LDAP服务器是可ping的,身份验证与ldap：//完美配合,但与ldaps：//无关.它也适用于debian OS上的ldaps：//,但不适用于CentOS.

我的$ldapsearch也得到了无法联系的错误…但我修复了它在/etc/openldap/ldap.conf中设置TLS_REQCERT允许.但是为/etc/pam_ldap.conf设置它并没有帮助.

我做的步骤：

> $yum install pam_ldap nss-pam-ldapd openldap-clients
> $authconfig-tui并激活LDAP以进行身份​​验证
>修改/ etc / pam_ldap
>修改/etc/nslcd.conf
>修改/etc/openldap/ldap.conf
>创建/etc/ldap/ldap.conf(在某处读取它是一个后备配置文件路径)
>创建/etc/ldap.conf(与/etc/ldap/ldap.conf具有相同的内容)
>重启服务nscd和nslcd

更多信息：

> LDAP-Server的CA-Cert对每个人都是可读的.
> iptables已禁用

同样令人困惑的是/ var / log / secure中的IP.它表示10.1.1.1中testuser的密码失败,但LDAP服务器的配置IP为10.1.1.42,主机IP为10.1.1.27.无论如何,如果我使用uri ldap：//10.1.1.42并在认证上注释行ssl就像魅力一样.

有任何想法吗？

.

尝试通过pam,/ var / log / secure进行身份验证

Sep 15 09:50:37 client-server unix_chkpwd[16146]: password check Failed for user (testuser)
Sep 15 09:50:37 client-server sshd[16144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.1.1.1  user=testuser
Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: reconnecting to LDAP server...
Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Sep 15 09:50:40 client-server sshd[16144]: Failed password for testuser from 10.1.1.1 port 11339 ssh2
Sep 15 09:50:40 client-server sshd[16145]: Received disconnect from 10.1.1.1: 13: Unable to authenticate

运行$ldapsearch -v -H ldaps：//10.1.1.42/ -D cn = admin,dc = sub,dc = example,dc = org -W -x -b dc = sub,dc = org – d1检查ldaps //是否正常工作. (是的,它有效)

ldap_url_parse_ext(ldaps://10.1.1.42/)
ldap_initialize( ldaps://10.1.1.42:636/??base )
ldap_create
ldap_url_parse_ext(ldaps://10.1.1.42:636/??base)
Enter LDAP Password:
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 10.1.1.42:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.1.1.42:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: certificate [CN=sub.example.org,OU=test-ou,O=test-o,ST=test-st,C=DE] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
TLS certificate verification: subject: CN=sub.example.org,C=DE,issuer: CN=sub.example.org,cipher: AES-128,security level: high,secret key bits: 128,total key bits: 128,cache hits: 0,cache misses: 0,cache not reusable: 0
ldap_open_defconn: successful
ldap_send_server_request
...

/etc/pam_ldap.conf的内容

ldap_version 3
pam_password crypt
uri ldaps://10.1.1.42:636
base dc=sub,dc=example,dc=org
ssl on
tls_reqcert allow
tls_cacertfile /srv/ldap-cacert.pem
tls_checkpeer no

/etc/openldap/ldap.conf的内容

TLS_REQCERT allow
TLS_CACERTFILE /srv/ldap-cacert.pem
URI ldaps://10.1.1.42:636/
BASE dc=sub,dc=org

/etc/nslcd.conf的内容

uid nslcd
gid ldap
ssl on
tls_reqcert allow
tls_cacertfile /srv/ldap-cacert.pem
uri ldaps://10.1.1.42:636/
base dc=sub,dc=org

/etc/ldap.conf和/etc/ldap/ldap.conf的内容：

tls_checkpeer no
tls_reqcert allow
tls_cacertfile /srv/ldap-cacert.pem
uri ldaps://10.1.1.42:636/
base dc=sub,dc=org