Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :)

First off, the LDAP server is running fine because the other machines can connect to it. Second, I followed this guide on Gentoo wiki to set up the client. Third, I even tried using the ldap/nss/pam config files from the other workstations but still can't login...

What works is the ldapsearch:

ldapsearch -Z '(objectclass=*)'

I used the -Z for TSL (That's what I read it is for) but -x also works.

From what I researched/googled/tried it seems that the error is not with ldap but with nss configuration? Any help would be greatly appreciated :)

Here is ldap.conf (slightly redacted)

timelimit 120
bind_timelimit 120
idle_timelimit 3600

TLS_CACERTDIR /etc/openldap/cacerts
URI ldaps://<sub>.<domain>.edu/
BASE dc=<sub>,dc=<domain>,dc=edu

# Just assume that there are no supplemental groups for these named users
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm,polkituser,    rtkit,pulse

ssl start_tls
pam_password md5

Current nsswitch.conf

# /etc/nsswitch.conf:
# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29 23:52:23 vapier Exp $

passwd:      files ldap
shadow:      files ldap
group:       files ldap

# passwd:    db files nis
# shadow:    db files nis
# group:     db files nis

hosts:       files dns
networks:    files dns

services:    files sss
protocols:   files
rpc:         files
ethers:      files
netmasks:    files
netgroup:    files
bootparams:  nisplus [NOTFOUND=return]files
publickey:   nisplus
automount:   files ldap
aliases:     files nisplus


auth            sufficient
auth            required
auth            required try_first_pass likeauth nullok
auth            optional

account         sufficient
account         required
account         optional

password        sufficeint
password        required difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password        required try_first_pass use_authtok nullok sha512 shadow
password        optional

session         required
session         required
session         required
session         optional
session         optional

Let me know if any other configuration files/information would be helpful.

share|improve this question
What does the following command returns (run as root)? getent shadow Which service are you trying to log to? Maybe this service uses pam so you would also need to install and configure libpam_LDAP. – alxgomz Jan 7 '14 at 18:24
getent shadow returns local users then hangs for a bit (trying to connect to ldap?) and returns nothing and exists. I'm trying to set up the workstation so the users can login to any machine and access their files (home folders are on a central server, they mount fine on boot though). So pretty much just login to the machine through ldap. I have pam_ldap module installed and configured as per gentoo's wiki page. – Drakkainen Jan 7 '14 at 18:56
Oh yes I missed the pam part in your initial post...You may have to configure you libnss-ldap as well. I am not sure about Henri, but under Debian it's in a file called /etc/libnss-ldap.conf. take a look at the corresponding man page. – alxgomz Jan 7 '14 at 22:13
up vote 1 down vote accepted

Figured it out, and I hope this will help someone in the future :)

The workstations that can login to ldap were using SSSD to authenticate against the ldap server. After installing and configuring it all I had to do was switch the lines in nsswitch.conf like so:

passwd:      files ldap
shadow:      files ldap
group:       files ldap


passwd:      files sss
shadow:      files sss
group:       files sss

I hope this will help someone out there :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.