On Thu, Feb 4, 2010 at 10:41 PM, Morris, Patrick <patrick.morris(a)hp.com> wrote:
Tom Lanyon wrote:
> On 05/02/2010, at 3:16 AM, Sean Carolan wrote:
>
>
>>> What is listed in your /etc/nsswitch.conf for passwd, shadow and group?
>>>
>> Here's what I have on one of the clients:
>>
>> passwd: files ldap
>> shadow: files ldap
>> group: files ldap
>>
>>
>>> If you do not have an entry for 'files' then the local
/etc/{passwd,shadow,group} files will not be searched.
>>>
>> Should it not try "files" first? I'm still seeing that when the
LDAP
>> server is down, I can't log onto the client machines at all. Logging
>> in as root works, but logging in as a normal user doesn't. Any
>> suggestions?
>>
>
> Yes, it should...
>
It probably does. The fun starts when it has to check every LDAP group
to see if that person is a member of one of them, and for that it *must*
go to LDAP, regardless of the order in nsswitch.conf.
You can disable that behavior on an account-by-account basis using the
nss_initgroups_ignoreusers in ldap.conf, and there may be other ways.
One alternative may just be to set the LDAP timeout short enough that
the login timeout doesn't kick in before the LDAP one does. There may
be others as well.
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
The problem is probably in pam. Lot s of internet docs have incorrect
info advice and say.
account required pam_nologin.so
account sufficient pam_ldap.so
When you do that you get the situation you have now. In some phases of
login sufficient becomes required.
Try this:
#%PAM-1.0
auth sufficient pam_ldap.so
auth include system-auth
account required pam_nologin.so
account [default=bad success=ok user_unknown=ignore
service_err=ignore system_err=ignore authinfo_unavail=ignore]
pam_ldap.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
session required pam_mkhomedir.so
You can also throw arguments to pam_ldap.so to do something similar.