ACI's in place not allowing anonymous binds to view the data in the tree (or only view a small subset of the tree), you can prevent anyone from dropping a laptop or other device on your network and data mining your LDAP tree for information (ie vendors, guests, etc). That won't stop those same people from snooping the traffic on your network, so the use of secure protocols are the other side of that, but implementing tls:simple authentication for the directory server and clients is not that difficult, and should be considered for any deployment of LDAP for use as a naming server.
    I do agree with your assessment that in an environment where anonymous binds are accecptable the use of the proxyagent is probably not warrented, but in my experience having the proxyagent has allowed me to tighten the security of my directory implementation .

  • Has anyone set up a Solaris 7 LDAP client to use with iPlanet DS 5.0?  I have only found docs for compiling OpenLDAP and have had NO LUCK with it. I can't get an LDAP client to run.

    I am trying Not to have 3 separate versions of LDAP in my environment (iDS5,Native Solaris LDAP,OpenLDAP). Can anyone point me to some DETAILED instructions to get an LDAP client (not server) running on Solaris 7?

    Hi,
    While U try to upgrade solaris it first tries to check the installed softtware & application and patch's specific to the exsisting version b'coz these patch are specific to version in most cases.Since in Ur case the authentication is done in ldap it would become bit of a mess if U upgrade.

  • Hi Can anyone guide me configure LDAP client in solaris 8 server.

    Hi,
    I am already having the solaris 8 LDAP master server. We have new server which i need to confgure as a client to that master server.
    Can any one help me to configure the same.
    Thanks in Advance....
    Bala......

    LDAP Setup and Configuration Guide
    Solaris 8 2/04 Update Collection > LDAP Setup and Configuration Guide > 1. Overview > Solaris Name Services
    [http://docs.sun.com/app/docs/doc/806-5580/6jej518ou?l=en&a=view&q=solaris+8+ldap]
    Download this book in PDF (557 KB)
    [http://dlc.sun.com/pdf/806-5580/806-5580.pdf]

  • Ldap client with directory server 6.0 on solaris 9 systems

    I have a directory server 6.0 running on a solaris 9 system. I have set up idsconfig, vlvindex and certificate database on the server side. The client ldap I am trying to set up is also solaris 9 system. I have set the certificate database on this ldap client using the Resource Kit certutil and import the server certificate to client certificate database. It seems the TLS secure connection did work between LDAP server and client. (I use the Resource Kit ldapsearch command to test it) I use 'ldapclient -v init ...' command using 'profileName=tlsprofile' to initialize the LDAP client and the information returned from that command said LDAP client configed sucsessfully. But when I run ldapaddent command to import /etc/passwd. I got error:
    Passwd container does not exist.
    The ldapaddent command I ran like this:
    ldapaddent -v -f <passwd file> -D "cn=Directory Manager" passwd
    Then I tried to use 'ldapclient -v manual ....' command to set up LDAP client. That command finishes succefully. But I still can not import /etc/passwd using ldapaddent with same error.
    What is wrong with my set-up?
    Thanks,
    --xinhuan                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

    I looked into the /var/adm/messages, and I have the following error:
    ldap_cachemgr[1640]: [ID 605618 daemon.error] libldap: CERT_VerifyCertName: cert server name 'directory server' does not match 'hostname.mycompany.com': SSL connection denied
    It seems I have problem with SSL certificate set-up. I did generate the server side 'hostname.mycompany.com' certificate then use the Resource Kit certutil import that certificate to the client side. Is that right way to do?
    Thanks,
    --xinhuan                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • Solaris 7 ldap client

    Hello,
    Does anyone have advise for a solaris 7 ldap client? Is openldap/nss_ldap pretty much the standard? After comile & installation, editing /etc/nsswitch.conf & ldap.conf, what else needs to be done?
    thanks

    It is advisable to upgrade to Solaris8 + lastest Kernel and LDAPv2 patches, uninstall OpenLDAP Client Libraries and just use the SUN supported Solaris Native LDAP Client Libraries.
    Assuming "idsconfig" has been run at the DS5.2 server end, to create the profiles and agent data, after that "ldapclient" should be run also at all ldap clients, it will setup /etc/nsswitch.conf, however you may need to adjust the "hosts: files ldap" to "hosts: files dns".
    If you intend to use pam_ldap, lookup docs.sun.com for a recommended /etc/pam.conf
    You may follow http://web.singnet.com.sg/~garyttt/
    Gary

  • Solaris ldap client problem (tls:simple + anonymous)

