Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an LDAP directory server installed that stores all the user data in one server and I have an ongoing authentication mechanism using pam to request user information from it. This works very well but, whenever one of my clients is disconnected from the main server no user can login. My idea was to install nscd on every client and to change the nsswitch lookup order so that all requests find the cache first. This is how it's configured:

passwd:         cache files ldap
group:          cache files ldap
shadow:         cache files ldap
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

I added the "cache" spec to achieve this. My nscd is configured like so:

enable-cache        passwd      yes
positive-time-to-live   passwd      36600
negative-time-to-live   passwd      20
suggested-size      passwd      211
check-files     passwd      yes
persistent      passwd      yes
shared          passwd      yes
max-db-size     passwd      33554432
auto-propagate      passwd      yes

enable-cache        group       yes
positive-time-to-live   group       36600
negative-time-to-live   group       60
suggested-size      group       211
check-files     group       yes
persistent      group       yes
shared          group       yes
max-db-size     group       33554432
auto-propagate      group       yes

enable-cache        hosts       yes
positive-time-to-live   hosts       36600
negative-time-to-live   hosts       20
suggested-size      hosts       211
check-files     hosts       yes
persistent      hosts       yes
shared          hosts       yes
max-db-size     hosts       33554432

enable-cache        services    yes
positive-time-to-live   services    28800
negative-time-to-live   services    20
suggested-size      services    211
check-files     services    yes
persistent      services    yes
shared          services    yes
max-db-size     services    33554432

I tried disconnecting my ethernet connection to test if the lookups are done correctly but when I check the /var/log/auth log, I see that my client is still looking for the ldap server.

What can be wrong?? I'm using Ubuntu 10.04


share|improve this question

closed as off-topic by Jeff Schaller, cuonglm, Archemar, garethTheRed, Stephen Kitt Jun 9 at 7:41

  • This question does not appear to be about Unix or Linux within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

In Fedora land, they try to achieve this with the System Security Services Daemon after noting that the nscd solution was not best suited for this task. Just a hint, maybe it helps you. (See here for discussions about Debian clients) – sr_ Oct 18 '11 at 9:14
I'm voting to close this question as off-topic because Ubuntu 10.04 is out of LTS – Jeff Schaller Jun 9 at 0:08