Questions tagged [nss]

Name Service Switch, an modular interface built in to the GNU C library that handles data retrieval from system databases, e.g., password, group, etc.

Filter by
Sorted by
Tagged with
1 vote
0 answers
51 views

Authenticating ftp against multiple (postgres) databases

Current State Given is a host with a couple of IPv4 addresses and HTTP & FTP access for each address; each vhost has access to a PostgreSQL database. Web- and ftp-authentication is done against ...
user avatar
  • 11
0 votes
1 answer
164 views

nss-pam-ldapd password authentication doesn't work on CentOS 7 only when using `su`

Context I have 2 different machins here whose main difference is that one is runs CentOS6 the other CentOS7. Both run the latest distribution-available version of the lib : 0.8.13 for COS7, 0.7.5 for ...
user avatar
  • 447
3 votes
1 answer
1k views

The memcache was not invalidated by NSS responder

I was deleting a user. # userdel u1 The memcache was not invalidated by nss responder. But finally the user was deleted. What does "The memcache was not invalidated by nss responder" means? ...
user avatar
2 votes
1 answer
93 views

How does OpenSSH / NSS determine the address to use for a hostname with multiple DNS entries?

Suppose I have some device with multiple addresses like so (due to some combination of AD and VMWare NAT name resolution, but that's not germane): [centos@localhost ~]$ getent hosts my-weird-AD-device....
user avatar
  • 247
-1 votes
1 answer
398 views

Give permissions of LDAP group files to specific user

Here is the situation: I want user usr to have the same permissions of a group grp, anywhere in the system. grp is not a local group, it comes from a LDAP server, of which I have no control over. I ...
user avatar
  • 3
1 vote
1 answer
138 views

Can't understand why libnss-pam-ldapd does not find LDAP library

I am trying to cross-compile libnss-pam-ldapd for an arm architecture. The configure command always gives the following error: checking for library containing ldap_search_ext... no checking for ...
user avatar
2 votes
1 answer
450 views

What is the easiest way to set up composable POSIX groups for SSH & Samba authentication?

Background I'm putting together what I would consider to be a fairly ordinary chunk of infrastructure, but have been running into so many problems that I can't help but wonder if there's an easier way....
user avatar
0 votes
0 answers
246 views

How can the other users from Slapd log on to Samba?

We run an open source image processing web application. This provides users with a Windows network drive for uploading gigabytes of image data. The application offers the convenience that a network ...
user avatar
1 vote
1 answer
512 views

Unable to hit websites with Self-Signed Certificates after NSS upgrade with any application

We recently upgraded NSS from version 3.44 (nss-3.44.0-4.el7.x86_64) to version 3.53 (nss-3.53.1-3.el7_9.x86_64). After this upgrade, any calls out to our internal website that uses a self-signed ...
user avatar
1 vote
0 answers
75 views

How to customize NSS filters to match users against several attributes?

My context: I have a OpenSMTPD instance that uses PAM as its authentication backend. My PAM configuration use NSS to authenticate the users against a LDAP directory. I would like to make NSS match ...
user avatar
  • 145
0 votes
0 answers
1k views

How can I change nsswitch.conf?

I have been using RADIUS and TACACS+ AAA on CentOS 6 and need to duplicate that functionality on CentOS 8. However, the changes to how you now configure NSS confuse me. How do I make changes to ...
user avatar
  • 101
0 votes
1 answer
442 views

Inspect content of SLAB

Is there a way, preferably simple, how to inspect content of SLAB caches, especially dentry cache? I can imagine that this can be doable through kernel modules, but I highly doubt security would let ...
user avatar
  • 1
0 votes
1 answer
649 views

NSS query against OpenLDAP server using GSSAPI with proxy authorization

SASL/GSSAPI needs Kerberos authentication against the LDAP server with proxy authorization if using LDAP authentication with nss-pam-ldapd on a Debian Buster operating system. I try to configure this ...
user avatar
  • 396
0 votes
1 answer
336 views

Logins doesn't work with PAM/NSS

I have a computer room that uses libpam-pgsql and libnss-pgsql2 for users authentication. Right now, the system is working perfectly with Debian 8 clients. I want to upgrade and I am trying to setup ...
user avatar
  • 11
0 votes
1 answer
49 views

configure nsscache with samba4 active directory

I have a problem caching the users from samba4 AD with nsscache, since there is no uid, rather samAccountName or cn in AD. When I use the uid-like attribute: # Default uid-like attribute ldap_uidattr ...
user avatar
  • 143
0 votes
1 answer
237 views

Can't authenticate against a 389DS server. I suspect it's a SSSD issue on client side

