When our OpenLDAP server lost power the CentOS machines' console became nearly unusable.
We were trying to login with a local account, but each command would take minutes to return. Even simple commands like
ls were just sitting there.
This does not seem to be a problem with the same configuration under Ubuntu. It takes a while for the initial login to succeed for the local account, but once you are in everything works.
I am looking for a way to mitigate the problem, and came up with a couple ideas:
- Set a timeout value (if one exists) for the ldap-pam module
- Run a local ldap db and authenticate with that (it would be a slave of the main one)
- Create a cron job to enable/disable if we loose connectivity to the ldap server
Are there any better solutions to managing some sort of redundancy/failover with LDAP?