Package: libnss-ldap Version: 256-1 Severity: normal We have at least two systems running the libnss-ldap package, one Debian lenny and one Ubuntu feisty. Both exhibit this same problem.
Both systems boot fine without libnss-ldap. My goal is for each system to continue working with libnss-ldap: local passwd and group files should override values from our LDAP directory. However I would like users without local accounts to be able to login with their LDAP account. To this end, I changed the passwd and group lines in nsswitch.conf (see entire file attached): passwd: compat ldap group: compat ldap This works great when our LDAP server is available, but if it's not, I still want users with local accounts to be able to login. Instead, if I boot the system and our LDAP server is unavailable, no logins are possible. Not even root is able to login. In this case, I need to reboot the system in single user mode and remove ldap from nsswitch.conf before anyone can login. This is particularly a problem on the system actually running our LDAP server, since our LDAP server is obviously never available when it boots. In this case as well, I must boot in single user mode, remove ldap from nsswitch.conf, finish booting, and finally return ldap to nsswitch.conf. Once done, users can happily login with their LDAP accounts. I have also tried changing the passwd and group lines in nsswitch.conf: passwd: compat ldap [NOTFOUND=return] group: compat ldap [NOTFOUND=return] This case behaves the same when our LDAP server is unavailalbe. When our LDAP server is available, users with local accounts can login, but users with LDAP accounts can't. I've not yet installed nscd or either system. Thanks for maintaining libnss-ldap in Debian, Jack -- System Information: Debian Release: lenny/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.21-2-686 (SMP w/2 CPU cores) Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages libnss-ldap depends on: ii debconf [debconf-2.0] 1.5.14 Debian configuration management sy ii libc6 2.6.1-1+b1 GNU C Library: Shared libraries ii libkrb53 1.6.dfsg.1-6 MIT Kerberos runtime libraries ii libldap2 2.1.30-13.4 OpenLDAP libraries Versions of packages libnss-ldap recommends: ii libpam-ldap 184-2 Pluggable Authentication Module al pn nscd <none> (no description available) -- debconf information: libnss-ldap/dblogin: false libnss-ldap/override: true * shared/ldapns/base-dn: dc=campcoop,dc=com * shared/ldapns/ldap-server: ldap://ldap.campcoop.com libnss-ldap/confperm: false * libnss-ldap/rootbinddn: cn=admin,dc=campcoop,dc=com * shared/ldapns/ldap_version: 3 libnss-ldap/binddn: cn=proxyuser,dc=example,dc=net * libnss-ldap/nsswitch: libnss-ldap/dbrootlogin: true
# /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat ldap group: compat ldap shadow: compat hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis
