I am trying to configure a Debian Testing system to authenticate against my office LDAP server.
I installed libldap, libnss-ldap, libpam-ldap, libnss-db and libpam-ccreds. Everything works with the LDAP server connected, but when I disconnect the network, the login screen fails, and a "su xxxx" gives: Password: You have been logged on using cached credentials. su: Authentication failure cc_dump shows my passwords are cached. Unfortunately, I havne't found a up to date Debian howto for LDAP+Cache and have been trying to configure base on out of date and Ubuntu instructions. Anyone know how to fix the problem? --Stuart my /etc/nsswitch.conf is: ------------------------------- # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat ldap [NOTFOUND=return] db group: compat ldap [NOTFOUND=return] db shadow: compat ldap [NOTFOUND=return] db hosts: files dns ldap networks: files ldap protocols: db files services: db files ethers: db files rpc: db files netgroup: ldap ------------------------------------ pam.d/common.auth --------------------------------- # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) auth [success=4 default=ignore] pam_unix.so nullok_secure try_first_pass auth [authinfo_unavail=ignore success=3 default=ignore] pam_ldap.so use_first_pass auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 action=validate use_first_pass auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth optional pam_ccreds.so minimum_uid=1000 action=store # end of pam-auth-update config -------------------------------------------- pam.d/common-password ------------------------------------ # # /etc/pam.d/common-password - password-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define the services to be # used to change user passwords. The default is pam_unix. # Explanation of pam_unix options: # # The "sha512" option enables salted SHA512 passwords. Without this option, # the default is Unix crypt. Prior releases used the option "md5". # # The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in # login.defs. # # See the pam_unix manpage for other options. # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) password [success=2 default=ignore] pam_unix.so obscure sha512 password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config ---------------------------------------------------------
