Date: Thu, 6 Mar 2014 17:36:12 -0500 From: Mark Saad <nonesuch@longcount.org> To: "freebsd-stable@freebsd.org" <freebsd-stable@freebsd.org> Subject: Re: NSS ldap errors Message-ID: <CC55938C-0AE9-4D8D-AE66-83FBC1C46BEE@longcount.org> In-Reply-To: <201403061621.16046.jhb@freebsd.org> References: <53174346.6070703@phat.za.net> <2FA6FDB3-6F13-4C86-A9CD-EDD88EE072EA@longcount.org> <201403061621.16046.jhb@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Mar 6, 2014, at 4:21 PM, John Baldwin <jhb@freebsd.org> wrote: > >> On Wednesday, March 05, 2014 9:41:21 pm Mark Saad wrote: >> >> Looping the list back in . >> >>> On Mar 5, 2014, at 10:31 AM, Aragon Gouveia <aragon@phat.za.net> wrote: >>> >>> Hi, >>> >>> I'm trying to implement net/nss-pam-ldapd on 9.2-RELEASE, and hitting some NSS issues. PAM authentication with SSH works fine, but there are a lot > of NSS errors in /var/log/debug.log: >>> >>> Mar 4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, passwd, getpwnam_r, not found, and no fallback provided >>> Mar 4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, group, setgrent, not found, and no fallback provided >>> Mar 4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, group, getgrent_r, not found, and no fallback provided >>> Mar 4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, group, endgrent, not found, and no fallback provided >>> Mar 4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, passwd, endpwent, not found, and no fallback provided >>> Mar 4 17:15:11 <user.debug> cstor1 -bash: NSSWITCH(_nsdispatch): ldap, passwd, getpwuid_r, not found, and no fallback provided >>> Mar 4 17:15:11 <user.debug> cstor1 -bash: NSSWITCH(_nsdispatch): ldap, passwd, endpwent, not found, and no fallback provided >>> >>> And in the case of bash, it's unable to resolve the LDAP username, and the resulting PS1 prompt shows: >>> >>> [I have no name!@cstor1 ~]$ >>> >>> The author of nss-pam-ldapd isn't sure what the problem is: >>> >>> http://lists.arthurdejong.org/nss-pam-ldapd-users/2014/msg00044.html >>> >>> FWIW, the same problems occur with net/nss_ldap. >>> >>> Any NSS gurus who can help? >>> >>> >>> Thanks, >>> Aragon >> >> >> This is related to using bash-static as root's shell . As well as setting non root users login shell to bash-static . >> The "I have no name" user name issue and the the getpwuid* calls failing have to do with the fact that bash-static can not load some library , but my > memory is lost on the exact library and details . I wasted a bunch of time on this in 7.2-RELEASE and it took a while to debug this . Using a standard > port of bash or any other shell resolved this for me . > > Yes, static binaries have no copy of the runtime linker around, so they can't > invoke dlopen() to open nss_foo.so modules. I have no idea if you can use > nscd to work around this for static binaries. > John, I tested both with nscd and straight lookups and I had the same issue either way . As soon as you said "can't dlopen nss_libfoo" it all came back to me . I had bash-static with the remote syslog patch as everyone's shell . It took a while to track down if it was the syslog patch or the static shell . > -- > John Baldwin --- Mark saad | mark.saad@longcount.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CC55938C-0AE9-4D8D-AE66-83FBC1C46BEE>