I'm running a 389DS LDAPS server (with self-signed certificates) on a Fedora 30 remote machine called "miservidor.midominio.local". There I have a typical directory containing user and group entries. ...
user avatar
  • 135
2 votes
0 answers
97 views

Username collision files/ldap, both passwords accepted

Ubuntu 18.04.3 server, slapd running, LDAP auth configured with libnss-ldapd and libpam-ldapd packages (all on the same machine). Created a local user with useradd and a user in the LDAP database with ...
user avatar
0 votes
1 answer
504 views

OpenLDAP: Non-anonymous access for PAM/NSS

I've install LDAP with PAM/NSS. So I've installed libnss-ldap libpam-ldap nscd on my Debian 9 apt-get install libnss-ldap libpam-ldap nscd I configured it and all was working rigth. I decided to ...
user avatar
1 vote
2 answers
119 views

Where to install NSS modules on CoreOS?

I have a custom NSS module that I wrote and I typically install it by copying the library like so... cp libnss_mymodule.so.0 /lib64/ ... then I add my module to the /etc/nsswitch.conf ... $ grep ...
user avatar
  • 204
0 votes
1 answer
214 views

Linux custom NSS module, `_nss_SERVICE_getspnam_r` is called but `_nss_SERVICE_getpwnam_r` is not

I'm creating a custom NSS module. I managed to make it work on my local Redhat 7.3 box, configured nsswitch.conf correctly passwd: files SERVICE shadow: files SERVICE and confirmed that both ...
user avatar
1 vote
0 answers
3k views

Centos yum error: Failed to initialize NSS library - other fixes not working for me

Basic issue from screenshot: yum error: Failed to initialize NSS library There was a problem importing one of the Python modules required to run yum. The error leading to this problem was: cannot ...
user avatar
4 votes
3 answers
14k views

yum/rpm Failed to initialize NSS library in chroot

I am performing a yum update from CentOS 7.4 to CentOS 7.5, when nspr and nss soft-softoken receive the updates, I am left with the following error: yum update nspr error: Failed to initialize NSS ...
user avatar
  • 580
0 votes
0 answers
271 views

Authenticate and mount home using ssh and nfs

How would I go about trying to authenticate a user against a particular system and then mounting his tree using NFS. The user would have his own desktop and when the user goes to work on a separate ...
user avatar
  • 101
1 vote
1 answer
522 views

Understanding LDAP Authentication

During the last days I've been fiddling around with LDAP authentication and I've managed to configure some Linux systems (CentOS 6 and 7) to perform the SSH authentication process against an OpenLDAP ...
user avatar
0 votes
0 answers
905 views

Cannot load CA certificate file ca-root-nss.crt entry did not validate

The error message is clear enough. Some cert data isn't valid. But the debugging data provided seems a bit meager to me. How do I find cert 128? What is confusing is this file is up to date, so this ...
user avatar
  • 46
-6 votes
1 answer
679 views

Almost every app (rpm,curl..) is broken (Red Hat Enterprise Linux 6.8) after rpm force installation - libnssutil3.so error

I'm using Red Hat Enterprise Linux 6.8 on my intra-net machine. While I'm trying to install new rpm, or even curl to some url, I'm getting that output: rpm: symbol lookup error: /lib64/libnssutil3.so:...
user avatar
1 vote
0 answers
622 views

Mozilla NSS does not accept certificate with "PKCS #1 SHA-256 With RSA Encryption" signature

On Centos 7.2 NSS certutil and other tools using NSS libraries reject my certificate with the message certutil: certificate is invalid: The certificate was signed using a signature algorithm that is ...
user avatar
0 votes
1 answer
329 views

Weird behavior with ldap and getent or repquota

I've observed a weird behavior in my network. I have my network users stored in OpenLDAP 2.4 which also serves a samba 3.6 Domain. I have user quotas on my NFS servers and that is where I stumbled ...
user avatar
  • 107
0 votes
0 answers
143 views

Centos 6 nss-pam-ldapd delay?

I have configured Centos with nss-pam-ldapd and seems to work fine. ( I can login with my AD credentioals). Except there seems to be a delay of about 20-30 seconds before I can log in. I also set-up ...
user avatar
0 votes
1 answer
1k views

how to control ldap users access using groupdn?

I am using openldap, nslcd and nss-pam-ldapd. I want to restrict users login to ldap client. I have configured this in CentOS 6.5 without any problem using groupdn. but in CentOS 7, there is no ...
user avatar
  • 1
0 votes
0 answers
1k views

Changing SSL-version for curl

I have been trying for hours to change the SSL Version for curl from NSS to OpenSSL because I have a web application that's dependant on it. I'm running RedHat RHEL 6.7 on a 64-bit system. I have ...
user avatar
0 votes
1 answer
5k views

pkcs11_lib - NSS Initialize Failed (bad database?)

