Tag Info

Hot answers tagged

9

No you probably don't (other than what David said, and maybe ypbind, but you said not NIS). The nsswitch.conf file isn't for a daemon in particular, it is actually a file used by the C library for various system calls.


9

You may have nscd (Name Service Caching Daemon) running, which you may need to restart, otherwise it's unlikely. Certain daemons might cache get*() function call results and may need restarting.


5

It helps to break things down like this in your head: NSS - A module based system for controlling how various OS-level databases are assembled in memory. This includes (but is not limited to) passwd, group, shadow (this is important to note), and hosts. UID lookups use the passwd database, and GID lookups use the group database. PAM - A module based system ...


4

Be aware that existing processes will not be aware of the changes to nsswitch.conf. The nsswitch.conf(5) page states, "Within each process that uses nsswitch.conf, the entire file is read only once; if the file is later changed, the process will continue using the old configuration."


3

$ find /usr/bin/ -group shadow | xargs ls -l -rwxr-sr-x 1 root shadow 45384 2008-12-08 03:13 /usr/bin/chage -rwxr-sr-x 1 root shadow 21424 2008-12-08 03:13 /usr/bin/expiry There may not be any users, but there is certainly software that needs to be able to read that file. Note that passwd itself is setuid root, and so doesn't need this.


3

LDAP really does three things on linux machines: Authentication: This is the realm of PAM, it's using username/password to verify that the user is the user. Authorization: Here is where PAM doesn't meet the need, PAM is on/off, you either get approval or you don't. Authorization is about group membership. Attributes: Where's your home directory? ...


3

Yes. System authentication on Linux and UNIX systems has been through the PAM, Pluggable Authentication Modules for decades. The PAM principle is that if you want to use a new authentication back-end you don't need to recompile all applications that use authentication such system auth, ssh, ftp, telnet sudo etc. Simple load the correct module and ...


3

Solaris 10 ships with a working (if not up-to-date) version of samba however the libraries are not compatible with the sunfreeware product. The problem you are seeing is caused by the sunfreeware product not having an nss_winbind.so library in the package and /usr/lib/nss_winbind.so is not compatible. To fix you will have to create your own. Download the ...


2

For really good OpenLDAP support under FreeBSD you need: nss_ldap pam_ldap - PAM ldap module pam_mkhomedir - to automatically create users' homedir from skel after first login sudo - with LDAP support openssh-portable - with LPK patch (for users ssh keys in LDAP) add following to /etc/pam.d/sshd auth sufficient /usr/local/lib/pam_ldap.so no_warn ...


2

Rule #1 of network-based authentication: Always have a local account available. Beyond rule #1 (and in order to make it useful without getting blocked up behind nss_ldap trying to talk to a dead server): Using pam_ldap/nss_ldap you can set the bind_policy to "soft" (return immediately on server failure), which eliminates the blocking problem. You can also ...


2

sssd is probably the more "forward thinking" option to go with. To that extent, the other answers are correct. That said, sssd does not completely supersede the features of nslcd, contrary to popular opinion. The primary (situational) advantage of nslcd over sssd is that you can write a custom authz query with parameter substitution: pam_authz_search ...


2

You're running into a namespace collision. By default /etc/nsswitch.conf is configured to look first at files then at external sources. group: files ldap. This means that the video group from /etc/group will match before the video group in ldap. This can be seen by running getent group video.


2

No, certutil doesn't have an option to add private keys. You need to use pk12util for that. If your private key is in PKCS12 format, you can add it to the key/cert database with pk12util -i keyfile.key -d/path/to/database -W password If it's in PEM format, you'll need to convert it to PKCS12 first by openssl pkcs12 -export -out server.pfx -inkey ...


1

Figured it out, and I hope this will help someone in the future :) The workstations that can login to ldap were using SSSD to authenticate against the ldap server. After installing and configuring it all I had to do was switch the lines in nsswitch.conf like so: passwd: files ldap shadow: files ldap group: files ldap to: passwd: ...


