LDAP服务器是可ping的,身份验证与ldap：//完美配合,但与ldaps：//无关.它也适用于debian OS上的ldaps：//,但不适用于CentOS.
我的$ldapsearch也得到了无法联系的错误…但我修复了它在/etc/openldap/ldap.conf中设置TLS_REQCERT允许.但是为/etc/pam_ldap.conf设置它并没有帮助.
我做的步骤：
> $yum install pam_ldap nss-pam-ldapd openldap-clients
> $authconfig-tui并激活LDAP以进行身份验证
>修改/ etc / pam_ldap
>修改/etc/nslcd.conf
>修改/etc/openldap/ldap.conf
>创建/etc/ldap/ldap.conf(在某处读取它是一个后备配置文件路径)
>创建/etc/ldap.conf(与/etc/ldap/ldap.conf具有相同的内容)
>重启服务nscd和nslcd
更多信息：
> LDAP-Server的CA-Cert对每个人都是可读的.
> iptables已禁用
同样令人困惑的是/ var / log / secure中的IP.它表示10.1.1.1中testuser的密码失败,但LDAP服务器的配置IP为10.1.1.42,主机IP为10.1.1.27.无论如何,如果我使用uri ldap：//10.1.1.42并在认证上注释行ssl就像魅力一样.
有任何想法吗？
.
尝试通过pam,/ var / log / secure进行身份验证
Sep 15 09:50:37 client-server unix_chkpwd[16146]: password check Failed for user (testuser) Sep 15 09:50:37 client-server sshd[16144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.1.1.1 user=testuser Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: ldap_simple_bind Can't contact LDAP server Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: reconnecting to LDAP server... Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: ldap_simple_bind Can't contact LDAP server Sep 15 09:50:40 client-server sshd[16144]: Failed password for testuser from 10.1.1.1 port 11339 ssh2 Sep 15 09:50:40 client-server sshd[16145]: Received disconnect from 10.1.1.1: 13: Unable to authenticate
运行$ldapsearch -v -H ldaps：//10.1.1.42/ -D cn = admin,dc = sub,dc = example,dc = org -W -x -b dc = sub,dc = org – d1检查ldaps //是否正常工作. (是的,它有效)
ldap_url_parse_ext(ldaps://10.1.1.42/) ldap_initialize( ldaps://10.1.1.42:636/??base ) ldap_create ldap_url_parse_ext(ldaps://10.1.1.42:636/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.1.1.42:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.1.1.42:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: certificate [CN=sub.example.org,OU=test-ou,O=test-o,ST=test-st,C=DE] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user.. TLS certificate verification: subject: CN=sub.example.org,C=DE,issuer: CN=sub.example.org,cipher: AES-128,security level: high,secret key bits: 128,total key bits: 128,cache hits: 0,cache misses: 0,cache not reusable: 0 ldap_open_defconn: successful ldap_send_server_request ...
/etc/pam_ldap.conf的内容
ldap_version 3 pam_password crypt uri ldaps://10.1.1.42:636 base dc=sub,dc=example,dc=org ssl on tls_reqcert allow tls_cacertfile /srv/ldap-cacert.pem tls_checkpeer no
/etc/openldap/ldap.conf的内容
TLS_REQCERT allow TLS_CACERTFILE /srv/ldap-cacert.pem URI ldaps://10.1.1.42:636/ BASE dc=sub,dc=org
/etc/nslcd.conf的内容
uid nslcd gid ldap ssl on tls_reqcert allow tls_cacertfile /srv/ldap-cacert.pem uri ldaps://10.1.1.42:636/ base dc=sub,dc=org
/etc/ldap.conf和/etc/ldap/ldap.conf的内容：
tls_checkpeer no tls_reqcert allow tls_cacertfile /srv/ldap-cacert.pem uri ldaps://10.1.1.42:636/ base dc=sub,dc=org
TLS: certificate [CN=sub.example.org,cache not reusable: 0
它说：证书……无效…… Peer的证书颁发者已被标记为不被用户信任.这意味着用于颁发服务器证书的CA不受信任.在我看来,CACERTFILE TLS_CACERTFILE /srv/ldap-cacert.pem不包含正确的CA证书.在得到错误清除ldapsearch输出之前它将无法工作.
一旦解决,您可能会因证书的CN而出错.如果您这样做,请尝试使用ldaps：//sub.example.org/作为URI而不是ldaps：//10.1.1.42/.如果您的DNS没有解析该名称,只需将其放在/ etc / hosts文件中(仅用于测试,您应该更新您的DNS记录).