Problem: FreeBSD 7.x && ssh v2 && nss_ldap

[Konrad Heuer]

I see a problem on two systems running FreeBSD 7.0 or 7.1 which are 
configured as OpenLDAP clients using the nss_ldap module.

When someone logs on using ssh protocol version 2 the session will not be 
initialized correctly. The user will only get his primary group 
affiliation but no affiliation to other groups (memberUid attribute in 
LDAP group entries).

On 7.1 the ssh login process hangs forever with open ldap queries, on 7.0 
the group list is incomplete. On several 6.x systems, all works correctly.
I have used the configuration for years now.

There are some workarounds I found:

a) use ssh protocol version 1
b) set UseLogin to yes in sshd_config
c) avoid ssl encryption in communication to ldap server
    (ldap://... uri instead of ldaps://... in ldap.conf)

Does anybody see similar problems? Does anybody have an idea what may 
couse the problem?

Best regards

Konrad Heuer
GWDG, Am Fassberg, 37077 Goettingen, Germany, kheuer2 at gwdg.de