Hot answers tagged

14

You may have nscd (Name Service Caching Daemon) running, which you may need to restart, otherwise it's unlikely. Certain daemons might cache get*() function call results and may need restarting.


14

It helps to break things down like this in your head: NSS - A module based system for controlling how various OS-level databases are assembled in memory. This includes (but is not limited to) passwd, group, shadow (this is important to note), and hosts. UID lookups use the passwd database, and GID lookups use the group database. PAM - A module based system ...


10

No you probably don't (other than what David said, and maybe ypbind, but you said not NIS). The nsswitch.conf file isn't for a daemon in particular, it is actually a file used by the C library for various system calls.


7

Be aware that existing processes will not be aware of the changes to nsswitch.conf. The nsswitch.conf(5) page states, "Within each process that uses nsswitch.conf, the entire file is read only once; if the file is later changed, the process will continue using the old configuration."


4

$ find /usr/bin/ -group shadow | xargs ls -l -rwxr-sr-x 1 root shadow 45384 2008-12-08 03:13 /usr/bin/chage -rwxr-sr-x 1 root shadow 21424 2008-12-08 03:13 /usr/bin/expiry There may not be any users, but there is certainly software that needs to be able to read that file. Note that passwd itself is setuid root, and so doesn't need this.


4

Solaris 10 ships with a working (if not up-to-date) version of samba however the libraries are not compatible with the sunfreeware product. The problem you are seeing is caused by the sunfreeware product not having an nss_winbind.so library in the package and /usr/lib/nss_winbind.so is not compatible. To fix you will have to create your own. Download the ...


4

sssd is probably the more "forward thinking" option to go with. To that extent, the other answers are correct. That said, sssd does not completely supersede the features of nslcd, contrary to popular opinion. The primary (situational) advantage of nslcd over sssd is that you can write a custom authz query with parameter substitution: pam_authz_search ...


4

Yes. System authentication on Linux and UNIX systems has been through the PAM, Pluggable Authentication Modules for decades. The PAM principle is that if you want to use a new authentication back-end you don't need to recompile all applications that use authentication such system auth, ssh, ftp, telnet sudo etc. Simple load the correct module and ...


4

LDAP really does three things on linux machines: Authentication: This is the realm of PAM, it's using username/password to verify that the user is the user. Authorization: Here is where PAM doesn't meet the need, PAM is on/off, you either get approval or you don't. Authorization is about group membership. Attributes: Where's your home directory? ...


4

RHEL/CentOS does not enable ECC by default in NSS. You have to explicitly specify which ciphers you want, e.g. curl --ciphers ecdhe_rsa_aes_128_gcm_sha_256 .... or whatever cipher is supported by your server and also supported by your version of curl/NSS. See http://stackoverflow.com/a/31108631/3081018 for more details. I tried with explicit cipher, ...


3

I found this message in the sourcecode openldap-2.4.39/libraries/libldap/tls_m.c The comment says "prefer unlocked key, then key from opened certdb, then any other" My guess is that the routine is capable of unlocking a key and caching the answer. It seems to be a warning message, though, not an error.


3

You're running into a namespace collision. By default /etc/nsswitch.conf is configured to look first at files then at external sources. group: files ldap. This means that the video group from /etc/group will match before the video group in ldap. This can be seen by running getent group video.


3

No, certutil doesn't have an option to add private keys. You need to use pk12util for that. If your private key is in PKCS12 format, you can add it to the key/cert database with pk12util -i keyfile.key -d/path/to/database -W password If it's in PEM format, you'll need to convert it to PKCS12 first by openssl pkcs12 -export -out server.pfx -inkey ...


2

it's general problem for curl compiled with NSS (only redhat-linuxes, debian and suse curl packages compiled without nss). you need compile curl from sources without nss-library. so, i haven't solution how https-connections worked with nss-curl. curl --version curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.14.3.0 zlib/1.2.7 libidn/1.26 ...


