I am running into an issue getting LDAP to work alongside Centrify. We are making a switch from LDAP to Centrify and there are stages to that move. We aren't moving everything at once and this is making it to where we need to have them both working side by side. We need Centrify to be the first in the order, due to the Auditing piece. I have walked through a handful of configurations, however they all lead to LDAP not being able to login, we get the below Error:
ssh testuser@testserver
[LDAP]: 3004-300 You entered an invalid login name or password.
[LDAP]: 3004-300 You entered an invalid login name or password.
[LDAP]: 3004-300 You entered an invalid login name or password.
Received disconnect from 7.7.7.7 port 22:2: Too many authentication failures
Disconnected from 7.7.7.7 port 22
Below are the snippets from a couple configs:
# pam.conf #
########################################################################
# Centrify DirectControl + AIX PAM (Clean Structured Version)
########################################################################
############################
# SSHD
############################
sshd auth sufficient pam_centrifydc
sshd auth requisite pam_centrifydc deny
sshd auth requisite pam_permission
sshd auth required pam_aix
sshd account sufficient pam_centrifydc
sshd account requisite pam_centrifydc deny
sshd account required pam_aix
sshd password sufficient pam_centrifydc try_first_pass
sshd password requisite pam_centrifydc deny
sshd password required pam_aix
sshd session required pam_centrifydc homedir
sshd session required pam_aix
############################
# LOGIN
############################
login auth sufficient pam_centrifydc
login auth requisite pam_centrifydc deny
login auth requisite pam_permission
login auth required pam_aix
login account sufficient pam_centrifydc
login account requisite pam_centrifydc deny
login account required pam_aix
login password sufficient pam_centrifydc try_first_pass
login password requisite pam_centrifydc deny
login password required pam_aix
login session required pam_centrifydc homedir
login session required pam_aix
login session optional pam_mkuserhome
############################
# SU
############################
su auth sufficient pam_centrifydc enable_dzpamgate
su auth requisite pam_centrifydc deny
su auth sufficient pam_allowroot
su auth required pam_aix
su account sufficient pam_centrifydc
su account requisite pam_centrifydc deny
su account sufficient pam_allowroot
su account required pam_aix
su password sufficient pam_centrifydc try_first_pass
su password requisite pam_centrifydc deny
su password required pam_aix
su session required pam_centrifydc homedir
su session required pam_aix
############################
# DZDO
############################
dzdo auth sufficient pam_centrifydc
dzdo auth requisite pam_centrifydc deny
dzdo auth requisite pam_permission
dzdo auth required pam_aix
dzdo account sufficient pam_centrifydc
dzdo account requisite pam_centrifydc deny
dzdo account required pam_aix
dzdo password sufficient pam_centrifydc try_first_pass
dzdo password requisite pam_centrifydc deny
dzdo password required pam_aix
dzdo session required pam_centrifydc homedir
dzdo session required pam_aix
dzdo session optional pam_mkuserhome
############################
# SUDO
############################
sudo auth sufficient pam_centrifydc
sudo auth requisite pam_centrifydc deny
sudo auth required pam_aix
sudo account sufficient pam_centrifydc
sudo account requisite pam_centrifydc deny
sudo account required pam_aix
sudo password sufficient pam_centrifydc try_first_pass
sudo password requisite pam_centrifydc deny
sudo password required pam_aix
sudo session required pam_centrifydc homedir
sudo session required pam_aix
############################
# RLOGIN / RSH (with rhosts)
############################
rlogin auth sufficient pam_rhosts_auth
rlogin auth sufficient pam_centrifydc
rlogin auth requisite pam_centrifydc deny
rlogin auth requisite pam_permission
rlogin auth required pam_aix
rlogin account sufficient pam_centrifydc
rlogin account requisite pam_centrifydc deny
rlogin account required pam_aix
rlogin password sufficient pam_centrifydc try_first_pass
rlogin password requisite pam_centrifydc deny
rlogin password required pam_aix
rlogin session required pam_centrifydc homedir
