In this exercise, you will need to troubleshoot and resolve authentication issues with LDAP, Kerberos, and PAM.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Troubleshoot and resolve Server1.
Resolve login issues for
testuser01Try to log in as
testuser01:ssh testuser01@localhostView
/var/log/secure:tail /var/log/secureAttempt to pull the LDAP user information for
testuser01:getent passwd testuser01Perform an LDAP search:
ldapsearch -x *View and modify
/etc/openldap/ldap.conf:vim /etc/openldap/ldap.confChange:
URI ldap://ldap.example.com/To:
URI ldap://auth.example.com/Perform an LDAP search:
ldapsearch -x *Restart the LDAP naming services daemon:
systemctl restart nslcdAttempt to pull the LDAP user information for
testuser01:getent passwd testuser01View
/etc/sysconfig/authconfig:cat /etc/sysconfig/authconfigModify
authconfigusing the TUI interface:authconfig-tuiWithin
authconfig-tui:- Verify Use LDAP is checked under User Information
- Check Use Kerberos under Authentication
- Modify the LDAP server to use auth.example.com
- Use auth.example.com for the KDC and Admin Server for Kerberos
Restart the LDAP naming services daemon:
systemctl restart nslcdPull the LDAP user information for
testuser01:getent passwd testuser01Log in to the localhost as
testuser01:ssh testuser01@localhostObtain a Kerberos ticket
kinitList cached Kerberos tickets and logout:
klist && exitResolve Samba issues for
cloud_userVerify Samba is started and enabled:
systemctl start smb && systemctl enable smbAttempt to list the shares using
cloud_user:smbclient -U cloud_user -L localhostView the Samba log:
tail /var/log/samba/log.smbdView the Samba PAM config:
cat /etc/pam.d/sambaVerify the Samba package:
rpm -V sambaMove the modified file to
/root/samba.pam.old:mv /etc/pam.d/samba /root/samba.pam.oldReinstall Samba:
yum reinstall -y sambaList the shares using
cloud_user:smbclient -U cloud_user -L localhost- Troubleshoot and resolve Server2.
Use
authconfig-tuito verify and modify LDAP/Kerberos authentication:authconfig-tui- Verify Use LDAP is checked for both User Information and Authentication
- Verify Use Kerberos is checked for Authentication
- LDAP server should be auth.example.com
- Kerberos KDC and Admin should be auth.example.com
Perform an LDAP search:
ldapsearch -x *Ping the LDAP server:
ping auth.example.comNote the IP, view the contents of
/etc/hosts:cat /etc/hostsModify
/etc/hostsso that auth.example.com points to 10.0.1.5:vim /etc/hostsPerform an LDAP search:
ldapsearch -x *Restart the LDAP naming services daemon:
systemctl restart nslcdPull the LDAP user information for
testuser01:getent passwd testuser01Log in as
testuser01:ssh testuser01@localhostObtain a Kerberos ticket:
kinitList Kerberos ticket cache:
klist
