[SSSD] nsswitch.conf / sssd.conf confusion
John Hodrien
J.H.Hodrien at leeds.ac.uk
Tue Feb 12 10:19:02 UTC 2013
On Tue, 12 Feb 2013, Jakub Hrozek wrote:
> On Tue, Feb 12, 2013 at 11:04:47AM +0100, Olivier wrote:
>> Hello,
>>
>> just to let you know that I just realized that user authentications
>> on boxes where accepted based on their ldap login/passwd when
>> sssd was running and sssd.conf pointing an ldap auth_provider.
>>
>> You will say : and so what ?
>>
>> The problem is that on that on these boxes /etc/nsswitch.conf was
>> not configured to use "sss" nor "ldap".
>>
>> $ cat /etc/nsswitch.conf
>> ...
>> passwd: files
>> shadow: files
>> group: files
>> ...
>>
>> Is this the expected behaviour ?
>>
>> As a result, both ldap and local password where working for users,
>> both local and ldap groups considered in access.conf on that box,
>> as well as access to commands that I didn't want through "sudo"
>> under certain circomstances.
>
> Are the local and ldap accounts overlapping? Was the client configured to
> use sss in nsswitch.conf at some point so that there may be stalled
> cache issues?
I think you're mixing two issues here though. Have you checked you've not got
sssd still enabled in your PAM config?
jh
More information about the sssd-devel
mailing list