rlogin session required pam_aix
rlogin session optional pam_mkuserhome
rsh auth required pam_rhosts_auth
rsh auth sufficient pam_centrifydc
rsh auth requisite pam_centrifydc deny
rsh auth requisite pam_permission
rsh auth required pam_aix
rsh account sufficient pam_centrifydc
rsh account requisite pam_centrifydc deny
rsh account required pam_aix
rsh session required pam_centrifydc homedir
rsh session required pam_aix
############################
# FTP / TELNET / REXEC
############################
ftp auth sufficient pam_centrifydc
ftp auth requisite pam_centrifydc deny
ftp auth requisite pam_permission
ftp auth required pam_aix
ftp account sufficient pam_centrifydc
ftp account requisite pam_centrifydc deny
ftp account required pam_aix
ftp session required pam_centrifydc homedir
ftp session required pam_aix
telnet auth sufficient pam_centrifydc
telnet auth requisite pam_centrifydc deny
telnet auth requisite pam_permission
telnet auth required pam_aix
telnet account sufficient pam_centrifydc
telnet account requisite pam_centrifydc deny
telnet account required pam_aix
telnet password sufficient pam_centrifydc try_first_pass
telnet password requisite pam_centrifydc deny
telnet password required pam_aix
telnet session required pam_centrifydc homedir
telnet session required pam_aix
telnet session optional pam_mkuserhome
rexec auth sufficient pam_centrifydc
rexec auth requisite pam_centrifydc deny
rexec auth required pam_aix
rexec account sufficient pam_centrifydc
rexec account requisite pam_centrifydc deny
rexec account required pam_aix
rexec session required pam_centrifydc homedir
rexec session required pam_aix
############################
# WEB / SYSTEM SERVICES
############################
websm_rlogin auth sufficient pam_rhosts_auth
websm_rlogin auth sufficient pam_centrifydc
websm_rlogin auth requisite pam_centrifydc deny
websm_rlogin auth required pam_aix use_new_state
websm_rlogin account sufficient pam_centrifydc
websm_rlogin account requisite pam_centrifydc deny
websm_rlogin account required pam_aix mode=S_RLOGIN
websm_rlogin password sufficient pam_centrifydc try_first_pass
websm_rlogin password requisite pam_centrifydc deny
websm_rlogin password required pam_aix use_new_state try_first_pass
websm_rlogin session required pam_centrifydc homedir
websm_rlogin session required pam_aix
websm_su auth sufficient pam_centrifydc
websm_su auth requisite pam_centrifydc deny
websm_su auth sufficient pam_aix
websm_su auth required pam_aix
websm_su account sufficient pam_centrifydc
websm_su account requisite pam_centrifydc deny
websm_su account sufficient pam_aix mode=S_SU
websm_su account required pam_aix mode=S_SU
websm_su password sufficient pam_centrifydc try_first_pass
websm_su password requisite pam_centrifydc deny
websm_su password required pam_aix try_first_pass
websm_su session required pam_centrifydc homedir
websm_su session required pam_aix
############################
# OTHER / DEFAULT
############################
OTHER auth sufficient pam_centrifydc
OTHER auth requisite pam_centrifydc deny
OTHER auth required pam_prohibit
OTHER account sufficient pam_centrifydc
OTHER account requisite pam_centrifydc deny
OTHER account required pam_prohibit
OTHER password sufficient pam_centrifydc try_first_pass
OTHER password requisite pam_centrifydc deny
OTHER password required pam_prohibit
OTHER session required pam_centrifydc homedir
OTHER session required pam_prohibit
#################################################################
# /etc/methods.cfg #
NIS:
program = /usr/lib/security/NIS
program_64 = /usr/lib/security/NIS_64
DCE:
program = /usr/lib/security/DCE
program_64 = /usr/lib/security/DCE
PAM:
program = /usr/lib/security/PAM
program_64 = /usr/lib/security/PAM
options = auth=PAM,db=BUILTIN
LDAP:
program = /usr/lib/security/LDAP
program_64 = /usr/lib/security/LDAP64
*CENTRIFYDAMODIFY CENTRIFYDC:
*CENTRIFYDAMODIFY program = /usr/lib/security/CENTRIFYDC
*CENTRIFYDAMODIFY program_64 = /usr/lib/security/CENTRIFYDC64
*CENTRIFYDAMODIFY options = noprompt
CENTRIFYDC:
program = /usr/lib/security/CENTRIFYDA
program_64 = /usr/lib/security/CENTRIFYDA64
options = noprompt
CENTRIFYDALOCAL:
program = /usr/lib/security/CENTRIFYDALOCAL
program_64 = /usr/lib/security/CENTRIFYDALOCAL64
options = noprompt
#################################################################
