Bug#458623: libnss-ldapd: problem with SSH logins

2008-01-03 Thread Petter Reinholdtsen
[Arthur de Jong] > By the way, wouldn't it be simpler to limit which users could login > with PAM or something like that and have NSS show all the users? It is not only for login. When I user is removed from a relevant netgroup, I want cron top no longer start his cronjobs, and files owned by tha

Bug#458623: libnss-ldapd: problem with SSH logins

2008-01-03 Thread Arthur de Jong
On Thu, 2008-01-03 at 00:57 +0100, Petter Reinholdtsen wrote: > [Arthur de Jong] > > I have not tested such a setup before but from what I can see from > > my tests is that it may be very inefficient with the current version > > of nss-ldapd. It is better to use: > > passwd: files ldap > > gro

Bug#458623: libnss-ldapd: problem with SSH logins

2008-01-02 Thread Petter Reinholdtsen
[Arthur de Jong] > I have not tested such a setup before but from what I can see from my > tests is that it may be very inefficient with the current version of > nss-ldapd. It is better to use: > passwd: files ldap > group: files ldap > shadow: files ldap > (you also don't need the + at the

Bug#458623: libnss-ldapd: problem with SSH logins

2008-01-02 Thread Arthur de Jong
On Wed, 2008-01-02 at 13:25 +0100, Petter Reinholdtsen wrote: > Here is the output from nslcd -d, with comments to explain what was > done when. I trimmed the long lists of "error writing to client". Thank you, it has been very helpful. Especially your config at the end: > /etc/nsswitch.conf >

Bug#458623: libnss-ldapd: problem with SSH logins

2008-01-02 Thread Petter Reinholdtsen
[Arthur de Jong] > 2. perform some lookups > getent passwd svn > getent group svn > id -a svn > and report the output and the output from nslcd above? Here is the output from nslcd -d, with comments to explain what was done when. I trimmed the long lists of "error writing t

Bug#457936: Bug#458623: libnss-ldapd: problem with SSH logins

2008-01-02 Thread Arthur de Jong
On Tue, 2008-01-01 at 23:55 +0100, Petter Reinholdtsen wrote: > I tried the svn version, and it is definitely better when it comes to > this problem. Both 'getent group svn' and 'getent group|grep svn' > show the group members, and 'id pere' report what appear to be the > correct set of group mem