[SSSD] nsswitch.conf / sssd.conf confusion

John Hodrien J.H.Hodrien at leeds.ac.uk
Tue Feb 12 10:19:02 UTC 2013


On Tue, 12 Feb 2013, Jakub Hrozek wrote:

> On Tue, Feb 12, 2013 at 11:04:47AM +0100, Olivier wrote:
>> Hello,
>> 
>> just to let you know that I just realized that user authentications
>> on boxes where accepted based on their ldap login/passwd when
>> sssd was running and sssd.conf pointing an ldap auth_provider.
>> 
>> You will say : and so what ?
>> 
>> The problem is that on that on these boxes /etc/nsswitch.conf was
>> not configured to use "sss" nor "ldap".
>> 
>> $ cat /etc/nsswitch.conf
>> ...
>> passwd:     files
>> shadow:     files
>> group:      files
>> ...
>> 
>> Is this the expected behaviour ?
>> 
>> As a result, both ldap and local password where working for users,
>> both local and ldap groups considered in access.conf on that box,
>> as well as access to commands that I didn't want through "sudo"
>> under certain circomstances.
>
> Are the local and ldap accounts overlapping? Was the client configured to
> use sss in nsswitch.conf at some point so that there may be stalled
> cache issues?

I think you're mixing two issues here though.  Have you checked you've not got
sssd still enabled in your PAM config?

jh



More information about the sssd-devel mailing list