Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are using an LDAP server with both Solaris and RHEL servers and planning to migrate more servers over to RHEL. However we have an issue with LDAP on all Red Hat servers. When we type "getent passwd", all users on the entire LDAP Server are shown, instead of only the users that have access to this server. Normally about 10 to 50 people have access to a server, so Solaris prints out this list of users, while Red Hat flat out prints out a list of all users that exist in the LDAP (about 650).

We use nscd/nslcd on RHEL 6.2. Migrating to sssd is not a solution short-term, although we are considering doing so in the future.

I have found out that this can be changed by using compat as a source for /etc/nsswitch.conf, which enumerates so you only see the users with access to the +netgroup in /etc/passwd.

  • What is normal behavior on Red Hat Linux Servers?
  • Is there a security risk in users being able to see all other users?
  • Do you recommend using compat in /etc/nsswitch.conf as a solution?
share|improve this question
    
This is expected behavior. –  Tom O'Connor Aug 13 '13 at 10:22

1 Answer 1

up vote 1 down vote accepted

nsswitch is correct, don't change it! it DOESN'T have any filtering capability, so if it's outputting the ldap users, its set correctly.

The problem is the ldap filter in /etc/ldap.conf. On solaris is filtering the users and only allowing the ones matching the filter, on the RHEL you aren't probably using any filter and so allowing all users.

check the pam_filter option. you can use this ldap.conf example as base if your is too empty

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.