Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have an LDAP directory server installed that stores all the user data in one server and I have an ongoing authentication mechanism using pam to request user information from it. This works very well but, whenever one of my clients is disconnected from the main server no user can login. My idea was to install nscd on every client and to change the nsswitch lookup order so that all requests find the cache first. This is how it's configured:

passwd:         cache files ldap
group:          cache files ldap
shadow:         cache files ldap
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

I added the "cache" spec to achieve this. My nscd is configured like so:

enable-cache        passwd      yes
positive-time-to-live   passwd      36600
negative-time-to-live   passwd      20
suggested-size      passwd      211
check-files     passwd      yes
persistent      passwd      yes
shared          passwd      yes
max-db-size     passwd      33554432
auto-propagate      passwd      yes

enable-cache        group       yes
positive-time-to-live   group       36600
negative-time-to-live   group       60
suggested-size      group       211
check-files     group       yes
persistent      group       yes
shared          group       yes
max-db-size     group       33554432
auto-propagate      group       yes

enable-cache        hosts       yes
positive-time-to-live   hosts       36600
negative-time-to-live   hosts       20
suggested-size      hosts       211
check-files     hosts       yes
persistent      hosts       yes
shared          hosts       yes
max-db-size     hosts       33554432

enable-cache        services    yes
positive-time-to-live   services    28800
negative-time-to-live   services    20
suggested-size      services    211
check-files     services    yes
persistent      services    yes
shared          services    yes
max-db-size     services    33554432

I tried disconnecting my ethernet connection to test if the lookups are done correctly but when I check the /var/log/auth log, I see that my client is still looking for the ldap server.

What can be wrong?? I'm using Ubuntu 10.04

Thanks

share|improve this question
    
In Fedora land, they try to achieve this with the System Security Services Daemon after noting that the nscd solution was not best suited for this task. Just a hint, maybe it helps you. (See here for discussions about Debian clients) –  sr_ Oct 18 '11 at 9:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.