Доброго времени!
Хочу попросить сообщество помочь разобраться.

Система freeBSD 8.2 PDC Samba3.6 + LDAP, TLS.

Не работает аутентификация ч-з LDAP
===============================================================
pkg_info | grep _ldap
nss_ldap-1.265_7    RFC 2307 NSS module
pam_ldap-1.8.6_2    A pam module for authenticating with LDAP
==============================================================

Конфиги

rc.conf

.......
#enable Samba
samba_enable="YES"
winbindd_enable=YES

#slapd
slapd_enable="YES"
slapd_flags='-h "ldaps:///  ldapi:///var/run/openldap/ldapi/ ldaps://localhost/ ldaps://192.168.0.4/"'

..............
===================================================================
slapd.conf

include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include         /usr/local/etc/openldap/schema/samba.schema

loglevel 256

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args
modulepath      /usr/local/libexec/openldap
moduleload      back_bdb
password-hash {SSHA} {MD5} {SHA}
TLSCertificateFile      /usr/local/etc/openldap/ssl/ldapscert.pem
TLSCertificateKeyFile   /usr/local/etc/openldap/ssl/keys/ldapskey.pem
TLSCipherSuite          TLSv1+RSA:!NULL
disallow bind_anon
require bind
security simple_bind=128
database        bdb
suffix          "dc=smbdomain,dc=local"
rootdn          "cn=Manager,dc=smbdomain,dc=local"
rootpw          {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXX

directory       /var/db/openldap-data

index   objectClass     eq
index   cn              pres,sub,eq
index   sn              pres,sub,eq
index   uid             pres,sub,eq
index   displayName     pres,sub,eq
index   uidNumber               eq
index   gidNumber               eq
index   memberUID               eq
index   sambaSID                eq
index   sambaPrimaryGroupSID    eq
index   sambaDomainName         eq
index   default                 sub
index   uniqueMember            eq,pres
======================================================================

/usr/local/etc/nss_ldap (сим.линк c /usr/local/etc/ldap.conf )

uri ldaps://192.168.0.4
base dc=smbdomain,dc=local
ldap_version 3
rootbinddn cn=Manager,dc=smbdomain,dc=local

bind_policy soft
bind_timelimit 10

ssl yes
idle_timelimit 3600
nss_connect_policy persist
nss_paged_results yes

pagesize 1000
scope one
timelimit 30

tls_randfile    /dev/random
tls_ciphers     TLSv1+RSA

TLS_CACERTDIR   /usr/local/etc/openldap/ssl
TLS_CACERT       /usr/local/etc/openldap/ssl/ldapscert.pem
TLS_CERT        /usr/local/etc/openldap/ssl/client.cert
TLS_KEY         /usr/local/etc/openldap/ssl/keys/client.key
TLS_REQCERT     allow
TLS_CRLCHECK    none

pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_min_uid 1000
pam_max_uid 65530
pam_password SSHA

nss_base_group  ou=Groups,dc=smbdomain,dc=local?one
nss_base_passwd ou=People,dc=smbdomain,dc=local?one
nss_base_passwd ou=Computers,dc=smbdomain,dc=local?one
nss_base_shadow ou=People,dc=smbdomain,dc=local?one

==========================================================================
/etc/nsswitch.conf

group: files winbind  ldap
group_compat: nis
hosts: files dns
networks: files
passwd: files winbind  ldap
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
shadow: files winbind ldap
==========================================================================
/etc/pam.d/sshd

# auth
auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
auth            sufficient        /usr/local/lib/pam_ldap.so    no_warn
auth            required        pam_unix.so             no_warn try_first_pass
account         required        pam_nologin.so
account         required        pam_login_access.so
account         sufficient        /usr/local/lib/pam_ldap.so
account         required        pam_unix.so
session         required        pam_permit.so
password        sufficient        /usr/local/lib/pam_ldap.so              no_warn
password        required        pam_unix.so             no_warn try_first_pass
==========================================================================
/etc/pam.d/system

auth            sufficient      pam_opie.so             no_warn no_fake_prompts
auth            requisite       pam_opieaccess.so       no_warn allow_local
auth            sufficient      /usr/local/lib/pam_ldap.so
auth            required        pam_unix.so             no_warn try_first_pass nullok
account         required        pam_login_access.so
account         sufficient      /usr/local/lib/pam_ldap.so
account         required        pam_unix.so
session         required        pam_lastlog.so          no_fail
password        sufficient      /usr/local/lib/pam_ldap.so
password        required        pam_unix.so             no_warn try_first_pass
===============================================================================
sockstat

USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
ldap     slapd      3848  7  tcp4   *:636                 *:*
ldap     slapd      3848  10 tcp4   127.0.0.1:636         *:*
ldap     slapd      3848  11 tcp4   192.168.0.4:636       *:*
ldap     slapd      3848  14 tcp4   192.168.0.4:636       192.168.0.4:11145
root     smbd       1279  10 tcp4   192.168.0.4:28298     192.168.0.4:636
root     winbindd   1274  14 tcp4   192.168.0.4:52547     192.168.0.4:636
root     winbindd   1272  14 tcp4   192.168.0.4:11145     192.168.0.4:636
root     sendmail   1111  4  tcp4   127.0.0.1:25          *:*
root     sshd       1103  3  tcp4   192.168.0.4:22        *:*
root     smbd       954   10 tcp4   192.168.0.4:28298     192.168.0.4:636
root     smbd       954   29 tcp4   127.0.0.1:445         *:*
root     smbd       954   30 tcp4   127.0.0.1:139         *:*
root     smbd       954   31 tcp4   192.168.0.4:445       *:*
root     smbd       954   32 tcp4   192.168.0.4:139       *:*
root     nmbd       950   11 udp4   *:137                 *:*
root     nmbd       950   12 udp4   *:138                 *:*
root     nmbd       950   13 udp4   192.168.0.4:137       *:*
root     nmbd       950   14 udp4   192.168.0.7:137       *:*
root     nmbd       950   15 udp4   192.168.0.4:138       *:*
root     nmbd       950   16 udp4   192.168.0.7:138       *:*
bind     named      803   20 tcp4   192.168.0.4:53        *:*
bind     named      803   21 tcp4   127.0.0.1:53          *:*
bind     named      803   22 tcp4   127.0.0.1:953         *:*
bind     named      803   512 udp4  192.168.0.4:53        *:*
bind     named      803   513 udp4  127.0.0.1:53          *:*
root     syslogd    695   9  udp4   *:514                 *:*
===============================================================================

service slapd restart
Nov  2 12:22:23 dn slapd[9169]: @(#) $OpenLDAP: slapd 2.4.33 (Nov 20 2012 15:26:05) $   root@dn.smbdomain.local:/usr/ports/net/openldap24-server/work/openldap-2.4.33/servers/slapd
Nov  2 12:22:23 dn slapd[9169]: nss_ldap: failed to bind to LDAP server ldaps://192.168.0.4/: Can't contact LDAP server
Nov  2 12:22:23 dn slapd[9169]: nss_ldap: could not search LDAP server - Server is unavailable
Nov  2 12:22:23 dn slapd[9169]: nss_ldap: failed to bind to LDAP server ldaps://192.168.0.4/: Can't contact LDAP server
Nov  2 12:22:23 dn slapd[9169]: nss_ldap: could not search LDAP server - Server is unavailable
Nov  2 12:22:23 dn slapd[9170]: slapd starting

wbinfo -p SMBDOMAIN
Ping to winbindd succeeded

wbinfo -u
wbinfo -g
  Ничего

ssh 192.168.0.4 -l root

log/messages
Nov  2 11:52:33 dn sshd[8950]: pam_ldap: error trying to bind as user "uid=root,ou=People,dc=smbdomain,dc=local" (Invalid credentials)
Nov  2 11:52:33 dn sshd[8948]: error: PAM: authentication error for illegal user root from 192.168.0.4

log/slapd.log
Nov  2 12:23:50 dn slapd[9170]: conn=1000 fd=14 ACCEPT from IP=192.168.0.4:46990 (IP=192.168.0.4:636)
Nov  2 12:23:50 dn slapd[9170]: conn=1000 fd=14 TLS established tls_ssf=256 ssf=256
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=0 BIND dn="cn=Manager,dc=smbdomain,dc=local" method=128
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=0 BIND dn="cn=Manager,dc=smbdomain,dc=local" mech=SIMPLE ssf=0
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=0 RESULT tag=97 err=0 text=
Nov  2 12:23:50 dn slapd[9170]: connection_input: conn=1000 deferring operation: binding
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=1 SRCH base="ou=People,dc=smbdomain,dc=local" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=root))"
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=1 SRCH attr=host authorizedService shadowExpire shadowFlag shadowInactive shadowLastChange shadowMax shadowMin shadowWarning uidNumber
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=2 BIND anonymous mech=implicit ssf=0
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=2 BIND dn="uid=root,ou=People,dc=smbdomain,dc=local" method=128
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=2 RESULT tag=97 err=49 text=
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=3 BIND dn="cn=Manager,dc=smbdomain,dc=local" method=128
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=3 BIND dn="cn=Manager,dc=smbdomain,dc=local" mech=SIMPLE ssf=0
Nov  2 12:23:50 dn slapd[9170]: conn=1000 op=3 RESULT tag=97 err=0 text=
Nov  2 12:23:50 dn slapd[9170]: conn=1000 fd=14 closed (connection lost)
Nov  2 12:25:00 dn slapd[9170]: conn=1001 fd=14 ACCEPT from IP=192.168.0.4:22301 (IP=192.168.0.4:636)
Nov  2 12:25:00 dn slapd[9170]: conn=1001 fd=14 TLS established tls_ssf=256 ssf=256
Nov  2 12:25:00 dn slapd[9170]: conn=1001 op=0 BIND dn="" method=128
Nov  2 12:25:00 dn slapd[9170]: conn=1001 op=0 RESULT tag=97 err=48 text=anonymous bind disallowed
Nov  2 12:25:00 dn slapd[9170]: conn=1001 op=1 UNBIND
Nov  2 12:25:00 dn slapd[9170]: conn=1001 fd=14 closed
Nov  2 12:25:00 dn slapd[9170]: conn=1002 fd=19 ACCEPT from IP=192.168.0.4:61164 (IP=192.168.0.4:636)
Nov  2 12:25:00 dn slapd[9170]: conn=1002 fd=19 TLS established tls_ssf=256 ssf=256
Nov  2 12:25:00 dn slapd[9170]: conn=1002 op=0 BIND dn="" method=128
Nov  2 12:25:00 dn slapd[9170]: conn=1002 op=0 RESULT tag=97 err=48 text=anonymous bind disallowed
Nov  2 12:25:00 dn slapd[9170]: conn=1002 op=1 UNBIND
Nov  2 12:25:00 dn slapd[9170]: conn=1002 fd=19 closed

dapsearch -Q -LLL -H ldaps://localhost/ -b "uid=root,dc=smbdomain dc=local"
ldap_sasl_interactive_bind_s: Operations error (1)
additional info: BIND required

[root@dn] ~# slapcat | grep root
dn: uid=root,ou=People,dc=smbdomain,dc=local
uid: root
cn: root
sn: root
homeDirectory: /home/root
sambaHomePath: \%Lroot
sambaProfilePath: \\dn\profiles\root
memberUid: root

ldap.secret создан
-rw-------  1 root  wheel  8 30 окт 23:09 /usr/local/etc/ldap.secret

Вроде всё.
Понятно, что проблема в nss_ldap + Bind (bind BIND required) только вот что конкретно следует предпринять?
До поднятия TLS заходили в домен, но с разрешённым анонимным соединением. Пробовал фокус с созданием специального
пользователя для чтения паролей..... фокус не удался.
возможно, есть различные варианты реализаций, .....
Может быть есть мнения, в чём может быть причина?
Спасибо.