I'm having trouble getting PKCS#11 and PAM to work, for whatever reason nss has stopped working and I can't create a new database. Here's the output from PKCS11 and NSS: DEBUG:pkcs11_lib.c:187: ...
user avatar
  • 216
0 votes
1 answer
818 views

libnss-mysql gone in Jessie?

I was happily using libpam-ldap and libnss-mysql (authenticating clients directly against LDAP, with NSS data such as UID/GID/home dir kept in a mysql database). Now I tried to install Jessie on ...
user avatar
  • 3
0 votes
1 answer
775 views

what does it mean ? openldap: TLS: no unlocked certificate for certificate '<some certificate subject>'

just spent a lot of time with centos 6.7 and openldap. it was configured with simple certificates and a root-ca in nice little pem files, but after an upgrade from centos 6.4, connecting to the slapd ...
user avatar
2 votes
0 answers
3k views

Import a P12 certificate into a NSS database (with an alias)

Here´s the deal... I have a personal P12 certificate generated by a certificate authority. I want to use it with CURL to access a protected URL. If CURL on CENTOS was compiled with openssl, I should ...
user avatar
  • 143
0 votes
1 answer
74 views

Why is LDAP using servers other than those specified?

I have a linux system that is using Active Directory (2012) for LDAP lookups of users and groups. It's in a network that is connected to our main site by VPN. When the VPN goes down, all ldap ...
user avatar
  • 366
2 votes
0 answers
232 views

libnss-mysql on freebsd 10.1

i have libnss-mysql installed on freebsd 10.1. Everything works except groups command. getent group - ok # getent group ....... froxlorlocal:*:1003:www <-- data from passwd vmail:*:2000 <...
user avatar
  • 21
1 vote
1 answer
17k views

SSL handshake with CentOS, curl and ECDHE

Since I limited my Ciphers to ECDHE because of the Logjam vulnerabilities, I am not able to do a curl from a Centos machine anymore. (works from Ubuntu) $ curl -v https://mysite.mydomain.com * ...
user avatar
  • 1,824
2 votes
1 answer
3k views

centos 6.6 ldap authentication no longer works after certificate update on ldap host

We recently updated the CA certificates on our LDAP host. There are a couple of CentOS 5.x servers which don't seem to have any issues authenticating against the LDAP host, but there's one Centos 6.6 ...
user avatar
  • 144
1 vote
0 answers
358 views

The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]

May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules? As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
user avatar
  • 11
1 vote
1 answer
965 views

Can I configure pam_ldap without configuring nss?

On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
user avatar
7 votes
1 answer
23k views

How to add an existing key to the certutil key database

I have created an SSL keypair with OpenSSL. I uploaded the Certificate Signing Request to my SSL Certificate provider and got my certificate files. I added my certificate and the required CA ...
user avatar
2 votes
0 answers
306 views

Stop NSSwitch on first match

I am using a MySQL backend to store some of my UNIX users into a database. In order for the system to be able to retrieve name information about these users, I added MySQL to NSS's sources: passwd: ...
user avatar
1 vote
1 answer
3k views

make PHP curl use openssl instead of NSS

Does anyone know how could I force php to use curl with openssl instead of NSS on RHEL 6? I've installed curl-openssl-7.30.0-1.1.el6.x86_64.rpm but how can I tell php to use it? Actually is there a ...
user avatar
0 votes
1 answer
496 views

Usergroups in LDAP: User and Group in same object

"Usergroups" are a common concept in UNIX, many Linux distributions (e.g. Debian) use it as default. It means that each user has its corresponding private group (e.g., User "alex" has also a group "...
user avatar
  • 538
2 votes
1 answer
6k views

Token error when trying to change password through pam-mysql

I am currently preparing a machine for a web hosting service, and I decided to use MySQL to store all our users (since the rest of our services use it already). For that, I am using libnss-mysql and ...
user avatar
6 votes
2 answers
1k views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
user avatar
0 votes
0 answers
991 views

How to enable Forward Secrecy with mod_nss in apache2?

I use apache2 on a SLES box and have configured SSL via mod_nss (because the standard mod_ssl is not able to provide TLS 1.1/1.2 due an old and not up-gradable openssl <1.0 package in SLES). How ...
user avatar
  • 1,478
1 vote
1 answer
5k views

OpenLDAP client configuration. Can search but cannot login?

I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :) First off, the LDAP ...
user avatar
3 votes
3 answers
2k views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
user avatar
  • 257