NSS ldap errors

[Mark Saad]

> On Mar 6, 2014, at 4:21 PM, John Baldwin <jhb at freebsd.org> wrote:
> 
>> On Wednesday, March 05, 2014 9:41:21 pm Mark Saad wrote:
>> 
>> Looping the list back in .
>> 
>>> On Mar 5, 2014, at 10:31 AM, Aragon Gouveia <aragon at phat.za.net> wrote:
>>> 
>>> Hi,
>>> 
>>> I'm trying to implement net/nss-pam-ldapd on 9.2-RELEASE, and hitting some NSS issues.  PAM authentication with SSH works fine, but there are a lot
> of NSS errors in /var/log/debug.log:
>>> 
>>> Mar  4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, passwd, getpwnam_r, not found, and no fallback provided
>>> Mar  4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, group, setgrent, not found, and no fallback provided
>>> Mar  4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, group, getgrent_r, not found, and no fallback provided
>>> Mar  4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, group, endgrent, not found, and no fallback provided
>>> Mar  4 17:15:00 <cron.debug> cstor1 cron[68418]: NSSWITCH(_nsdispatch): ldap, passwd, endpwent, not found, and no fallback provided
>>> Mar  4 17:15:11 <user.debug> cstor1 -bash: NSSWITCH(_nsdispatch): ldap, passwd, getpwuid_r, not found, and no fallback provided
>>> Mar  4 17:15:11 <user.debug> cstor1 -bash: NSSWITCH(_nsdispatch): ldap, passwd, endpwent, not found, and no fallback provided
>>> 
>>> And in the case of bash, it's unable to resolve the LDAP username, and the resulting PS1 prompt shows:
>>> 
>>> [I have no name!@cstor1 ~]$
>>> 
>>> The author of nss-pam-ldapd isn't sure what the problem is:
>>> 
>>> http://lists.arthurdejong.org/nss-pam-ldapd-users/2014/msg00044.html
>>> 
>>> FWIW, the same problems occur with net/nss_ldap.
>>> 
>>> Any NSS gurus who can help?
>>> 
>>> 
>>> Thanks,
>>> Aragon
>> 
>> 
>> This is related to using bash-static as root's shell . As well as setting non root users login shell to bash-static .
>> The "I have no name" user name issue and the the getpwuid* calls failing have to do with the fact that bash-static can not load some library , but my
> memory is lost on the exact library and details . I wasted a bunch of time on this in 7.2-RELEASE and it took a while to debug this .  Using a standard 
> port of bash or any other shell resolved this for me . 
> 
> Yes, static binaries have no copy of the runtime linker around, so they can't
> invoke dlopen() to open nss_foo.so modules.  I have no idea if you can use
> nscd to work around this for static binaries.
> 

John, I tested both with nscd and straight lookups and I had the same issue either way . 

As soon as you said "can't dlopen nss_libfoo" it all came back to me . I had bash-static with the remote syslog patch as everyone's shell . It took a while to track down if it was the syslog patch or the static shell . 

> -- 
> John Baldwin


---
Mark saad | mark.saad at longcount.org