Chinaunix

标题: vsftpd + pam_ldap + openldap 验证不成功，请帮忙 [打印本页]

作者: cznao 时间: 2006-03-30 10:23
标题: vsftpd + pam_ldap + openldap 验证不成功，请帮忙
vsftpd + pam_ldap + openldap 验证不成功, 本地帐号登陆成功。
请问哪里可以看openldap的登陆日志，怎么看我的pam_ldap 已经连接到openldap了？
各位请帮忙看看，谢谢！
os: redhat as 3
vsftpd-2.0.4 + pam_ldap-180 + openldap-2.3.20 这三个都是通过编译安装

vsftpd 配置文件 /etc/vsftpd.conf

anonymous_enable=NO
local_enable=YES
write_enable=NO
anon_upload_enable=NO
anon_mkdir_write_enable=NO
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
guest_enable=YES
guest_username=vsftpdguest
listen=YES
chroot_local_user=YES
pam_service_name=ftp

vsftpd pam认证文件 /etc/pam.d/ftp

#%PAM-1.0
auth       sufficient    /lib/security/pam_ldap.so use_first_pass
account    sufficient    /lib/security/pam_ldap.so
password sufficient    /lib/security/pam_ldap.so
session    sufficient    /lib/security/pam_ldap.so

auth    required    /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth    required    /lib/security/pam_pwdb.so shadow nullok
auth    required    /lib/security/pam_shells.so
account required    /lib/security/pam_pwdb.so
session required    /lib/security/pam_pwdb.so
pam_ldap 配置文件 /etc/ldap.conf

[# @(#)$Id: ldap.conf,v 1.27 2003/01/17 21:37:12 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# PADL Software
# http://www.padl.com
#

host 127.0.0.1

# The distinguished name of the search base.
base dc=it,dc=com
pam_password crypt
pam_password exop
ssl no
pam_password md5

openldap 创建参考 openldap的安装笔记，请大家多点关注ldap技术。
openldap配置文件 /usr/local/openldap/etc/openldap/slapd.conf：

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include       /usr/local/openldap/etc/openldap/schema/core.schema
include       /usr/local/openldap/etc/openldap/schema/corba.schema
include       /usr/local/openldap/etc/openldap/schema/cosine.schema
include       /usr/local/openldap/etc/openldap/schema/inetorgperson.schema
include       /usr/local/openldap/etc/openldap/schema/misc.schema
include       /usr/local/openldap/etc/openldap/schema/openldap.schema
include       /usr/local/openldap/etc/openldap/schema/nis.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral    ldap://root.openldap.org

pidfile       /usr/local/openldap/var/run/slapd.pid
argsfile       /usr/local/openldap/var/run/slapd.args
loglevel 1

# Load dynamic backend modules:
# modulepath /usr/local/openldap/libexec/openldap
# moduleload back_bdb.la
# moduleload back_ldap.la
# moduleload back_ldbm.la
# moduleload back_passwd.la
# moduleload back_shell.la

# Sample security restrictions
#    Require integrity protection (prevent hijacking)
#    Require 112-bit (3DES or better) encryption for updates
#    Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#    Root DSE: allow anyone to read it
#    Subschema (sub)entry DSE: allow anyone to read it
#    Other DSEs:
#             Allow self write access
#             Allow authenticated users read access
#             Allow anonymous users to authenticate
#    Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#    by self write
#    by users read
#    by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read"

#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

database       bdb
suffix       "dc=it,dc=com"
rootdn       "cn=root,dc=it,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(

and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw       secret
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory    /usr/local/openldap/var/openldap-data
# Indices to maintain
index objectClass    eq

[ 本帖最后由 cznao 于 2006-3-30 16:01 编辑 ]

作者: cznao 时间: 2006-03-30 10:35
标题: 我的openldap中的数据
我手工导入了一个 dn：

ldapadd -x -D 'cn=root,dc=it,dc=com' -W
dn: uid=cc,dc=it,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: cc
cn: cc
sn: cc
userPassword:: 123456
telephoneNumber: 138888888
description: openldap test
telexNumber: tex-888888
street: my street
postOfficeBox: postofficebox
displayName: qqdisplay
homePhone: home1111111
mobile: mobile99999
mail: cc@cc.com

登陆测试验证，是否可以用用户名：cc 密码：123456？
好象导入到openldap后userPassword加密了，不知是否密码明文和密文的关系？

以下是我查询的结果
[root@localhost bin]# ./ldapsearch -x -b 'dc=it,dc=com'
# extended LDIF
#
# LDAPv3
# base <dc=it,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# it.com
dn: dc=it,dc=com
objectClass: dcObject
objectClass: organization
dc: it
o: Corporation
description: d Corporation

# qq, it.com
dn: uid=qq,dc=it,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: qq
cn: qq
sn: qq
telephoneNumber: 138888888
description: openldap test
telexNumber: tex-8888888
street: my street
postOfficeBox: postofficebox
displayName: qqdisplay
homePhone: home1111111
mobile: mobile99999
mail: qq@qq.com

# cc, it.com
dn: uid=cc,dc=it,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: cc
cn: cc
sn: cc
userPassword:: MTIzNDU2
telephoneNumber: 138888888
description: openldap test
telexNumber: tex-888888
street: my street
postOfficeBox: postofficebox
displayName: qqdisplay
homePhone: home1111111
mobile: mobile99999
mail: cc@cc.com

# search result
search: 2
result: 0 Success

# numResponses: 4
# numEntries: 3

作者: wolfg 时间: 2006-03-31 09:16
“openldap的安装笔记，请大家多点关注ldap技术。”这个帖子里说了：

关于log的设置：
增加了日志功能，需修改syslog配置文件，在文件中增加一项：
local4.* /var/log/ldap.log
日志级别定义可查相官方网站的文档。1级记录的信息很多。可用于调试。

需要修改/etc/syslog.conf

作者: webyuhang 时间: 2006-07-17 13:02
我也是同样的问题；
more /var/log/messages
Jul 17 11:24:26 rd vsftpd(pam_unix)[25268]: check pass; user unknown
Jul 17 11:24:26 rd vsftpd(pam_unix)[25268]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.1.20
找不到用户，不知道为什么？

欢迎光临 Chinaunix (http://bbs.chinaunix.net/)