pam_ldap and nss_ldap : checken and egg problem with "wheel" group and "su" utility

[Chao Shin]

> Hello, Freebsd-security.
>
>   I have chicken-adn-egg problem with wheel group and su utility when
> all users but root are stored in LDAP.
>
>     wheel group should be in /etc/group to allow basic system services
> to start before LDAP is available.
>
>     But when "wheel" is in /etc/group with only "root" member (as all
>  other members are in LDAP), system never takes "wheel" members from
>  LDAP (because /etc/group has priority) and "su" doesn't work!
>
>    What is proper way to resolve this problem?
>

I don't have system to test this now, but you can try below config in your
nsswitch.conf


group: files [success=return notfound=continue] ldap
passwd: files [success=return notfound=continue] ldap

I didn't meet this problem in my last company's environment

-- 
The Power to Serve