• DNS client- und serverseitig korrekt
• (open)ldap inkl. TLS
• Benutzer in LDAP angelegt (nicht nss_ldap!)
• falls Gruppen in Gruppen verschachtelt (nested groups) werden sollen: RFC2307bis Schema hinzufügen

• Debian ab 8: sssd-ldap sssd-tools ¹⁾

/etc/sssd/sssd.conf

[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
 
[nss]
 
[pam]
 
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
 
ldap_schema = rfc2307
ldap_uri = ldap://vm1.z36.example.org
ldap_search_base = dc=example,dc=org
 
ldap_tls_cacert = /etc/ssl/certs/ca.example.org.cert.pem
 
ldap_default_bind_dn = cn=admin,dc=example,dc=org
ldap_default_authtok = villa
ldap_default_authtok_type = password
 
enumerate = true
cache_credentials = true

chmod 600 /etc/sssd/sssd.conf
sssctl config-check

Fehlersuche:

service sssd stop
sssd -i -d 3

Doku:

• /usr/share/doc/sssd-common/examples/sssd-example.conf
• man sssd-ldap