1

it's general problem for curl compiled with NSS (only redhat-linuxes, debian and suse curl packages compiled without nss). you need compile curl from sources without nss-library. so, i haven't solution how https-connections worked with nss-curl. curl --version curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.14.3.0 zlib/1.2.7 libidn/1.26 ...


1

No, shadow group should have no users, but this group is required for shadow passwords to work. I guess the idea here is to have the file accessible by root and root only. You may have extra users in root group, this is why the separate user group was created.


1

I would prefer an environment with the same software and configuration as much as possible, unless people say that sssd is really better for RH-6 and nscd/nslcd is really better for RH-5. SSSD is the future and you get Kerberos auth & better compatibility with AD if that's your LDAP server for instance. Otherwise I don't see any reason not to use ...


1

The nss-pam-ldapd package allows LDAP directory servers to be used as a primary source of name service information. When I would run 'getent passwd', I would only see the users from the /etc/passwd file. When I started the /etc/init.d/nlscd service and then issued the 'getent passwd' command, I then saw all LDAP users and system users and the shells were ...


1

CentOS 6.3 ships with OpenSSH5.3p1, there is a known bug that prevents sftp from retrieving the groupnames of files, the result is that an error is thrown and the connection is closed whenever the ls command is given. The solution is to download a more recent version of OpenSSH, I took 6.1p1 and build it from source. Mostly I followed these instructions: ...


1

I think the answer to your problem is in this this line: open("/etc/nss-pgsql-root.conf", O_RDONLY) = -1 EACCES (Permission denied) Try relaxing permissions on this file to be readable by "group" and "other" and see if that solves the problem. You are wrong that the file corresponds to /etc/shadow. It corresponds to /etc/password, which is readable by ...


1

With regards to getent passwd/shadow its most likely configuration differences in the /etc/switch.conf file. You might be using the following rule, which your client doesn't like. passwd: compat shodow: compat passwd_compat: ldap shadow_compat: ldap Iv seen this on some of my clients where i needed to change it to the following passwd: files ldap ...


1

Normally, getent shadow won't return anything unless you are root. You need to change the PAM config in /etc/pam.d to use the mysql PAM module. After that you will be able to change passwords with the normal passwd command.


1

Can anycast DNS work for you? I can't really tell from the info in your question. In any case anycast DNS has been discussed on serverfault before so if you search for it, you should be able to find more info, either on serverfault or the interwebs.


1

Are there good solutions for this besides heartbeat? Install two LVS balancer(with VRRP) and Keepalived.


1

As sysadmin1138 says, you do need read access to the LDAP database. You can achive this by adding a special ldap user with read access to every attributes (except userPassword). dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <some sha1 hash> ...


1

IIRC, the user and password that has to be stored there is the one that can read all of the appropriate LDAP attributes. It just so happens that LDAP-root can read them all. If time is taken to create a user in the LDAP structure that has the ability to read the correct attributes, but not write them, it will allow a less privileged account to be stored in ...


1

Holy cow... someone had given the Organization supervisor rights to the TREE :O


1

I have found out that at least for samba on debian you've have to give * read access to a few attributes on the login accounts : access to attrs=userPassword by anonymous auth by * none access to dn.subtree="ou=People,dc=MYDOMAIN,dc=com" attrs=dc,cn,uid,gecos,entry by * read access to * by dn="cn=admin,dc=MYDOMAIN,dc=com" write by ...


1

I think if you do: access to attrs=userPassword,shadowLastChange by dn="cn=Admin,dc=MYDOMAIN,dc=com" write by anonymous auth by self write by * none access to * by dn="cn=Admin,dc=MYDOMAIN,dc=com" write by self write by anonymous auth by users read by * none You'll have what you want.



Only top voted, non community-wiki answers of a minimum length are eligible