LDAP queries for local users

authenticationldapnsswitch.confpam

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. LDAP authentication works fine but we have found, from the log, that also for local users there are some LDAP queries and we think that this could be related to the crash.
I am working on this problem, changing nsswitch.conf, pam modules and so on, but I can't get rid of this LDAP call for local users.
Does anyone have any idea on how to stop LDAP queries for local users?

Thank you very much in advance.

In our machine is installed SuSE Linux 11 SP2 and OpenLDAP 2.4.
This is nsswitch.conf

passwd:         compat
group:          files ldap
hosts:          files dns
networks:       files dns

passwd_compat:  ldap
group_compat:   ldap

UPDATE

This is the log taken from the LDAP server after a login attempt on another machine from a user called guest which is local to that machine

Jul 29 11:00:45 vmtemplate slapd[2465]: conn=1627 op=1 SRCH base="dc=test,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=guest))"
Jul 29 11:00:45 vmtemplate slapd[2465]: conn=1627 op=2 SRCH base="dc=test,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(memberUid=guest))"
Jul 29 11:00:47 vmtemplate slapd[2465]: conn=1008 op=407 SRCH base="dc=test,dc=com"

Best Answer

To put it simply, you can't, not without removing ldap from nsswitch.conf and defeating the point of the exercise.

Some calls want that data. An easy illustration of this is to run the following command, which will definitely trip whatever log filter your colleagues are wringing their hands watching: getent passwd

This will dump all users, both from the local system and LDAP. The important thing to understand about how dupe usernames/uids are handled is to visualize what would happen if those dupe entries were actually in /etc/passwd, in the order seen by getent passwd. This has never led to any crashes that I know of, otherwise every terrible software vendor who has ever added a second user with a uid of 0 to a system would have immediately brought the machine to its knees.

Related Topic