2

I have Ubuntu 14.04 and LDAP as center of authentication. It works fine until LDAP server is online. Sometimes network is going to down between LDAP and other servers and LDAP is unavailable, so users can't login to server with theirs LDAP creds.

I have installed nscd and during LDAP is offline command like
getent passwd $userid runs successfull. I tried several manual from internet, like: http://ubuntuforums.org/showthread.php?t=1708785 but it doesn't work for me.

Guys, could you please share your configs with LDAP configuration which able to provide access to server with LDAP creds during LDAP is offline?

  • I'm not sure that LDAP does this, and would probably cite security concerns as the reason. Say a user's password gets leaked, so they change it. All someone need do is go to another machine and unplug the network. They can then authenticate with the old password, and plug the network back in once logged in. The whole point of LDAP is to not keep the accounts locally so that many machines can reference a common source. – Centimane Jul 8 '16 at 12:24
  • there are as minimum two services nscd and nslcd which provide cache, its provide time-to-live cache. Offline authentication required for laptops during its won't connect for main network. – Oleg Ilyin Jul 8 '16 at 12:27
  • 1
    In sssd.conf you can set cache_credentials = True. do you have that set? – Centimane Jul 8 '16 at 12:32
  • from my experiment cache will only work for user who've connected at least once. – Archemar Jul 8 '16 at 12:46
  • Unfortunately I don't have SSSd and I can't replace software in current solution. There is fully enough to have cache only for users who's connected at least once – Oleg Ilyin Jul 8 '16 at 12:52
2

nscd can only be used for caching NSS maps like passwd and groups etc. But it does not handle anything of the PAM stuff.

Also nss-pam-ldapd aka nslcd does not cache password logins coming in through PAM.

But that's exactly what sssd does: It checks the clear-text password against LDAP while in online mode and stores a salted SHA-512 hash to its cache DB. This password hash is used when checking a password while in off-line mode.

Having said this you have to think a bit more about real-world use-cases:

Password caching is always useful when using Linux on a laptop while traveling, that's the perfect use-case for sssd.

If your network goes down you're probably in more general trouble. Now ask yourself:

  • Does it make sense trying a login to normal machines? No doubt you have to work somewhere to fix the network problem. But is that your LDAP-integrated Linux system?
  • If you have many machines getting redeployed in a data-center, did you ever provide your password on all machines before?

There's one use-case: If for some strange reasons, e.g. a local network driver going crazy, and you have to login through a console (via BMC) to fix this, it would be useful to have a cached password.

But in most of these cases you won't need or can't even use an off-line login.

And if you insist having it you might use a SSH emergency key with proper security controls in place for the private key.

P.S.: And yes, having many LDAP replicas in various racks of your data-center to avoid such an outage is the right thing to do.

0

While I also recommend to have client side caching as mentioned with sssd, you can also reduce the risks by having LDAP replicas in place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.