On Thu, Feb 4, 2010 at 10:41 PM, Morris, Patrick <patrick.morris at hp.com> wrote:
> Tom Lanyon wrote:
>> On 05/02/2010, at 3:16 AM, Sean Carolan wrote:
>>
>>
>>>> What is listed in your /etc/nsswitch.conf for passwd, shadow and group?
>>>>
>>> Here's what I have on one of the clients:
>>>
>>> passwd: ? ? files ldap
>>> shadow: ? ? files ldap
>>> group: ? ? ?files ldap
>>>
>>>
>>>> If you do not have an entry for 'files' then the local /etc/{passwd,shadow,group} files will not be searched.
>>>>
>>> Should it not try "files" first? ?I'm still seeing that when the LDAP
>>> server is down, I can't log onto the client machines at all. ?Logging
>>> in as root works, but logging in as a normal user doesn't. ?Any
>>> suggestions?
>>>
>>
>> Yes, it should...
>>
>
> It probably does. The fun starts when it has to check every LDAP group
> to see if that person is a member of one of them, and for that it *must*
> go to LDAP, regardless of the order in nsswitch.conf.
>
> You can disable that behavior on an account-by-account basis using the
> nss_initgroups_ignoreusers in ldap.conf, and there may be other ways.
> One alternative may just be to set the LDAP timeout short enough that
> the login timeout doesn't kick in before the LDAP one does. ?There may
> be others as well.
> --
> 389 users mailing list
> 389-users at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/389-users
>
The problem is probably in pam. Lot s of internet docs have incorrect
info advice and say.
account required pam_nologin.so
account sufficient pam_ldap.so
When you do that you get the situation you have now. In some phases of
login sufficient becomes required.
Try this:
#%PAM-1.0
auth sufficient pam_ldap.so
auth include system-auth
account required pam_nologin.so
account [default=bad success=ok user_unknown=ignore
service_err=ignore system_err=ignore authinfo_unavail=ignore]
pam_ldap.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
session required pam_mkhomedir.so
You can also throw arguments to pam_ldap.so to do something similar.