2

Rule #1 of network-based authentication: Always have a local account available. Beyond rule #1 (and in order to make it useful without getting blocked up behind nss_ldap trying to talk to a dead server): Using pam_ldap/nss_ldap you can set the bind_policy to "soft" (return immediately on server failure), which eliminates the blocking problem. You can also ...


2

The nss-pam-ldapd package allows LDAP directory servers to be used as a primary source of name service information. When I would run 'getent passwd', I would only see the users from the /etc/passwd file. When I started the /etc/init.d/nslcd service and then issued the 'getent passwd' command, I then saw all LDAP users and system users and the shells were ...


2

I would prefer an environment with the same software and configuration as much as possible, unless people say that sssd is really better for RH-6 and nscd/nslcd is really better for RH-5. SSSD is the future and you get Kerberos auth & better compatibility with AD if that's your LDAP server for instance. Otherwise I don't see any reason not to use ...


2

For really good OpenLDAP support under FreeBSD you need: nss_ldap pam_ldap - PAM ldap module pam_mkhomedir - to automatically create users' homedir from skel after first login sudo - with LDAP support openssh-portable - with LPK patch (for users ssh keys in LDAP) add following to /etc/pam.d/sshd auth sufficient /usr/local/lib/pam_ldap.so no_warn ...


2

Okay, I found the solution for that one. First : I would strongly recommend anyone getting into this to study PAM modules basics. This really helps understanding the whole thing. Now, let's have a look at my common-* files. They all have the same structure : facility required pam_unix.so [...] facility sufficient pam_mysql.so [...] Now, after ...


1

Figured it out, and I hope this will help someone in the future :) The workstations that can login to ldap were using SSSD to authenticate against the ldap server. After installing and configuring it all I had to do was switch the lines in nsswitch.conf like so: passwd: files ldap shadow: files ldap group: files ldap to: passwd: ...


1

To answer your first question the reasons given for removing it from debian were Ophaned since 1.5 years Dead upstream (former maintainer is also the Savannah project admin) Virtually unused https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617591 Seems the last reelase it was in was squeeze, it wasn't in wheezy or jessie. The second part of your ...


1

I should probably go home and have some food or something. Forgot to create the folder nssdb (yes, it's a folder and not a file.. which is so clearly stated in every forum google came up with during my debugging). I should know this. # mkdir -p /etc/pam_pkcs11/nssdb # chmod 700 /etc/pam_pkcs11/nssdb # certutil -d /etc/pam_pkcs11/nssdb -N Also note that ...


1

SSSD is the future and much more powerful than nslcd. SSSD can provide additional features like SSO in offline machines, so you can as example, use SSSD in Notebook Workstations and the users will be able to login through the Single Sigo-On Daemon even without connection with the authentication server. There's no reason to implement nslcd and all the ...


1

No, shadow group should have no users, but this group is required for shadow passwords to work. I guess the idea here is to have the file accessible by root and root only. You may have extra users in root group, this is why the separate user group was created.


1

NSS is there to enumerate information about services/users (what group you belong to, where your home directory is etc). PAM determines what to do about that information. If you want to use LDAP for authentication you need pam_ldap. If you are using something else (local accounts, Kerberos etc) then you may not. So they do different things. NSS gets ...


1

Holy cow... someone had given the Organization supervisor rights to the TREE :O


1

IIRC, the user and password that has to be stored there is the one that can read all of the appropriate LDAP attributes. It just so happens that LDAP-root can read them all. If time is taken to create a user in the LDAP structure that has the ability to read the correct attributes, but not write them, it will allow a less privileged account to be stored in ...


1

As sysadmin1138 says, you do need read access to the LDAP database. You can achive this by adding a special ldap user with read access to every attributes (except userPassword). dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <some sha1 hash> ...


1

Are there good solutions for this besides heartbeat? Install two LVS balancer(with VRRP) and Keepalived.


1

Can anycast DNS work for you? I can't really tell from the info in your question. In any case anycast DNS has been discussed on serverfault before so if you search for it, you should be able to find more info, either on serverfault or the interwebs.



Only top voted, non community-wiki answers of a minimum length are eligible