    Hi All,
    I've installed Directory Server 6.3.1 and it works just fine,
    but I have a problem regarding connecting Solaris 10 ldap client to it through SSL using anonymous credential level.
    Both SSL with proxy credential level or anonymous without SSL work fine but as you know these configurations are not pretty secure.
    More detail.
    Profile:
    dn: cn=sslnoproxyuser,ou=profile,dc=domain,dc=com
    authenticationmethod: tls:simple
    bindtimelimit: 10
    cn: sslnoproxyuser
    credentiallevel: anonymous
    defaultsearchbase: dc=domain,dc=com
    defaultsearchscope: one
    defaultserverlist: servername.domain.com
    followreferrals: TRUE
    objectclass: top
    objectclass: DUAConfigProfile
    preferredserverlist: servername.domain.com
    profilettl: 43200
    searchtimelimit: 30
    Ldapclient output:
    bash-3.00# ldapclient init -v -a profileName=sslnoproxyuser servername.domain.com
    Parsing profileName=sslnoproxyuser
    Arguments parsed:
    profileName: sslnoproxyuser
    defaultServerList: servername.domain.com
    Handling init option
    About to configure machine by downloading a profile
    findBaseDN: begins
    findBaseDN: ldap not running
    findBaseDN: calling __ns_ldap_default_config()
    found 2 namingcontexts
    findBaseDN: __ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=domain.com))"
    rootDN[0] dc=domain,dc=com
    found baseDN dc=domain,dc=com for domain domain.com
    Proxy DN: NULL
    Proxy password: NULL
    Credential level: 0
    Authentication method: 3
    No proxyDN/proxyPassword required
    About to modify this machines configuration by writing the files
    Stopping network services
    Stopping sendmail
    stop: sleep 100000 microseconds
    stop: network/smtp:sendmail... success
    Stopping nscd
    stop: sleep 100000 microseconds
    stop: sleep 200000 microseconds
    stop: system/name-service-cache:default... success
    Stopping autofs
    stop: sleep 100000 microseconds
    stop: sleep 200000 microseconds
    stop: sleep 400000 microseconds
    stop: sleep 800000 microseconds
    stop: sleep 1600000 microseconds
    stop: sleep 3200000 microseconds
    stop: system/filesystem/autofs:default... success
    ldap not running
    nisd not running
    nis(yp) not running
    file_backup: stat(/etc/nsswitch.conf)=0
    file_backup: (/etc/nsswitch.conf -> /var/ldap/restore/nsswitch.conf)
    file_backup: stat(/etc/defaultdomain)=0
    file_backup: (/etc/defaultdomain -> /var/ldap/restore/defaultdomain)
    file_backup: stat(/var/nis/NIS_COLD_START)=-1
    file_backup: No /var/nis/NIS_COLD_START file.
    file_backup: nis domain is "domain.com"
    file_backup: stat(/var/yp/binding/domain.com)=-1
    file_backup: No /var/yp/binding/domain.com directory.
    file_backup: stat(/var/ldap/ldap_client_file)=-1
    file_backup: No /var/ldap/ldap_client_file file.
    Starting network services
    start: /usr/bin/domainname domain.com... success
    start: sleep 100000 microseconds
    start: network/ldap/client:default... maintenance
    start: sleep 100000 microseconds
    start: system/filesystem/autofs:default... success
    start: sleep 100000 microseconds
    start: system/name-service-cache:default... success
    start: sleep 100000 microseconds
    start: network/smtp:sendmail... success
    restart: sleep 100000 microseconds
    restart: sleep 200000 microseconds
    restart: milestone/name-services:default... success
    Error resetting system.
    Recovering old system settings.
    Stopping network services
    Stopping sendmail
    stop: sleep 100000 microseconds
    stop: network/smtp:sendmail... success
    Stopping nscd
    stop: sleep 100000 microseconds
    stop: sleep 200000 microseconds
    stop: system/name-service-cache:default... success
    Stopping autofs
    stop: sleep 100000 microseconds
    stop: sleep 200000 microseconds
    stop: sleep 400000 microseconds
    stop: sleep 800000 microseconds
    stop: sleep 1600000 microseconds
    stop: sleep 3200000 microseconds
    stop: system/filesystem/autofs:default... success
    Stopping ldap
    stop: network/ldap/client:default... restoring from maintenance state
    stop: sleep 100000 microseconds
    stop: network/ldap/client:default... success
    nisd not running
    nis(yp) not running
    recover: stat(/var/ldap/restore/defaultdomain)=0
    recover: open(/var/ldap/restore/defaultdomain)
    recover: read(/var/ldap/restore/defaultdomain)
    recover: old domainname "domain.com"
    recover: stat(/var/ldap/restore/ldap_client_file)=-1
    recover: stat(/var/ldap/restore/ldap_client_cred)=-1
    recover: stat(/var/ldap/restore/NIS_COLD_START)=-1
    recover: stat(/var/ldap/restore/domain.com)=-1
    recover: stat(/var/ldap/restore/nsswitch.conf)=0
    recover: file_move(/var/ldap/restore/nsswitch.conf, /etc/nsswitch.conf)=0
    recover: stat(/var/ldap/restore/defaultdomain)=0
    recover: file_move(/var/ldap/restore/defaultdomain, /etc/defaultdomain)=0
    Starting network services
    start: /usr/bin/domainname domain.com... success
    start: sleep 100000 microseconds
    start: system/filesystem/autofs:default... success
    start: sleep 100000 microseconds
    start: system/name-service-cache:default... success
    start: sleep 100000 microseconds
    start: network/smtp:sendmail... success
    restart: sleep 100000 microseconds
    restart: milestone/name-services:default... success
    */var/ldap/cachemgr.log*
    Tue Jun 30 10:50:51.4330 Starting ldap_cachemgr, logfile /var/ldap/cachemgr.log
    Tue Jun 30 10:50:51.4355 Error: Unable to read '/var/ldap/ldap_client_file': Configuration Error: No entry for 'NS_LDAP_BINDDN' found
    Tue Jun 30 10:50:51.4368 detachfromtty(): child failed (rc = 255).
    Any ideas?
    Edited by: ffffffffff356dfd on 30 ???? 2009 12:07
    Edited by: ffffffffff356dfd on 30 ???? 2009 12:07

