[midget 14:31] ~ >cat /etc/pam.d/sshd
#
# $FreeBSD: src/etc/pam.d/sshd,v 1.15 2003/04/30 21:57:54 markm Exp $
#
# PAM configuration for the "sshd" service
#
# auth
auth required pam_nologin.so no_warn
auth include system
# account
account include system
# session
session include system
# password
password include system
[midget 14:32] ~ >cat /etc/pam.d/system
#
# $FreeBSD: src/etc/pam.d/system,v 1.1 2003/06/14 12:35:05 des Exp $
#
# System-wide defaults
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
#auth required pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass
auth required pam_unix.so no_warn try_first_pass nullok
# account
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
# session
#session optional pam_ssh.so
session required pam_lastlog.so no_fail
# password
#password required pam_krb5.so no_warn try_first_pass
password sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_pass
[midget 14:02] ~ >cat /etc/nsswitch.conf
group: files ldap
hosts: files dns
networks: files
passwd: files ldap
shells: files
[midget 14:02] ~ >cat /usr/local/etc/ldap.conf
# The distinguished name of the search base.
base dc=dons,dc=net,dc=au
# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldapi://%2fvar%2frun%2fopenldap%2fldapi/
# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
#rootbinddn cn=manager,dc=padl,dc=com
rootbinddn cn=Manager,dc=dons,dc=net,dc=au
# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd ou=People,
# to append the default base DN but this
# may incur a small performance impact.
nss_base_passwd ou=Users,dc=dons,dc=net,dc=au
nss_base_shadow ou=Users,dc=dons,dc=net,dc=au
nss_base_group ou=Group,dc=dons,dc=net,dc=au
timeout 30
bind_timeout 30
TLS_CACERTDIR /etc/ssl/certs
[midget 14:02] ~ >cat /usr/local/etc/nss_ldap.conf
# The distinguished name of the search base.
base dc=dons,dc=net,dc=au
# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldapi://%2fvar%2frun%2fopenldap%2fldapi/
# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd ou=People,
# to append the default base DN but this
# may incur a small performance impact.
nss_base_passwd ou=Users,dc=dons,dc=net,dc=au?one
nss_base_shadow ou=Users,dc=dons,dc=net,dc=au?one
# Short timeouts, we're local
timeout 5
bind_timeout 5
# If the server is down, just fail
bind_policy soft