Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a working LDAP set up. However we hit a problem recently due to some user names and group names existing both in the local files and in LDAP. Specifically the apache user and group existed both in:

  • /etc/passwd and /etc/group
  • LDAP as both user and group

After a recent yum update (CentOS 5), it appeared that the group ID of the process had changed from the value in /etc/group to the value in LDAP (while the user ID remained the ID from /etc/passwd). As some of the files needed by httpd were owned by user root, with group apache (from /etc/group) but not world readable, this caused problems.

Note that we already have nss_initgroups_ignoreusers apache,... in both /etc/ldap.conf and /etc/openldap/ldap.conf. Also, in /etc/nsswitch.conf we have

passwd:     files ldap
group:     files ldap
shadow:     files ldap

and the rest of the normal bits and bobs.

So if a name exists in both LDAP and the local files, is there a way to ensure that the ID from the local files will take precedence over the ID in LDAP?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

I don't know if it's a typo in your example but the group database is called group and not groups.

You should be able to force the search to stop after a successful lookup e.g.

passwd:    files [SUCCESS=return] ldap
group:     files [SUCCESS=return] ldap

The above should be the deafult action anyway so you should confirm that what you are looking for really is in the files.

NOTES Within each process that uses nsswitch.conf, the entire file is read only once; if the file is later changed, the process will continue using the old configuration.

share|improve this answer
    
The groups was a typo, corrected in question now. Will look into this in more detail tomorrow at work. –  Hamish Downer Sep 20 '11 at 22:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.