Bug#563987: /lib/libnss_hesiod.so.2: hesiod users not fully supported

[Ken Raeburn <raeburn@permabit.com>]

Package: libc6
Version: 2.7-18
Severity: normal
File: /lib/libnss_hesiod.so.2


We've found that since updating to lenny, cron jobs for normal,
non-local users (who are listed in hesiod) aren't being run.  Adding
entries to /etc/shadow works around it.  The following message gets
logged, and the cron job just never runs:

Jan  6 16:07:01 just-testing CRON[25360]: Authentication service cannot retrieve authentication info

Chasing things a bit further, cron uses pam, and pam is looking up
shadow password entries.  (For some reason, this problem doesn't bite
us with ssh or X login, just cron, so far as we've noticed.)  The
above error message comes from the pam code.

The pam code seems to assume that shadow password entries will exist
for any valid account.  We're using libnss_hesiod, and it doesn't
support the shadow-password lookups, just regular password lookups.

A simple test program (that requires a libnss_hesiod setup to
demonstrate):

    #include <shadow.h>
    #include <stdio.h>
    #include <stdlib.h>
    int main () {
      struct spwd *sp = getspnam("nightly");
      if (sp) { printf("win\n"); exit(0); } else { printf("fail\n"); exit(1); }
    }

I expect the pam code's assumption is probably reasonable; if so, then
libnss_hesiod should be filling in the gap, and we should just be able
to use "shadow: files hesiod" in nsswitch.conf.


-- System Information:
Debian Release: 5.0.3
  APT prefers stable
  APT policy: (1001, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.30-2-permabit1-686-bigmem (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash

Versions of packages libc6 depends on:
ii  libgcc1                      1:4.3.2-1.1 GCC support library

libc6 recommends no packages.

Versions of packages libc6 suggests:
ii  glibc-doc                     2.7-18     GNU C Library: Documentation
ii  libc6-i686                    2.7-18     GNU C Library: Shared libraries [i
ii  locales                       2.7-18     GNU C Library: National Language (

-- debconf information:
  glibc/upgrade: true
  glibc/restart-failed:
  glibc/restart-services: