Red Hat Bugzilla – Full Text Bug Listing
|Summary:||nss_ldap security update breaks bash|
|Product:||Red Hat Enterprise Linux 5||Reporter:||Frode Nordahl <frode>|
|Component:||nss_ldap||Assignee:||Nalin Dahyabhai <nalin>|
|Status:||CLOSED DUPLICATE||QA Contact:|
|Version:||5.2||CC:||dchuha, jplans, redhat, rh-bugzilla|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2008-05-28 18:09:48 EDT||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
Description Frode Nordahl 2008-05-22 05:54:32 EDT
Description of problem: Child processes of bash have problems talking to the LDAP server. strace of a process shows that it attempts to reconnect to the LDAP server and fails. However, a strace of a process doing the same after downgrading does not show communication with the LDAP server at all. Version-Release number of selected component (if applicable): nss_ldap-253-12.el5 How reproducible: 100% Steps to Reproduce: 1. Log in as a user (not root) on a system using nss_ldap on a 32bit system 2. A=`echo hello`; echo $A Actual results: Blank output Expected results: hello Additional info: Downgrading to nss_ldap-253-5.el5 fixes the problem
Comment 1 David Chuha 2008-05-22 13:20:47 EDT
I can confirm this after upgrading to nss_ldap-253-12.el5. It also appears that running nscd will work around the problem until the issue is resolved.
Comment 2 Stephen John Smoogen 2008-05-22 18:13:30 EDT
In our environment, running nscd will allow for logins, but does not allow for su.
Comment 3 Jason Daly 2008-05-22 18:15:51 EDT
I'm having similar issues. After upgrading to RHEL 5.2, ordinary users can no longer log in (X or console), although authentication seems to succeed. A look at /var/log/secure shows the session open, then immediately close. Logging in remotely via ssh produces an interactive session, but almost any shell command I try (tcsh in this case) results in a "Broken pipe" error message. Clients are configured to use ldaps to connect to the directory server. Downgrading the configuration to use plain ldap fixes the problem. Downgrading to nss_ldap-253-5.el5 also fixes the problem.