From owner-freebsd-questions@FreeBSD.ORG Wed Sep 23 09:48:17 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4843610656C6; Wed, 23 Sep 2009 09:48:17 +0000 (UTC) (envelope-from doconnor@gsoft.com.au) Received: from cain.gsoft.com.au (cain.gsoft.com.au [203.31.81.10]) by mx1.freebsd.org (Postfix) with ESMTP id 946AC8FC19; Wed, 23 Sep 2009 09:48:16 +0000 (UTC) Received: from inchoate.gsoft.com.au ([118.210.91.254]) (authenticated bits=0) by cain.gsoft.com.au (8.13.8/8.13.8) with ESMTP id n8N9mDBL084716 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Wed, 23 Sep 2009 19:18:13 +0930 (CST) (envelope-from doconnor@gsoft.com.au) From: "Daniel O'Connor" To: "O. Hartmann" Date: Wed, 23 Sep 2009 19:18:01 +0930 User-Agent: KMail/1.9.10 References: <4AB8BAA9.1060100@zedat.fu-berlin.de> <200909231104.39234.doconnor@gsoft.com.au> <4AB9DDD8.2020700@zedat.fu-berlin.de> In-Reply-To: <4AB9DDD8.2020700@zedat.fu-berlin.de> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1945813.sjCl92Da08"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200909231918.10541.doconnor@gsoft.com.au> X-Spam-Score: -2.544 () AWL,BAYES_00,RDNS_NONE X-Scanned-By: MIMEDefang 2.63 on 203.31.81.10 Cc: freebsd-questions@freebsd.org, freebsd-current@freebsd.org Subject: Re: LDAP server gone -> impossible to login locally! X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Sep 2009 09:48:17 -0000 --nextPart1945813.sjCl92Da08 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Wed, 23 Sep 2009, O. Hartmann wrote: > Daniel O'Connor wrote: > > On Wed, 23 Sep 2009, Erik Norgaard wrote: > >> This sounds like the correct solution, AFAIK it's the same concept > >> as for NIS, first check local files, then ldap. You don't want > >> your root credentials possibly be leaked accross the network. On > >> the other hand you don't want or need user accounts in the local > >> files. > >> > >> Default first check local files which is fast, then fall back on > >> ldap if the user is not found. > > > > Actually I wrote them the wrong way, how odd! > > I actually have.. > > group: cache ldap files > > passwd: cache ldap files > > I had issues with the order > > 'files ldap' > > too, that's why I choosed 'ldap files'. Can you remember any details why? I can't :) > > On a related note, why is slapd so damn fragile? It's a righteous > > pain in the bum the way you have to run db_recover-X.Y > > /var/db/openldap-data if slapd fails to start. > > Yes, this is a lot of pain. I have had issues the same way and never > figured out what the reason was. /var/ is very often corrupted after > a crash, power failure or unclean reboot. Maybe not slpad is that > fragile, but db47 is. Yes, although openldap's handling of a bad DB is quite poor IMO.. That=20 said I haven't had the nerve to look at the code. I had a quick look to see if there was a more robust looking backend but=20 nothing jumped out at me. =2D-=20 Daniel O'Connor software and network engineer for Genesis Software - http://www.gsoft.com.au "The nice thing about standards is that there are so many of them to choose from." -- Andrew Tanenbaum GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C --nextPart1945813.sjCl92Da08 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.12 (FreeBSD) iD8DBQBKue7a5ZPcIHs/zowRAiRjAJ9dAyjv7NLIlBBNW7iWjFR/ZtOHagCeMnfv rYoWEs9MMeFoCf8bv7lPa+Q= =Wzqf -----END PGP SIGNATURE----- --nextPart1945813.sjCl92Da08--