0

I have an openldap master/slave configuration, setup as per the Ubuntu guide, on Ubuntu 12.04, running slapd 2.4.28-1.1ubuntu4.2. I have pam_ldap configured for ssh authentication, everything works fine as long as the master is up.

If I configure /etc/ldap.conf to point at only the slave, and the master is up, authentication works fine. But as soon as I take the master down, authentication fails and I can't login.

I can run an ldap search for my uid against both servers successfully, data returned is identical... the slave still shows data properly when the master is down.

The contextCSN is identical on both master and slave, and I've confirmed replication is occurring properly by changing an attribute on the master, roughly 30 seconds later the contextCSN is updated on the slave and a search for the attribute shows it updated.

The contents of /etc/ldap.conf with only the slave specified:

base dc=mydomain
ldap_version 3
pam_password md5
uri ldap://slave01

There's nothing in auth.log, syslog or the slapd.log that shows anything as to why this is the case.

Any ideas?

1 Answer 1

0

To answer my own question... the symptom was that when attempting to ssh from one host (client) to another (server) while the master was down, I'd see this:

$ ssh server
You don't exist, go away!

I wrongly assumed this was coming from the server, but it was actually coming from ssh on the client. The root cause is I configured the master and slave in /etc/ldap.conf on the server, but only the master in /etc/ldap.conf on the client. As soon as I took the master down, the client couldn't resolve my own uid and thus told me I didn't exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .