Bug 426050
| Summary: | sshd fails without nscd when using LDAP | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Joshua Daniel Franklin <joshuadfranklin> | ||||
| Component: | nss_ldap | Assignee: | Nalin Dahyabhai <nalin> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | |||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.1 | CC: | jplans, jsafrane, kengert, k.georgiou, ralph+rh-bugzilla, rrelyea, tmraz | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2009-09-02 20:34:48 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Joshua Daniel Franklin
2007-12-18 01:02:21 UTC
I'm sorry I cannot reproduce the problem here. I'm running this openssh version with authentication against a LDAP server through pam_ldap and everything works fine even without nscd. Can you rebuild the openssh src.rpm with %define nss 0 and try whether it helps? Sure, I'll try that. By the way, do you have "bind_policy soft" in /etc/ldap.conf? I've tried both with bind_policy soft and hard and still cannot reproduce it. OK, it works with '%define nss 0' in the SPEC. I rebuilt from this srpm: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/openssh-4.3p2-24.el5.src.rpm Toggling back to offical el5 the problem comes back. Created attachment 289929 [details]
My /etc/ldap.conf
So the NSS suport is the culprit. Although sshd doesn't call any function from NSS library it still has to link to it because some .c files which call NSS are shared with the ssh client. It seems like just the linking to NSS causes some conflicts with the nss_ldap or openldap library itself. I'm ccing maintainers of NSS, nss_ldap and openldap if they have some ideas on how to debug/fix this. From spamgl 2007-12-19 20:15 at CentOS bugzilla: "I have seen the same problem when trying to authenticate against our main openldap server, v2.2.13-6.4e (Centos 4.4). However when I modify /etc/ldap.conf to point at our backup ldap server, openldap v2.2.13-4 (Centos 4.3), users can authenticate. Turning on nscd, on the affected client, allows us to authenticate against our main openldap (v2.2.13-6.4e) server." Could you try to strace the old openssh and new openssh servers when trying to authenticate against the ldap server? Of course please ensure that you do not release security relevant info in the attached logs as this is a public bugzilla. (such as private keys of the server, passwords/password hashes, or ldap secret) I'm sorry I had other priorities today and I'm leaving on holiday tomorrow so I will probably not be able to get to this for a couple weeks. The CentOS bugzilla has this very interesting note from spamgl: "For another work-around, we've found that turning off SSL in ldap.conf on the client and contacting the LDAP server unencrypted also works on our main LDAP server (v2.2.13-6.4e)." Also you are of course welcome to make this high priority but enabling nscd is a pretty easy workaround. In fact I normally have nscd enabled but had disabled it temporarily to debug something else. I've finally reproduced the problem here. The problem is caused by sharing the TCP connection to the LDAP server between parent and child processes and NSS linking to pthread library. The question is how to fix it. This is another incarnation of bug 154314, it is fixed by the patch to nss_ldap. |