# /etc/security/login.cfg #
default:
sak_enabled = false
logintimes =
logindisable = 0
logininterval = 0
loginreenable = 0
logindelay = 10
herald = "\r\n NOTICE:\r\n\r\n Access to this computer system/network and the information on it is the\r\n property of The TEST and is intended only for employees and other\r\n users properly authorized by The TEST. It is to be accessed only\r\n for proper business purposes in accordance with TEST Policies,\r\n Standards and Guidelines. Unauthorized access or improper use of this\r\n system/network and the information on it will be cause for disciplinary\r\n action, up to and including termination and may be a criminal offense\r\n resulting in criminal prosecution and/or civil liability.\r\n\r\nlogin: "
logintimeout = 30
*/dev/console:
* synonym = /dev/tty0
usw:
auth_type = PAM_AUTH
logintimeout = 30
maxlogins = 32767
mkhomeatlogin = true
* auth_type = STD_AUTH
* pwd_algorithm = sblowfish
* pwd_algorithm = smd5
shells = /bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/bin/bash,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd,/usr/bin/bash,/bin/defaultshell,/usr/bin/defaultshell,/uv/bin/uv,/bin/false,/usr/bin/dzsh,/bin/cdax/bash,/bin/cdax/bsh,/bin/cdax/csh,/bin/cdax/defaultshell,/bin/cdax/ksh,/bin/cdax/ksh93,/bin/cdax/sh,/bin/cdax/tsh,/usr/bin/cdax/bash,/usr/bin/cdax/bsh,/usr/bin/cdax/csh,/usr/bin/cdax/dzsh,/usr/bin/cdax/defaultshell,/usr/bin/cdax/ksh,/usr/bin/cdax/ksh93,/usr/bin/cdax/rksh,/usr/bin/cdax/rksh93,/usr/bin/cdax/sh,/usr/bin/cdax/tsh,/usr/sbin/cdax/sliplogin,/usr/sbin/cdax/snappd,/usr/sbin/uucp/cdax/uucico,/bin/centrifyda
pwd_algorithm = ssha256
unix_passwd_compat = true
logindelay = 10
###########################################################
# /etc/netsvc.conf #
hosts = local4, bind4
sudoers = ldap, files
passwd = centrifydc, ldap, files
group = centrifydc, ldap, files
###########################################################
# /etc/security/user # (defaults)
default:
auth1 = SYSTEM
auth2 = NONE
account_locked = false
admgroups =
admin = false
daemon = true
default_roles =
dictionlist = /usr/local/etc/pwddictionary.dat
expires = 0
login = false
logintimes =
histexpire = 26
histsize = 50
loginretries = 5
minage = 0
maxage = 0
maxexpired = -1
minalpha = 3
minother = 3
minlen = 14
mindiff = 6
maxrepeats = 0
pwdchecks =
pwdwarntime = 30
rlogin = true
su = true
sugroups = ALL
tpath = nosak
ttys = ALL
umask = 027
* SYSTEM = "LDAP or compat"
minrepeats = 4
mindigit = 1
minloweralpha = 1
minupperalpha = 1
minspecialchar = 1
SYSTEM = "CENTRIFYDC AND CENTRIFYDALOCAL OR (LDAP OR compat)"
* SYSTEM = "CENTRIFYDC OR (CENTRIFYDC[NOTFOUND] AND CENTRIFYDALOCAL) OR (CENTRIFYDALOCAL[NOTFOUND] AND (LDAP OR compat))"
###########################################################
# /etc/security/ldap/ldap.cfg #
ldapservers:unixldap.test.us,2.2.2.2,3.3.3.3
binddn:cn=LDAPUNIX,ou=UNIX,ou=DATACENTER,o=XXXAUTH
bindpwd:XxXxX
authtype:ldap_auth
useSSL: yes
ldapsslkeyf:/etc/security/ldap/clientkey.kdb
userattrmappath:/etc/security/ldap/2307user.map
groupattrmappath:/etc/security/ldap/2307group.map
userbasedn:ou=Accounts,ou=UNIX,ou=DATACENTER,o=XXXAUTH??(|(groupmembership=cn=RPAU_N_UT_Unix-Servers,ou=Resource,ou=Groups,ou=UNIX,ou=DATACENTER,o=XXXAUTH)(groupmembership=cn=RPAU_N_UT_Unix-Server-testserver,ou=Resource,ou=Groups,ou=UNIX,ou=DATACENTER,o=XXXAUTH))
userbasedn:ou=XXXUSERS,ou=USERS,o=XXXAUTH??(|(groupmembership=cn=RPAU_N_UT_Unix-Servers,ou=Resource,ou=Groups,ou=UNIX,ou=DATACENTER,o=XXXAUTH)(groupmembership=cn=RPAU_N_UT_Unix-Server-testserver,ou=Resource,ou=Groups,ou=UNIX,ou=DATACENTER,o=XXXAUTH))
groupbasedn:ou=UNIX,ou=DATACENTER,o=XXXAUTH??(gidnumber<=20000)
userclasses:posixAccount
groupclasses:posixGroup
ldapversion:3
ldapport:389
ldapsslport:636
defaultentrylocation:local
ldaptimeout:90
memberfulldn: yes
host unixldap.test.us
base ou=HNBUSERS,ou=USERS,o=XXXAUTH
binddn cn=LDAPUNIX,ou=UNIX,ou=DATACENTER,o=XXXAUTH
bindpw XxXxX
SUDOERS_SEARCH_FILTER (sudoHost=testserver)
SUDOERS_BASE ou=sudoers,ou=UNIX,ou=DATACENTER,o=XXXAUTH
I have ran it through AI with recommendations and still hitting same error, it is seems to be a PAM issue with the "FAILBACK" side of things. Just haven't been able to figure it out.
------------------------------
Joshua Krause
------------------------------