Questions tagged [nss]
Name Service Switch, an modular interface built in to the GNU C library that handles data retrieval from system databases, e.g., password, group, etc.
77
questions
0
votes
0
answers
24
views
Different results for NSS depending on where the user is logged in
When I call getpwuid it returns data from where NSS told it. In a PAM enabled system, we can authenticate a user logged in from console differently with a user logged in via ssh, but with NSS it is ...
1
vote
0
answers
103
views
Authenticating ftp against multiple (postgres) databases
Current State
Given is a host with a couple of IPv4 addresses and HTTP & FTP access for each address; each vhost has access to a PostgreSQL database. Web- and ftp-authentication is done against ...
0
votes
1
answer
643
views
nss-pam-ldapd password authentication doesn't work on CentOS 7 only when using `su`
Context
I have 2 different machins here whose main difference is that one is runs CentOS6 the other CentOS7.
Both run the latest distribution-available version of the lib : 0.8.13 for COS7, 0.7.5 for ...
3
votes
1
answer
3k
views
The memcache was not invalidated by NSS responder
I was deleting a user.
# userdel u1
The memcache was not invalidated by nss responder.
But finally the user was deleted.
What does "The memcache was not invalidated by nss responder" means?
...
2
votes
1
answer
246
views
How does OpenSSH / NSS determine the address to use for a hostname with multiple DNS entries?
Suppose I have some device with multiple addresses like so (due to some combination of AD and VMWare NAT name resolution, but that's not germane):
[centos@localhost ~]$ getent hosts my-weird-AD-device....
-1
votes
1
answer
1k
views
Give permissions of LDAP group files to specific user
Here is the situation:
I want user usr to have the same permissions of a group grp, anywhere in the system.
grp is not a local group, it comes from a LDAP server, of which I have no control over.
I ...
1
vote
1
answer
462
views
Can't understand why libnss-pam-ldapd does not find LDAP library
I am trying to cross-compile libnss-pam-ldapd for an arm architecture. The configure command always gives the following error:
checking for library containing ldap_search_ext... no
checking for ...
4
votes
1
answer
1k
views
What is the easiest way to set up composable POSIX groups for SSH & Samba authentication?
Background
I'm putting together what I would consider to be a fairly ordinary chunk of infrastructure, but have been running into so many problems that I can't help but wonder if there's an easier way....
0
votes
0
answers
507
views
How can the other users from Slapd log on to Samba?
We run an open source image processing web application. This provides users with a Windows network drive for uploading gigabytes of image data. The application offers the convenience that a network ...
1
vote
1
answer
845
views
Unable to hit websites with Self-Signed Certificates after NSS upgrade with any application
We recently upgraded NSS from version 3.44 (nss-3.44.0-4.el7.x86_64) to version 3.53 (nss-3.53.1-3.el7_9.x86_64). After this upgrade, any calls out to our internal website that uses a self-signed ...
1
vote
0
answers
395
views
How to customize NSS filters to match users against several attributes?
My context: I have a OpenSMTPD instance that uses PAM as its authentication backend. My PAM configuration use NSS to authenticate the users against a LDAP directory.
I would like to make NSS match ...
1
vote
0
answers
3k
views
How can I change nsswitch.conf?
I have been using RADIUS and TACACS+ AAA on CentOS 6 and need to duplicate that functionality on CentOS 8. However, the changes to how you now configure NSS confuse me. How do I make changes to ...
0
votes
1
answer
592
views
Inspect content of SLAB
Is there a way, preferably simple, how to inspect content of SLAB caches, especially dentry cache? I can imagine that this can be doable through kernel modules, but I highly doubt security would let ...
0
votes
1
answer
989
views
NSS query against OpenLDAP server using GSSAPI with proxy authorization
SASL/GSSAPI needs Kerberos authentication against the LDAP server with proxy authorization if using LDAP authentication with nss-pam-ldapd on a Debian Buster operating system. I try to configure this ...
0
votes
1
answer
475
views
Logins doesn't work with PAM/NSS
I have a computer room that uses libpam-pgsql and libnss-pgsql2 for users authentication.
Right now, the system is working perfectly with Debian 8 clients.
I want to upgrade and I am trying to setup ...
0
votes
1
answer
63
views
configure nsscache with samba4 active directory
I have a problem caching the users from samba4 AD with nsscache, since there is no uid, rather samAccountName or cn in AD. When I use the uid-like attribute:
# Default uid-like attribute
ldap_uidattr ...
