2

What configuration errors would lead to the situation where ldapsearch works and getent works, but authentication seems to fail sometimes during SSH login?

I have two servers that query a third server for LDAP authentication. All servers are running Ubuntu 18.04.

The LDAP server (running OpenLDAP / slapd) uses a self-signed certificate and both client servers have "TLS_REQCERT allow" in /etc/ldap/ldap.conf . Both client servers can also successfully use ldapsearch over ldaps to query for users. On both client servers, I can run getent passwd and get the expected results.

However, on one server, when I log in via ssh, I experience a consistent delay (about thirty seconds). /var/log/auth.log from that server includes these lines:

pam_systemd(sshd:session): Failed to create session: Connection timed out nss_ldap: reconnecting to LDAP server... nss_ldap: reconnected to LDAP server ldaps://[IP address] after 1 attempt systemd-logind: nss_ldap: could not connect to any LDAP server as [...] - Can't contact LDAP server systemd-logind: nss_ldap: failed to bind to LDAP server ldaps://[IP address]: Can't contact LDAP server

As far as know, all relevant pieces of the configuration for the two client servers are the same as each other's.

I have tried:

sudo systemctl restart systemd-logind sudo systemctl restart polkit

sudo journalctl -u systemd-logind shows:

nss_ldap: could not connect to any LDAP server as [...] - Can't contact nss_ldap: failed to bind to LDAP server ldaps://[IP address]: Can't contact LDAP server nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...

On the client side of SSH, I see what's outlined here: ssh connection takes forever to initiate, stuck at "pledge: network"

Improve this question
1

3 Answers 3

Reset to default
3

It turns out that "apt install libnss-ldapd" seems to fix the problem, which removes libnss-ldap and installs nscd and nslcd.

Improve this answer
0

I'm unsure what worked for me:

apt install libnss-ldapd service nscd stop

or changing from ldapi:// to ldap://

My REHL7 server (running openladp) is configured for ldapi:// and it has RHEL7 clients connecting through ldapi://

I couldn't get the Debian 11 instance to use ldapi:// though.

EDIT: Using ldap:// instead of ldapi:// worked for me.

Improve this answer
2
  • Ran another VM to test. Did not install libnss-ldapd but DID use ldap:// instead of ldapi://. It worked without any issues. Commented Nov 28, 2021 at 6:32
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. Commented Dec 2, 2021 at 18:24
-1 
apt install libnss-ldapd systemctl restart systemd-logind

fixed it for me

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.