Accessing a shell with LDAP authentication

Shell access with LDAP authentication and authorization

Preparatory steps

Before we configure the use of LDAP, we confirm that the Linux system knows the root account, but does not know any sixpajo account. We do this with the command id:

id root
uid=0(root) gid=0(root) groups=0(root)
id sixpajo
id: sixpajo: No such user

Yes, exactly what we'd expect. But once we've enabled LDAP, we expect the second command to return a valid user.

To be able to use the LDAP database for authentication, we must have the right software. So as usual, we install it using apt-get or aptitude. The software we need is:

• libnss-ldapd, the NSS module that can use LDAP as a naming service
• libpam-ldap, the PAM module that allows LDAP interfaces

Note: the libnss-ldapd has the other one as dependencies, so you could limit yourself to

apt-get install libnss-ldapd

Note 2: some HOWTO's speak of libnss-ldap and the separate package nscd; however since there were some problems switching libraries from SSL to TLS, the libnss-ldap project forked libnss-ldapd. And when you install libnss-ldapd, you automatically get nslcd That extra "d" thus matters a lot :-) However, since all these files depend on a single configuration file (either nss-ldapd.conf or nss-ldap.conf) there is little differenc in the implementation of either.

When installing libnss-ldapd, Debian asks the following questions:

• the LDAP server Uniform Resource Identifier; you can submit ldap:///192.168.67.10 or whatever the IP address on your LDAP server's internal NIC is. Note: use "ldap:" and not "ldapi:". The difference is "ldapi:" signals LDAP over a Unix socket (and, to be complete, "ldaps:" signals LDAP over SSL).
• the DN of the LDAP search base: in our example this was "dc=saruman,dc=biz".
• a list of services for which to enable LDAP lookups; select services group, passwd and shadow - which should be the default.

Next is the libpam-ldap configuration:

• Make root database owner: default is yes, but we choose "no".
• Does the LDAP database require login: as long as we haven't disabled anonymous queries, it does not. We can answer "no".

Funny enough, if we run dpkg-reconfigure after installation, we get more questions.

Configuring PAM for LDAP authentication

First, let's check if the Debian installation has used the right information. Check /etc/pam_ldap.conf to contain the correct information on your LDAP server. If you run the correct cat-and-grep, you should see something like this:

cat /etc/pam_ldap.conf | grep -v ^# | grep -v ^$
base dc=saruman,dc=biz
uri ldap:///192.168.67.10
ldap_version 3
pam_password crypt

Next, check if libnss-ldapd.conf has the right information as well:

cat nss-ldapd.conf | grep -v ^# | grep -v ^$
uid nslcd
gid nslcd
uri ldap:///192.168.67.10
base dc=saruman,dc=biz

All correct, and with APT we wouldn't expect otherwise.

Now we'll configure PAM to use LDAP. This means editing PAM configuration files in /etc/pam.d. BE CAREFUL! Since PAM is quite fragile, it breaks easily when you make small mistakes in these files!

In /etc/pam.d/common-account, change account-required pam_unix.so into

account sufficient      pam_unix.so
account required        pam_ldap.so

In /etc/pam.d/common-auth, change auth required pam_unix.so nullok_secure into

auth [success=1 default=ignore] pam_unix.so nullok_secure
auth required           pam_ldap.so use_first_pass
auth required           pam_permit.so

In /etc/pam.d/common-session, add a line after session required pam_unix.so so you get

session required        pam_unix.so
session required        pam_mkhomedir.so skel=/etc/skel/ umask=0022

Configuring NSS to consult the LDAP server

To change NSS, we only have to change /etc/nsswitch.conf. There are multiple entries in there, but we're only interested in the two lines that start with passwd:, group: and shadow. Probably they look like this:

passwd:         compat
group:          compat
shadow:         compat

This means that for password, group and shadow information, the system will look into the normal files, and if no suitable answer is found there, in Sun's ancient NIS database. We don't employ NIS, but we do want to employ LDAP, so we change these three lines to:

passwd:         files ldap
group:          files ldap
shadow:         files ldap

Testing the new configuration

The nslcd program is very nice for caching and generally speeding up all things LDAP, but when testing we don't want it to interfere. Stop the daemon with sudo invoke-rc.d nslcd stop. If we now test for the presence of root and Joe Sixpack:

id root
uid=0(root) gid=0(root) groups=0(root)
id sixpacjo
uid=10001(sixpacjo) gid=10001(networkusers) groups=10001(networkusers)

Success! Root is still read from the Linux files (no object with a UID of "root" exists in your LDAP, at least not if you've followed this Wiki), and Joe Sixpack's account is found from the LDAP server. Note that if you restart your server, nslcd will be running automatically again. If you don't want to restart your server any time soon, you can manually start the nslcd daemon with sudo invoke-rc.d nslcd start.

LDAP authentication for SSH

By default, your Debian 5.0 "Lenny" setup is all ready to receive LDAP users. This is because by default the line

usePAM yes

is present; this makes SSH use the PAM settings in /etc/pam.d/sshd, which point to the standard PAM login methods "common-auth", "common-account" and "common-session". Thus, all settings you've made for shell access via the console automatically apply for SSH as well.

However, if you've configured your SSH server as we've outlined here, then to actually allow certain users, you need two distinct steps, that you've either performed already, or will need to do now:

1. add all LDAP users that you want to allow SSH acces to one or more LDAP groups, e.g. "ldapwheel";
2. add those group or groups to your SSH configuration in the AllowGroup line, e.g. AllowGroup wheel ldapwheel.

Ofcourse, if you've edited sshd_config, you'll need to restart the SSH server.