Hot answers tagged

15

It helps to break things down like this in your head: NSS - A module based system for controlling how various OS-level databases are assembled in memory. This includes (but is not limited to) passwd, group, shadow (this is important to note), and hosts. UID lookups use the passwd database, and GID lookups use the group database. PAM - A module based system ...


14

You may have nscd (Name Service Caching Daemon) running, which you may need to restart, otherwise it's unlikely. Certain daemons might cache get*() function call results and may need restarting.


10

No you probably don't (other than what David said, and maybe ypbind, but you said not NIS). The nsswitch.conf file isn't for a daemon in particular, it is actually a file used by the C library for various system calls.


9

Be aware that existing processes will not be aware of the changes to nsswitch.conf. The nsswitch.conf(5) page states, "Within each process that uses nsswitch.conf, the entire file is read only once; if the file is later changed, the process will continue using the old configuration."


4

$ find /usr/bin/ -group shadow | xargs ls -l -rwxr-sr-x 1 root shadow 45384 2008-12-08 03:13 /usr/bin/chage -rwxr-sr-x 1 root shadow 21424 2008-12-08 03:13 /usr/bin/expiry There may not be any users, but there is certainly software that needs to be able to read that file. Note that passwd itself is setuid root, and so doesn't need this.


4

Solaris 10 ships with a working (if not up-to-date) version of samba however the libraries are not compatible with the sunfreeware product. The problem you are seeing is caused by the sunfreeware product not having an nss_winbind.so library in the package and /usr/lib/nss_winbind.so is not compatible. To fix you will have to create your own. Download the ...


4

sssd is probably the more "forward thinking" option to go with. To that extent, the other answers are correct. That said, sssd does not completely supersede the features of nslcd, contrary to popular opinion. The primary (situational) advantage of nslcd over sssd is that you can write a custom authz query with parameter substitution: pam_authz_search ...


4

Yes. System authentication on Linux and UNIX systems has been through the PAM, Pluggable Authentication Modules for decades. The PAM principle is that if you want to use a new authentication back-end you don't need to recompile all applications that use authentication such system auth, ssh, ftp, telnet sudo etc. Simple load the correct module and ...


4

LDAP really does three things on linux machines: Authentication: This is the realm of PAM, it's using username/password to verify that the user is the user. Authorization: Here is where PAM doesn't meet the need, PAM is on/off, you either get approval or you don't. Authorization is about group membership. Attributes: Where's your home directory? ...


4

RHEL/CentOS does not enable ECC by default in NSS. You have to explicitly specify which ciphers you want, e.g. curl --ciphers ecdhe_rsa_aes_128_gcm_sha_256 .... or whatever cipher is supported by your server and also supported by your version of curl/NSS. See http://stackoverflow.com/a/31108631/3081018 for more details. I tried with explicit cipher, ...


3

You're running into a namespace collision. By default /etc/nsswitch.conf is configured to look first at files then at external sources. group: files ldap. This means that the video group from /etc/group will match before the video group in ldap. This can be seen by running getent group video.


3

No, certutil doesn't have an option to add private keys. You need to use pk12util for that. If your private key is in PKCS12 format, you can add it to the key/cert database with pk12util -i keyfile.key -d/path/to/database -W password If it's in PEM format, you'll need to convert it to PKCS12 first by openssl pkcs12 -export -out server.pfx -inkey server....


3

I found this message in the sourcecode openldap-2.4.39/libraries/libldap/tls_m.c The comment says "prefer unlocked key, then key from opened certdb, then any other" My guess is that the routine is capable of unlocking a key and caching the answer. It seems to be a warning message, though, not an error.


2

For really good OpenLDAP support under FreeBSD you need: nss_ldap pam_ldap - PAM ldap module pam_mkhomedir - to automatically create users' homedir from skel after first login sudo - with LDAP support openssh-portable - with LPK patch (for users ssh keys in LDAP) add following to /etc/pam.d/sshd auth sufficient /usr/local/lib/pam_ldap.so no_warn ...


2

Rule #1 of network-based authentication: Always have a local account available. Beyond rule #1 (and in order to make it useful without getting blocked up behind nss_ldap trying to talk to a dead server): Using pam_ldap/nss_ldap you can set the bind_policy to "soft" (return immediately on server failure), which eliminates the blocking problem. You can also ...


