Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 23 Sep 2009 11:04:36 +0930
From:      "Daniel O'Connor" <doconnor@gsoft.com.au>
To:        Erik Norgaard <norgaard@locolomo.org>
Cc:        freebsd-current@freebsd.org, "O. Hartmann" <ohartman@zedat.fu-berlin.de>, freebsd-questions@freebsd.org
Subject:   Re: LDAP server gone -> impossible to login locally!
Message-ID:  <200909231104.39234.doconnor@gsoft.com.au>
In-Reply-To: <4AB93614.2080106@locolomo.org>
References:  <4AB8BAA9.1060100@zedat.fu-berlin.de> <200909222248.16475.doconnor@gsoft.com.au> <4AB93614.2080106@locolomo.org>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
--nextPart2436435.bbRDvSTZIW
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Wed, 23 Sep 2009, Erik Norgaard wrote:
> This sounds like the correct solution, AFAIK it's the same concept as
> for NIS, first check local files, then ldap. You don't want your root
> credentials possibly be leaked accross the network. On the other hand
> you don't want or need user accounts in the local files.
>
> Default first check local files which is fast, then fall back on ldap
> if the user is not found.

Actually I wrote them the wrong way, how odd!
I actually have..
group: cache ldap files
passwd: cache ldap files

I think that if it fails ldap, it does so very quickly - it certainly=20
did this morning when I rebooted uncleanly.

I believe I did try it as "cache files ldap" but I had some issues, I=20
can't recall what they were though. I had quite a bit of difficulty=20
getting it to work acceptably so when it did I left it alone :)

On a related note, why is slapd so damn fragile? It's a righteous pain=20
in the bum the way you have to run db_recover-X.Y /var/db/openldap-data=20
if slapd fails to start.

It wouldn't be so bad if it logged anything, but even with full logging=20
it gives a very cryptic message and if you have logging disabled (which=20
is recommended for performance!) it won't say _anything_.

=2D-=20
Daniel O'Connor software and network engineer
for Genesis Software - http://www.gsoft.com.au
"The nice thing about standards is that there
are so many of them to choose from."
  -- Andrew Tanenbaum
GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C

--nextPart2436435.bbRDvSTZIW
Content-Type: application/pgp-signature; name=signature.asc 
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (FreeBSD)

iD8DBQBKuXsv5ZPcIHs/zowRAnUkAJ47Q7wTM2MneJMjRXXmOYdqlAJfQQCgnTXK
J/F9d1WkLucHikktWAJhHzk=
=VDXn
-----END PGP SIGNATURE-----

--nextPart2436435.bbRDvSTZIW--



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?200909231104.39234.doconnor>