LFCS · Question #128
After configuring PAM and NSS to integrate with OpenLDAP, the SSH server refuses to authenticate users who are only in LDAP. What is the first step you should follow to debug this problem?
The correct answer is B. Restart the sshd service. After modifying PAM/NSS for LDAP integration, restarting the sshd service is the first debugging step to ensure it loads the updated authentication configurations.
Question
Options
- ARestart the pamd service.
- BRestart the sshd service.
- CRestart the nssd service.
- DAdd the Use_LDAP = yes parameter to sshd_config.
How the community answered
(26 responses)- A4% (1)
- B92% (24)
- D4% (1)
Why each option
After modifying PAM/NSS for LDAP integration, restarting the `sshd` service is the first debugging step to ensure it loads the updated authentication configurations.
`pamd` is not a service that can be restarted; PAM (Pluggable Authentication Modules) is a framework that services like `sshd` utilize, and changes to PAM configuration files are only effective for a service after that specific service is restarted.
When PAM and NSS configurations are modified to integrate with OpenLDAP, the `sshd` service needs to be restarted for it to reload the updated authentication and name service lookup configurations. Until `sshd` is restarted, it will continue to use the older PAM/NSS settings, leading to authentication failures for LDAP users.
`nssd` is not a standard service related to NSS (Name Service Switch); while `nscd` (Name Service Cache Daemon) can be restarted, restarting `sshd` is the more direct and primary action to ensure new NSS configurations are applied to SSH.
The `sshd_config` file does not have a `Use_LDAP = yes` parameter for direct LDAP integration; SSH delegates user authentication to PAM, which then handles the integration with LDAP through its modules.
Concept tested: SSH/PAM/NSS/LDAP debugging
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_authentication_and_authorization/configuring-ldap-authentication_managing-authentication-and-authorization
Topics
Community Discussion
No community discussion yet for this question.