FreeBSD 13 – LDAP-Based Logins Fail via nss_ldap – Directory Auth Recovery

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Directory-backed users cannot authenticate, impacting shell access and sudo policy.

Environment & Reproduction

Seen after DNS/TLS certificate changes or LDAP endpoint migration.

id 
getent passwd 

Root Cause Analysis

Name service and PAM LDAP components cannot reach or trust directory services.

Quick Triage

Validate resolver, time sync, and LDAP endpoint connectivity.

drill ldap.example.com
openssl s_client -connect ldap.example.com:636 </dev/null

Step-by-Step Diagnosis

Review nsswitch, PAM, and LDAP client configuration for breakpoints.

cat /etc/nsswitch.conf
cat /usr/local/etc/nslcd.conf
tail -n 160 /var/log/auth.log

Solution – Primary Fix

Correct LDAP URI/base DN/TLS settings and restart identity services.

service nslcd restart
service nscd restart || true

Solution – Alternative Approaches

Use local break-glass admin accounts when directory infrastructure is unavailable.

Verification & Acceptance Criteria

Directory users resolve and authenticate through SSH and console paths.

getent passwd 
ssh @localhost

Rollback Plan

Restore previous LDAP client config and cert bundle if new endpoint fails.

Prevention & Hardening

Monitor directory health and cert expiry with authentication smoke tests.

Related Errors & Cross-Refs

pam_ldap: Authentication failure, user unknown in passwd database.

Related tutorial: View the step-by-step tutorial for freebsd-13.

View all freebsd-13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD LDAP integration, PAM, and nsswitch configuration documentation.