0

We are using an LDAP server with both Solaris and RHEL servers and planning to migrate more servers over to RHEL. However we have an issue with LDAP on all Red Hat servers. When we type "getent passwd", all users on the entire LDAP Server are shown, instead of only the users that have access to this server. Normally about 10 to 50 people have access to a server, so Solaris prints out this list of users, while Red Hat flat out prints out a list of all users that exist in the LDAP (about 650).

We use nscd/nslcd on RHEL 6.2. Migrating to sssd is not a solution short-term, although we are considering doing so in the future.

I have found out that this can be changed by using compat as a source for /etc/nsswitch.conf, which enumerates so you only see the users with access to the +netgroup in /etc/passwd.

  • What is normal behavior on Red Hat Linux Servers?
  • Is there a security risk in users being able to see all other users?
  • Do you recommend using compat in /etc/nsswitch.conf as a solution?
Improve this question
1
  • This is expected behavior.
    – Tom O'Connor
    Aug 13, 2013 at 10:22

1 Answer 1

Reset to default
1

nsswitch is correct, don't change it! it DOESN'T have any filtering capability, so if it's outputting the ldap users, its set correctly.

The problem is the ldap filter in /etc/ldap.conf. On solaris is filtering the users and only allowing the ones matching the filter, on the RHEL you aren't probably using any filter and so allowing all users.

check the pam_filter option. you can use this ldap.conf example as base if your is too empty

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .