--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: boot failure (using local files) if ldap unavailable
- From: Jack Bates <ms419@freezone.co.uk>
- Date: Sun, 09 Sep 2007 16:40:31 -0700
- Message-id: <20070909234031.10453.55469.reportbug@dew.campcoop.com>
Package: libnss-ldap
Version: 256-1
Severity: normal
We have at least two systems running the libnss-ldap package, one Debian
lenny and one Ubuntu feisty. Both exhibit this same problem.
Both systems boot fine without libnss-ldap. My goal is for each system
to continue working with libnss-ldap: local passwd and group files
should override values from our LDAP directory. However I would like
users without local accounts to be able to login with their LDAP
account.
To this end, I changed the passwd and group lines in nsswitch.conf
(see entire file attached):
passwd: compat ldap
group: compat ldap
This works great when our LDAP server is available, but if it's not, I
still want users with local accounts to be able to login. Instead, if I
boot the system and our LDAP server is unavailable, no logins are
possible. Not even root is able to login. In this case, I need to reboot
the system in single user mode and remove ldap from nsswitch.conf before
anyone can login.
This is particularly a problem on the system actually running our LDAP
server, since our LDAP server is obviously never available when it
boots. In this case as well, I must boot in single user mode, remove
ldap from nsswitch.conf, finish booting, and finally return ldap to
nsswitch.conf. Once done, users can happily login with their LDAP
accounts.
I have also tried changing the passwd and group lines in nsswitch.conf:
passwd: compat ldap [NOTFOUND=return]
group: compat ldap [NOTFOUND=return]
This case behaves the same when our LDAP server is unavailalbe. When our
LDAP server is available, users with local accounts can login, but users
with LDAP accounts can't.
I've not yet installed nscd or either system.
Thanks for maintaining libnss-ldap in Debian, Jack
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.21-2-686 (SMP w/2 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libnss-ldap depends on:
ii debconf [debconf-2.0] 1.5.14 Debian configuration management sy
ii libc6 2.6.1-1+b1 GNU C Library: Shared libraries
ii libkrb53 1.6.dfsg.1-6 MIT Kerberos runtime libraries
ii libldap2 2.1.30-13.4 OpenLDAP libraries
Versions of packages libnss-ldap recommends:
ii libpam-ldap 184-2 Pluggable Authentication Module al
pn nscd <none> (no description available)
-- debconf information:
libnss-ldap/dblogin: false
libnss-ldap/override: true
* shared/ldapns/base-dn: dc=campcoop,dc=com
* shared/ldapns/ldap-server: ldap://ldap.campcoop.com
libnss-ldap/confperm: false
* libnss-ldap/rootbinddn: cn=admin,dc=campcoop,dc=com
* shared/ldapns/ldap_version: 3
libnss-ldap/binddn: cn=proxyuser,dc=example,dc=net
* libnss-ldap/nsswitch:
libnss-ldap/dbrootlogin: true
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: compat ldap
group: compat ldap
shadow: compat
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
--- End Message ---