2

I would prefer an environment with the same software and configuration as much as possible, unless people say that sssd is really better for RH-6 and nscd/nslcd is really better for RH-5. SSSD is the future and you get Kerberos auth & better compatibility with AD if that's your LDAP server for instance. Otherwise I don't see any reason not to use ...


2

The nss-pam-ldapd package allows LDAP directory servers to be used as a primary source of name service information. When I would run 'getent passwd', I would only see the users from the /etc/passwd file. When I started the /etc/init.d/nslcd service and then issued the 'getent passwd' command, I then saw all LDAP users and system users and the shells were ...


2

it's general problem for curl compiled with NSS (only redhat-linuxes, debian and suse curl packages compiled without nss). you need compile curl from sources without nss-library. so, i haven't solution how https-connections worked with nss-curl. curl --version curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.14.3.0 zlib/1.2.7 libidn/1.26 ...


2

Okay, I found the solution for that one. First : I would strongly recommend anyone getting into this to study PAM modules basics. This really helps understanding the whole thing. Now, let's have a look at my common-* files. They all have the same structure : facility required pam_unix.so [...] facility sufficient pam_mysql.so [...] Now, after ...


2

You should use SSSD and configure it to use LDAP instead of working with PAM directly. Then you can use the following in the SSSD domain configuration: access_provider = simple simple_allow_groups = groupname which is a very basic way to limit users, but you could also use access_provider=ldap and then use much more advanced LDAP queries to control ...


1

NSS is there to enumerate information about services/users (what group you belong to, where your home directory is etc). PAM determines what to do about that information. If you want to use LDAP for authentication you need pam_ldap. If you are using something else (local accounts, Kerberos etc) then you may not. So they do different things. NSS gets ...


1

SSSD is the future and much more powerful than nslcd. SSSD can provide additional features like SSO in offline machines, so you can as example, use SSSD in Notebook Workstations and the users will be able to login through the Single Sigo-On Daemon even without connection with the authentication server. There's no reason to implement nslcd and all the ...


1

I have found out that at least for samba on debian you've have to give * read access to a few attributes on the login accounts : access to attrs=userPassword by anonymous auth by * none access to dn.subtree="ou=People,dc=MYDOMAIN,dc=com" attrs=dc,cn,uid,gecos,entry by * read access to * by dn="cn=admin,dc=MYDOMAIN,dc=com" write by ...


1

I think if you do: access to attrs=userPassword,shadowLastChange by dn="cn=Admin,dc=MYDOMAIN,dc=com" write by anonymous auth by self write by * none access to * by dn="cn=Admin,dc=MYDOMAIN,dc=com" write by self write by anonymous auth by users read by * none You'll have what you want.


1

On my Ubuntu machine there are a number of commands which are set-group-id to shadow. This provides them exactly and only the privilege of reading the two shadow files (which are grouped to shadow, and only group-readable). -rwxr-sr-x 1 root shadow 35584 Mar 16 11:45 /sbin/pam_extrausers_chkpwd -rwxr-sr-x 1 root shadow 35544 Mar 16 11:45 /sbin/unix_chkpwd -...


1

CentOS 6.3 ships with OpenSSH5.3p1, there is a known bug that prevents sftp from retrieving the groupnames of files, the result is that an error is thrown and the connection is closed whenever the ls command is given. The solution is to download a more recent version of OpenSSH, I took 6.1p1 and build it from source. Mostly I followed these instructions: ...


1

I think the answer to your problem is in this this line: open("/etc/nss-pgsql-root.conf", O_RDONLY) = -1 EACCES (Permission denied) Try relaxing permissions on this file to be readable by "group" and "other" and see if that solves the problem. You are wrong that the file corresponds to /etc/shadow. It corresponds to /etc/password, which is readable by "...


1

With regards to getent passwd/shadow its most likely configuration differences in the /etc/switch.conf file. You might be using the following rule, which your client doesn't like. passwd: compat shodow: compat passwd_compat: ldap shadow_compat: ldap Iv seen this on some of my clients where i needed to change it to the following passwd: files ldap ...


1

Normally, getent shadow won't return anything unless you are root. You need to change the PAM config in /etc/pam.d to use the mysql PAM module. After that you will be able to change passwords with the normal passwd command.



Only top voted, non community-wiki answers of a minimum length are eligible