ldap 用户登录不了

aca_jingru

ldap client ，远程ssh 连接，输密码就马上连接就被关了，看本机的日志 /var/log/secure 如下:
ldap_initialize Bad parameter to an ldap routine
Failed password for gqdw from 192.168.1.4 port 14722 ssh2
fatal: Access denied for user gqdw by PAM account configuration

ldap server 没有报错信息。
怀疑问题出在client端。

cat /etc/pam.d/sshd
#%PAM-1.0
auth           required        pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth


cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_mkhomedir.so skel=/etc/skel umask=077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so


cat /etc/openldap/ldap.conf
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE        dc=example,dc=com
#URI        ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT        12
#TIMELIMIT        15
#DEREF                never
#host                dhcp.master.com

#TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://192.168.1.9
BASE dc=master,dc=com
TLS_CACERTDIR /etc/openldap/cacerts