From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1IjwgW-0004iY-Mz for garchives@archives.gentoo.org; Mon, 22 Oct 2007 12:47:09 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.1/8.14.0) with SMTP id l9MCkGtk008896; Mon, 22 Oct 2007 12:46:16 GMT Received: from mx1.disciplina.net (terra.disciplina.net [82.70.32.61]) by robin.gentoo.org (8.14.1/8.14.0) with ESMTP id l9MCiOJl006582 for ; Mon, 22 Oct 2007 12:44:24 GMT Received: from ignis (ignis.disciplina.net [82.70.32.57]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.disciplina.net (Postfix) with ESMTP id 89BDC91D3; Mon, 22 Oct 2007 12:44:32 +0000 (UTC) From: Benjamin Smee Organization: Gentoo To: gentoo-dev@lists.gentoo.org Subject: Re: [gentoo-dev] Slapd calls nss_ldap before opening its ports Date: Mon, 22 Oct 2007 13:44:19 +0100 User-Agent: KMail/1.9.7 Cc: Bertram Scharpf References: <20071022121229.GA24735@bart.bs.l> In-Reply-To: <20071022121229.GA24735@bart.bs.l> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200710221344.21550.strerror@gentoo.org> X-Archives-Salt: 12f8dbd4-3925-44f3-a7ef-f0211035167f X-Archives-Hash: cfd58faec0330cdc0a6dfedd8508105f On Monday 22 October 2007 13:12:29 Bertram Scharpf wrote: > Hi, > > when setting up LDAP Pam authentication I encountered a > problem that seems to be neither Slapd- nor > nss_ldap-specific. > > When running the init script there comes up an error that > clutters up my syslog with a lot of useless error messages: > > @(#) $OpenLDAP: slapd 2.3.38 (Oct 18 2007 22:12:26) $ > root@myhost:/var/tmp/portage/net-nds/openldap-2.3.38/work/openldap-2.3.38/ >servers/slapd nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: > Can't contact LDAP server nss_ldap: failed to bind to LDAP server > ldap://127.0.0.1/: Can't contact LDAP server nss_ldap: failed to bind to > LDAP server ldapi://%2fvar%2frun%2fldapi_sock/: Can't contact LDAP server > ... > nss_ldap: could not search LDAP server - Server is unavailable > WARNING: No dynamic config support for database ldbm. > slapd starting > > I found out that the Gentoo init script activates the > options "-u ldap -g ldap". Without them, the error messages > do not appear. Therefore I suppose the slapd daemon tries to > obtain passwd/shadow information for ldap via nss_ldap. At > least when I say "compat" in nsswitch.conf, the error > message doesn't appear as well. instead of -u ldap -g ldap, try putting in the UID and GID. This should stop the calls to the server. > The files should be searched first. The "ldap" information > is present in all three of them. I even tried to chown the > shadow file to ldap but this didn't save me from the weird > messages either. Don't play with the perms on /etc/shadow, you're just openning up security holes. -- Benjamin Smee (strerror) net-mail/netmon/forensics/crypto/ldap Fingerprint: 497F 5E98 1FA0 C313 EA0B 08C7 004A 66ED 448B E78C -- gentoo-dev@gentoo.org mailing list