On Tue, 12 Feb 2013, Jakub Hrozek wrote:
On Tue, Feb 12, 2013 at 11:04:47AM +0100, Olivier wrote:
> Hello,
>
> just to let you know that I just realized that user authentications
> on boxes where accepted based on their ldap login/passwd when
> sssd was running and sssd.conf pointing an ldap auth_provider.
>
> You will say : and so what ?
>
> The problem is that on that on these boxes /etc/nsswitch.conf was
> not configured to use "sss" nor "ldap".
>
> $ cat /etc/nsswitch.conf
> ...
> passwd: files
> shadow: files
> group: files
> ...
>
> Is this the expected behaviour ?
>
> As a result, both ldap and local password where working for users,
> both local and ldap groups considered in access.conf on that box,
> as well as access to commands that I didn't want through "sudo"
> under certain circomstances.
Are the local and ldap accounts overlapping? Was the client configured to
use sss in nsswitch.conf at some point so that there may be stalled
cache issues?
I think you're mixing two issues here though. Have you checked you've not got
sssd still enabled in your PAM config?
jh