    Hi ,
    yes I use it.
    Here is my pam.conf:
    # Authentication management
    # login service (explicit because of pam_dial_auth)
    login auth requisite pam_authtok_get.so.1
    login auth required pam_dhkeys.so.1
    login auth required pam_unix_cred.so.1
    login auth required pam_dial_auth.so.1
    login auth binding pam_unix_auth.so.1 server_policy
    login auth required pam_ldap.so.1
    # rlogin service (explicit because of pam_rhost_auth)
    # rlogin auth sufficient pam_rhosts_auth.so.1
    rlogin auth requisite pam_authtok_get.so.1
    rlogin auth required pam_dhkeys.so.1
    rlogin auth required pam_unix_cred.so.1
    rlogin auth binding pam_unix_auth.so.1 server_policy
    rlogin auth required pam_ldap.so.1
    # rsh service (explicit because of pam_rhost_auth,
    # and pam_unix_auth for meaningful pam_setcred)
    # rsh auth sufficient pam_rhosts_auth.so.1
    rsh auth required pam_unix_cred.so.1
    rsh auth binding pam_unix_auth.so.1 server_policy
    rsh auth required pam_ldap.so.1
    # PPP service (explicit because of pam_dial_auth)
    ppp auth requisite pam_authtok_get.so.1
    ppp auth required pam_dhkeys.so.1
    ppp auth required pam_dial_auth.so.1
    ppp auth binding pam_unix_auth.so.1 server_policy
    ppp auth required pam_ldap.so.1
    # Default definitions for Authentication management
    # Used when service name is not explicitly mentioned for authentication
    other auth requisite pam_authtok_get.so.1
    other auth required pam_dhkeys.so.1
    other auth required pam_unix_cred.so.1
    other auth binding pam_unix_auth.so.1 server_policy
    other auth required pam_ldap.so.1
    # passwd command (explicit because of a different authentication module)
    passwd auth binding pam_passwd_auth.so.1 server_policy
    passwd auth required pam_ldap.so.1
    # cron service (explicit because of non-usage of pam_roles.so.1)
    cron account required pam_unix_account.so.1
    # Default definition for Account management
    # Used when service name is not explicitly mentioned for account management
    other account requisite pam_roles.so.1
    other account binding pam_unix_account.so.1
    other account required pam_ldap.so.1
    # Default definition for Session management
    # Used when service name is not explicitly mentioned for session management
    other session required pam_unix_session.so.1
    # Default definition for Password management
    # Used when service name is not explicitly mentioned for password management
    other password required pam_dhkeys.so.1
    other password requisite pam_authtok_get.so.1
    other password requisite pam_authtok_check.so.1
    other password required pam_authtok_store.so.1 server_policy
    # Support for Kerberos V5 authentication and example configurations can
    # be found in the pam_krb5(5) man page under the "EXAMPLES" section.
    #

  • Solaris 9 LDAP client sun_ssh public key authentication

    I have directory server 6.0 up on solaris 9 system and I have a couple of solaris 9 system migrated to LDAP client. I need to configure ssh public key authentication on two Solaris 9 LDAP clients. However, I seem can't make it working. I have done 1) generate rsa public/private key pairs on one host 2) cat public key to the authorized_keys file on another host. I checked the permission on $HOME and $HOME/.ssh, they both set to 700. The file permission are also correct. But I still get prompt when ssh from one LDAP client to another. If I add my password/shadow entry back to local files, then public key authentication works. My /etc/pam.conf is set up according to the Sun documentation for LDAP client. In /etc/nsswitch.conf
    passwd: compat
    passwd_compat: ldap
    shadow: files ldap
    group: files ldap
    netgroup: ldap
    loginShell does exist for the user.and LDAP entry has objectClasses 'posixAccount' and 'shadowAccount'
    I have latest patch 112960 installed on all of LDAP clients.
    What am I missing here?
    Thanks,
    --xinhuan                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

    One more thing - I have latest patch 112960 installed on all of LDAP clients.
    --xinhuan                                                                                                                                                                               

Maybe you are looking for