SSH+Active Directory (kerberos)

но к результату это не привело

А в чем собственно была конкретная проблема?

nss_ldap в упор не мог достучаться до AD. Наверно nss_ldap для OpenLDAP больше оптимизирован :)

nss_ldap в упор не мог достучаться до AD.

Ну так давайте настройки, логи, ошибки.

настройки:

ldap.conf

base dc=office,dc=com
uri ldap://194.84.5.5
ldap_version 3
binddn cn=Users,cn=admin,dc=office,dc=com
bindpw MyPassword
scope sub
pam_password md5
# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad

nsswitch.conf

passwd: files ldap compat
group: files ldap compat
shadow: files ldap compat

hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

netgroup: nis

common-account.

# here are the per-package modules (the «Primary» block)
account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=1 default=ignore] pam_ldap.so
# here's the fallback if no module succeeds
account requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the «Additional» block)
# end of pam-auth-update config

common-auth.

# here are the per-package modules (the «Primary» block)
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_ldap.so use_first_pass
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the «Additional» block)
# end of pam-auth-update config

common-password.

# here are the per-package modules (the «Primary» block)
password [success=2 default=ignore] pam_unix.so obscure sha512
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
# and here are more per-package modules (the «Additional» block)
password optional pam_gnome_keyring.so
# end of pam-auth-update config


common-session.

# here are the per-package modules (the «Primary» block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# and here are more per-package modules (the «Additional» block)
session required pam_unix.so
session optional pam_ldap.so
session optional pam_ck_connector.so nox11
# end of pam-auth-update config

в ssh.conf

UsePAM yes

Далее пробуем зайти в ssh'ом на Linux:


root@ADMiN:/etc#

ssh admin@192.168.85.150
admin@192.168.85.150's password:
Permission denied, please try again.

ОШИБКА в логах:

Jun 9 15:16:01 ADMiN mc: nss_ldap: failed to bind to LDAP server ldap://194.84.5.5: Invalid credentials
Jun 9 15:16:01 ADMiN mc: nss_ldap: could not search LDAP server - Server is unavailable

>Jun 9 15:16:01 ADMiN mc: nss_ldap: failed to bind to LDAP server ldap://194.84.5.5: Invalid credentials

Invalid credentials

binddn cn=Users,cn=admin,dc=office,dc=com

Ололошеньки. Может, cn=admin,cn=Users,dc=office,dc=com.
BTW. А AD не позволит подключиться анонимно для авторизации? А то использовать binddn - моветон вобще. Очень часто вижу такой стиль, но это есть неправильно.

пробовал также. не помогло.

nss_ldap: failed to bind to LDAP server ldap://domain.office.com nss_ldap: could not search LDAP server - Server is unavailable

> это есть неправильно

А что есть правильно, и почему (не флейма ради, просвещенья для)?

Пример для slapd.conf (думаю, AD можно настроить аналогично):

access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword,s
ambaPwdLastSet,sambaPwdMustChange
        by anonymous auth
        by self write
        by * none

access to dn.base="" by * read