[midget 14:31] ~ >cat /etc/pam.d/sshd
#
# $FreeBSD: src/etc/pam.d/sshd,v 1.15 2003/04/30 21:57:54 markm Exp $
#
# PAM configuration for the "sshd" service
#

# auth
auth            required        pam_nologin.so          no_warn
auth            include         system

# account
account         include         system

# session
session         include         system

# password
password        include         system

[midget 14:32] ~ >cat /etc/pam.d/system
#
# $FreeBSD: src/etc/pam.d/system,v 1.1 2003/06/14 12:35:05 des Exp $
#
# System-wide defaults
#

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
#auth           required        pam_krb5.so             no_warn try_first_pass
#auth           sufficient      pam_ssh.so              no_warn try_first_pass
auth            sufficient      /usr/local/lib/pam_ldap.so no_warn try_first_pass
auth            required        pam_unix.so             no_warn try_first_pass nullok


# account
#account        required        pam_krb5.so
account         required        pam_login_access.so
account         required        pam_unix.so

# session
#session        optional        pam_ssh.so
session         required        pam_lastlog.so          no_fail

# password
#password       required        pam_krb5.so             no_warn try_first_pass
password        sufficient      /usr/local/lib/pam_ldap.so no_warn try_first_pass
password        required        pam_unix.so             no_warn try_first_pass

[midget 14:02] ~ >cat /etc/nsswitch.conf
group: files ldap
hosts: files dns
networks: files
passwd: files ldap
shells: files

[midget 14:02] ~ >cat /usr/local/etc/ldap.conf
# The distinguished name of the search base.
base dc=dons,dc=net,dc=au

# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldapi://%2fvar%2frun%2fopenldap%2fldapi/

# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
#rootbinddn cn=manager,dc=padl,dc=com
rootbinddn cn=Manager,dc=dons,dc=net,dc=au

# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX          base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd       ou=People,
# to append the default base DN but this
# may incur a small performance impact.
nss_base_passwd         ou=Users,dc=dons,dc=net,dc=au
nss_base_shadow         ou=Users,dc=dons,dc=net,dc=au
nss_base_group          ou=Group,dc=dons,dc=net,dc=au

timeout                 30
bind_timeout            30

TLS_CACERTDIR /etc/ssl/certs

[midget 14:02] ~ >cat /usr/local/etc/nss_ldap.conf
# The distinguished name of the search base.
base dc=dons,dc=net,dc=au

# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldapi://%2fvar%2frun%2fopenldap%2fldapi/

# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX          base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd       ou=People,
# to append the default base DN but this
# may incur a small performance impact.
nss_base_passwd ou=Users,dc=dons,dc=net,dc=au?one
nss_base_shadow ou=Users,dc=dons,dc=net,dc=au?one

# Short timeouts, we're local
timeout                 5
bind_timeout            5

# If the server is down, just fail
bind_policy             soft