Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to know why I can't login as root (ssh, sudo or su -) when my LDAP is down or when I have some outage in my network.

How to reproduce the problem: - Just change your DNS to something that does not work (example: nameserver 100.0.2.2) - Try to login (su -) or ssh

The /var/log/secure says:

Feb 26 18:45:39 vmcentos5 sshd[6311]: Accepted password for root from 10.0.2.2 port 59717 ssh2
Feb 26 18:46:19 vmcentos5 sshd[6311]: nss-ldap: do_open: do_start_tls failed:stat=-1
Feb 26 18:46:59 vmcentos5 sshd[6311]: nss-ldap: do_open: do_start_tls failed:stat=-1
Feb 26 18:46:59 vmcentos5 sshd[6311]: nss_ldap: could not search LDAP server - Server is unavailable

But you can't get the prompt to work.

This is pam.d/system-auth:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        sufficient    pam_ldap.so use_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_access.so
account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     sufficient    pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0027
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
  • Why I can't get the shell to work?
  • Why 'su -' tries to connect on LDAP even to become root, even with 'nss_initgroups_ignoreusers root' in my ldap.conf?

Thanks!

share|improve this question
1  
Please post your pam.conf. –  quadruplebucky Feb 26 at 22:26
    
Hello @quadruplebucky I edited the post and now we have, sorry! –  Tiago Cruz Feb 27 at 12:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.