0
votes
1
answer
439
views
Can't authenticate against a 389DS server. I suspect it's a SSSD issue on client side
I'm running a 389DS LDAPS server (with self-signed certificates) on a Fedora 30 remote machine called "miservidor.midominio.local". There I have a typical directory containing user and group entries.
...
2
votes
0
answers
186
views
Username collision files/ldap, both passwords accepted
Ubuntu 18.04.3 server, slapd running, LDAP auth configured with libnss-ldapd and libpam-ldapd packages (all on the same machine). Created a local user with useradd and a user in the LDAP database with ...
0
votes
1
answer
740
views
OpenLDAP: Non-anonymous access for PAM/NSS
I've install LDAP with PAM/NSS. So I've installed libnss-ldap libpam-ldap nscd on my Debian 9
apt-get install libnss-ldap libpam-ldap nscd
I configured it and all was working rigth. I decided to ...
1
vote
2
answers
218
views
Where to install NSS modules on CoreOS?
I have a custom NSS module that I wrote and I typically install it by copying the library like so...
cp libnss_mymodule.so.0 /lib64/
... then I add my module to the /etc/nsswitch.conf ...
$ grep ...
1
vote
1
answer
323
views
Linux custom NSS module, `_nss_SERVICE_getspnam_r` is called but `_nss_SERVICE_getpwnam_r` is not
I'm creating a custom NSS module. I managed to make it work on my local Redhat 7.3 box, configured nsswitch.conf correctly
passwd: files SERVICE
shadow: files SERVICE
and confirmed that both ...
1
vote
0
answers
4k
views
Centos yum error: Failed to initialize NSS library - other fixes not working for me
Basic issue from screenshot:
yum
error: Failed to initialize NSS library
There was a problem importing one of the Python modules
required to run yum. The error leading to this problem was:
cannot ...
5
votes
3
answers
17k
views
yum/rpm Failed to initialize NSS library in chroot
I am performing a yum update from CentOS 7.4 to CentOS 7.5, when nspr and nss soft-softoken receive the updates, I am left with the following error:
yum update nspr
error: Failed to initialize NSS ...
0
votes
0
answers
387
views
Authenticate and mount home using ssh and nfs
How would I go about trying to authenticate a user against a particular system and then mounting his tree using NFS.
The user would have his own desktop and when the user goes to work on a separate ...
1
vote
1
answer
609
views
Understanding LDAP Authentication
During the last days I've been fiddling around with LDAP authentication and I've managed to configure some Linux systems (CentOS 6 and 7) to perform the SSH authentication process
against an OpenLDAP ...
0
votes
0
answers
1k
views
Cannot load CA certificate file ca-root-nss.crt entry did not validate
The error message is clear enough. Some cert data isn't valid. But the debugging data provided seems a bit meager to me. How do I find cert 128? What is confusing is this file is up to date, so this ...
-6
votes
1
answer
768
views
Almost every app (rpm,curl..) is broken (Red Hat Enterprise Linux 6.8) after rpm force installation - libnssutil3.so error
I'm using Red Hat Enterprise Linux 6.8 on my intra-net machine.
While I'm trying to install new rpm, or even curl to some url, I'm getting that output:
rpm: symbol lookup error: /lib64/libnssutil3.so:...
1
vote
0
answers
849
views
Mozilla NSS does not accept certificate with "PKCS #1 SHA-256 With RSA Encryption" signature
On Centos 7.2 NSS certutil and other tools using NSS libraries reject my certificate with the message certutil: certificate is invalid: The certificate was signed using a signature algorithm that is ...
0
votes
1
answer
392
views
Weird behavior with ldap and getent or repquota
I've observed a weird behavior in my network.
I have my network users stored in OpenLDAP 2.4 which also serves a samba 3.6 Domain.
I have user quotas on my NFS servers and that is where I stumbled ...
0
votes
0
answers
155
views
Centos 6 nss-pam-ldapd delay?
I have configured Centos with nss-pam-ldapd and seems to work fine. ( I can login with my AD credentioals). Except there seems to be a delay of about 20-30 seconds before I can log in.
I also set-up ...
0
votes
1
answer
2k
views
how to control ldap users access using groupdn?
I am using openldap, nslcd and nss-pam-ldapd. I want to restrict users login to ldap client. I have configured this in CentOS 6.5 without any problem using groupdn. but in CentOS 7, there is no ...
