1

We have one RAC cluster of machines where the local UID:GID of a couple users (oracle and grid) do not match the UID:GID of those same users in LDAP. Ultimately we ought to change the UID and GID of these two users on every system in the cluster (and ownership of all their files) but getting the downtime to do that is difficult. Also, these two users need to be able to authenticate over the network from each node to every other node in the cluster. Just disabling remote auth for these users is not an option.

Is there any way to disable LDAP lookups for specific groups or users on a server? Perhaps with /etc/security/access.conf or some PAM setting?

These are Oracle Linux servers.

  • I'd suggest diving into /etc/pam.d where the actual mechanisms of authentication are defined. Since Oracle Linux is derived from Red Hat Enterprise Linux, the RHEL documentation might come handy when doing this: access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/… . In case you'd like a more comprehensive answer, post contents of /etc/pam.d/system-auth-something (I really can't recall the name right now) to your question. – Sami Laine Jul 26 '14 at 11:21
0

Assuming you're using sssd on your hosts, the "filter_users" and "filter_groups" options in sssd.conf appear to address your problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.