Bug 806951

Summary: update from centos 5.7 to 5.8, /var/log/message full of nss_ldap: failed to bind to LDAP server
Product: Red Hat Enterprise Linux 5 Reporter: emmanuel.borlet
Component: nss_ldapAssignee: Nalin Dahyabhai <nalin>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 5.8CC: jhrozek, jplans, prc
Target Milestone: rc   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-26 17:11:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description emmanuel.borlet 2012-03-26 15:13:31 UTC 
Description of problem:

After update from centos 5.7 to 5.8, /var/log/message full of nss_ldap: failed to bind to LDAP server
aditionnaly i have found that "getent passwd" didn't show the account on the ldap after the on in /etc/passwd 
BUT 
"getent passwd <a user>" work as in 5.7

I'm using Zimbra 7 ldap on the same server as described :
http://wiki.zimbra.com/wiki/UNIX_and_Windows_Accounts_in_Zimbra_LDAP_and_Zimbra_Admin_UI
all is done by code…


Version-Release number of selected component (if applicable):
Centos 5.8
Zimbra 7

How reproducible:

I have seen on numbers servers
  
Additional info:

The answer is to shut down nscd
/etc/init.d/nscd stop

put a wrong password in 
/etc/ldap.secret

try (this one should not work)
getent passwd
in the logs :
failed to bind to LDAP server ldap://xxx: Invalid credentials

put the good password in 
/etc/ldap.conf

start nscd
/etc/init.d/nscd start

try (this one should work)
getent passwd


it seems that nscd store a wrong password in it's caches
…

it's the fist time i see that !

for info :
nscd-2.5-81.el5_8.1
nss_ldap-253-49.el5
nss_db-2.2-35.4.el5_5
glibc-common-2.5-81.el5_8.1
openldap-2.3.43-25.el5 (client libs ?)
zimbra-core-7.1.3_GA_3346.RHEL5-20110928134520
(openldap -> /opt/zimbra/openldap-2.4.26.5z)
Comment 1 Jakub Hrozek 2012-03-26 15:25:15 UTC 
This sounds like a duplicate of bug #797410 to me. Can you check if your ldap.secret does end with a newline and add it if it does not?
Comment 2 emmanuel.borlet 2012-03-26 15:54:03 UTC 
yep you right 

my php code didn't put a newline at the end

so this bug is duplicate an uncorrected yet ;)

i have using "nano" to edit the /etc/ldap.conf file
so nano have added the newline..
Comment 3 Jakub Hrozek 2012-03-26 17:11:28 UTC 
Thank you for testing.

*** This bug has been marked as a duplicate of bug 797410 ***