Fedora Directory Server

[Wall, Patrick]

Hi. 

I'm new to using Fedora Directory Server, so please pardon me if this is
a newbie question. 
The directory server was setup by someone else, and has been running for
many months, so unfortunately, I don't have much background information
on how it was setup.  I searched thru various on-line helps and it
appears to be setup properly as it is working for various userids. 
However, there are a few userids defined, that no matter what I set the
passwd to, if one attempts to login as one of those users: "Access
denied". 

I can create a new user, set a passwd, log in no problem (it'll create
the home directory and everything).  
I've even tried deleting the userid that doesn't work, and then
re-creating, same issue. Doesn't like the passwd. 
(all userids are created the same, just different home paths and UID
numbers.

Any thoughts?


	Patrick

[Kwan Lowe]

2010/3/15 Wall, Patrick <patrick.wall(a)tc.gc.ca&gt;:
>  Hi.
>
>  I'm new to using Fedora Directory Server, so please pardon me if this is a
>  newbie question.
>  The directory server was setup by someone else, and has been running for
>  many months, so unfortunately, I don't have much background information on
>  how it was setup.  I searched thru various on-line helps and it appears to
>  be setup properly as it is working for various userids.
>
>  However, there are a few userids defined, that no matter what I set the
>  passwd to, if one attempts to login as one of those users: "Access denied".
>  

You might want to check the system to see if those IDs are defined
locally. You may have some specific permissions set locally for those
users (or maybe the password itself is wrong).

[Wall, Patrick]

Thanks for the quick reply. 
All the ID's for the fedora directory server users are different from the local ones.

There are no matching userids/ids in the directory server and the local passwd files.  



Regards, 
Patrick

-----Original Message-----
From: 389-users-bounces(a)lists.fedoraproject.org
[mailto:[e-mail]] On Behalf Of Kwan Lowe
Sent: Monday, March 15, 2010 4:29 PM
To: General discussion list for the 389 Directory server project.
Subject: Re: [389-users] Fedora Directory Server

2010/3/15 Wall, Patrick <patrick.wall(a)tc.gc.ca&gt;:
>  Hi.
>
>  I'm new to using Fedora Directory Server, so please pardon me if this 
>  is a newbie question.
>  The directory server was setup by someone else, and has been running 
>  for many months, so unfortunately, I don't have much background 
>  information on how it was setup.  I searched thru various on-line 
>  helps and it appears to be setup properly as it is working for various userids.
>
>  However, there are a few userids defined, that no matter what I set 
>  the passwd to, if one attempts to login as one of those users: "Access
> denied".
>  

You might want to check the system to see if those IDs are defined locally. You may have
some specific permissions set locally for those users (or maybe the password itself is
wrong).
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

[Kwan Lowe]

On Mon, Mar 15, 2010 at 4:31 PM, Wall, Patrick <patrick.wall(a)tc.gc.ca&gt; wrote:
>  Thanks for the quick reply.
>  All the ID's for the fedora directory server users are different from the local
> ones.
>  There are no matching userids/ids in the directory server and the local passwd files.
>  
How about the user numbers themselves?  It is possible to use the UID
number as a filter. Are the failing IDs all under 500 or some other
limit?

[Kwan Lowe]

On Mon, Mar 15, 2010 at 4:31 PM, Wall, Patrick <patrick.wall(a)tc.gc.ca&gt; wrote:
>  Thanks for the quick reply.
>  All the ID's for the fedora directory server users are different from the local
> ones.
>  There are no matching userids/ids in the directory server and the local passwd files.
>  
BTW, what are the client machines running?  If they are Linux systems,
you may want to peek at the /var/log/secure logfile. It should tell
you why the account is being denied.

[Wall, Patrick]

It basically tells me the passwd is incorrect.  Yet I know it's not.
I've reset it a few times, trying different passwds.  
Here is what /var/tmp/secure has to say (note: I have intentionally
blocked out the IP Address and userid for security reasons):

Mar 15 16:40:45 nodexxx sshd[30277]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=nodeyyy@can'tsay
user=USERID
Mar 15 16:40:45 nodexxx sshd[30277]: pam_ldap: error trying to bind as
user "uid=USERID,dc=XX, dc=YY, dc=ZZ" (Invalid credentials)
Mar 15 16:40:47 nodexxx sshd[30277]: Failed password for USERID from
IP_ADDRESS port 3235 ssh2
Mar 15 16:40:54 nodexxx sshd[30277]: pam_ldap: error trying to bind as
user "uid=USERID,dc=XX, dc=YY, dc=ZZ" (Invalid credentials)
Mar 15 16:40:56 nodexxx sshd[30277]: Failed password for USERID from
IP_ADDRESS port 3235 ssh2 


As in a previous note, I can create a new userid, and it works just
fine!  Argh.....


Regards, 
Patrick

-----Original Message-----
From: 389-users-bounces(a)lists.fedoraproject.org
[mailto:[e-mail]] On Behalf Of Kwan
Lowe
Sent: Monday, March 15, 2010 4:37 PM
To: General discussion list for the 389 Directory server project.
Subject: Re: [389-users] Fedora Directory Server

On Mon, Mar 15, 2010 at 4:31 PM, Wall, Patrick <patrick.wall(a)tc.gc.ca
>  
wrote:
>  Thanks for the quick reply.
>  All the ID's for the fedora directory server users are different from 
the local
ones.
>  There are no matching userids/ids in the directory server and the
local passwd files.
>  
BTW, what are the client machines running?  If they are Linux systems,
you may want to peek at the /var/log/secure logfile. It should tell you
why the account is being denied.
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users

[Kwan Lowe]

On Mon, Mar 15, 2010 at 4:45 PM, Wall, Patrick <patrick.wall(a)tc.gc.ca&gt; wrote:
>  It basically tells me the passwd is incorrect.  Yet I know it's
> not.
>  I've reset it a few times, trying different passwds.
>  Here is what /var/tmp/secure has to say (note: I have intentionally
>  blocked out the IP Address and userid for security reasons): 
How about the UIDs or groups?  Do you see anything in common with the
ones that are failing?

There could be some local settings preventing login.. Have you checked
the faillog? It looks like sshd itself is throwing the initial
failure, so that might even rule out ldap.