Hi,
I have a Sun LDAP server version 5.2 that I am using as a solaris naming
service. Everything is working as expected except for a problem with
sshd and pam. With the following entries in pam.conf everything works
well except that password expiration from the ldap server is ignored.
sshd auth requisite pam_authtok_get.so.1
sshd auth required pam_dhkeys.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1 try_first_pass
sshd account required pam_unix_account.so.1
If I use the following entries in pam.conf everything works including
password expiration unless I use a public key for authentication. If I
have a public key in place I am unable to log in. I get prompted for a
password and that fails. If I remove the public key I am prompted for a
password and get successfully authenticated.
sshd auth requisite pam_authtok_get.so.1
sshd auth required pam_dhkeys.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1 try_first_pass
sshd account sufficient pam_ldap.so.1
sshd account binding pam_unix_account.so.1 server_policy
Here is the ssh client debug output from trying to login with the public
key and the above pam.conf entries.
[vengle@datamart-->]ssh -v sniper
OpenSSH_3.9p1, OpenSSL 0.9.7e 25 Oct 2004
debug1: Reading configuration data /usr/local/etc/ssh_config
debug1: Connecting to sniper [66.43.143.232] port 22.
debug1: Connection established.
debug1: identity file /home/vengle/.ssh/identity type -1
debug1: identity file /home/vengle/.ssh/id_rsa type 1
debug1: identity file /home/vengle/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_3.9p1
debug1: match: OpenSSH_3.9p1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.9p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'sniper' is known and matches the RSA host key.
debug1: Found key in /home/vengle/.ssh/known_hosts:3
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue:
publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/vengle/.ssh/identity
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue:
publickey,password,keyboard-interactive
debug1: Offering public key: /home/vengle/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue:
publickey,password,keyboard-interactive
debug1: Trying private key: /home/vengle/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
Password:
The server accepts the key but continues to try to authenticate me. Any
help or direction would be greatly appreciated.
Thanks,
Vic Engle