0
votes
0
answers
2k
views
Changing SSL-version for curl
I have been trying for hours to change the SSL Version for curl from NSS to OpenSSL because I have a web application that's dependant on it.
I'm running RedHat RHEL 6.7 on a 64-bit system.
I have ...
0
votes
1
answer
5k
views
pkcs11_lib - NSS Initialize Failed (bad database?)
I'm having trouble getting PKCS#11 and PAM to work, for whatever reason nss has stopped working and I can't create a new database.
Here's the output from PKCS11 and NSS:
DEBUG:pkcs11_lib.c:187: ...
0
votes
1
answer
871
views
libnss-mysql gone in Jessie?
I was happily using libpam-ldap and libnss-mysql (authenticating clients directly against LDAP, with NSS data such as UID/GID/home dir kept in a mysql database).
Now I tried to install Jessie on ...
0
votes
1
answer
798
views
what does it mean ? openldap: TLS: no unlocked certificate for certificate '<some certificate subject>'
just spent a lot of time with centos 6.7 and openldap.
it was configured with simple certificates and a root-ca in nice little pem files, but after an upgrade from centos 6.4, connecting to the slapd ...
2
votes
0
answers
3k
views
Import a P12 certificate into a NSS database (with an alias)
Here´s the deal... I have a personal P12 certificate generated by a certificate authority.
I want to use it with CURL to access a protected URL.
If CURL on CENTOS was compiled with openssl, I should ...
0
votes
1
answer
82
views
Why is LDAP using servers other than those specified?
I have a linux system that is using Active Directory (2012) for LDAP lookups of users and groups. It's in a network that is connected to our main site by VPN.
When the VPN goes down, all ldap ...
2
votes
0
answers
245
views
libnss-mysql on freebsd 10.1
i have libnss-mysql installed on freebsd 10.1.
Everything works except groups command.
getent group - ok
# getent group
.......
froxlorlocal:*:1003:www <-- data from passwd
vmail:*:2000 <...
1
vote
1
answer
20k
views
SSL handshake with CentOS, curl and ECDHE
Since I limited my Ciphers to ECDHE because of the Logjam vulnerabilities, I am not able to do a curl from a Centos machine anymore. (works from Ubuntu)
$ curl -v https://mysite.mydomain.com
* ...
2
votes
1
answer
3k
views
centos 6.6 ldap authentication no longer works after certificate update on ldap host
We recently updated the CA certificates on our LDAP host. There are a couple of CentOS 5.x servers which don't seem to have any issues authenticating against the LDAP host, but there's one Centos 6.6 ...
1
vote
0
answers
358
views
The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]
May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules?
As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
1
vote
1
answer
1k
views
Can I configure pam_ldap without configuring nss?
On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
8
votes
1
answer
26k
views
How to add an existing key to the certutil key database
I have created an SSL keypair with OpenSSL. I uploaded the Certificate Signing Request to my SSL Certificate provider and got my certificate files.
I added my certificate and the required CA ...
2
votes
0
answers
408
views
Stop NSSwitch on first match
I am using a MySQL backend to store some of my UNIX users into a database. In order for the system to be able to retrieve name information about these users, I added MySQL to NSS's sources:
passwd: ...
1
vote
1
answer
3k
views
make PHP curl use openssl instead of NSS
Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6?
I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it?
Actually is there a ...
0
votes
1
answer
684
views
Usergroups in LDAP: User and Group in same object
"Usergroups" are a common concept in UNIX, many Linux distributions (e.g. Debian) use it as default. It means that each user has its corresponding private group (e.g., User "alex" has also a group "...
2
votes
1
answer
6k
views
Token error when trying to change password through pam-mysql
I am currently preparing a machine for a web hosting service, and I decided to use MySQL to store all our users (since the rest of our services use it already). For that, I am using libnss-mysql and ...
6
votes
2
answers
2k
views
Virtual users in sshd from a postgres database
I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification.
So far, i have setup these parts on ...
0
votes
0
answers
1k
views
How to enable Forward Secrecy with mod_nss in apache2?
I use apache2 on a SLES box and have configured SSL via mod_nss (because the standard mod_ssl is not able to provide TLS 1.1/1.2 due an old and not up-gradable openssl <1.0 package in SLES).
How ...
1
vote
1
answer
5k
views
OpenLDAP client configuration. Can search but cannot login?
I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :)
First off, the LDAP ...