4

If I execute

sudo getent shadow

I see password hashes for all the local users who have them. For most of the LDAP accounts I only see * in the password field. However, for a few LDAP users, I see password hashes. I have verified that they don't have local accounts (i.e. no entry in /etc/passwd but getent passwd username returns a line).

In fact, logged in as myself, my user entry is one of the ones with an *.

There is a single LDAP server running OpenLDAP with a single group of accounts (one branch in the tree).

The LDAP-client servers are running nscd and libnss-ldap.

This is a portion of /etc/nsswitch.conf on the LDAP-client servers:

passwd:         files ldap
group:          files ldap
shadow:         files ldap

LDAP is used to authenticate the user for login to the LDAP-client server in this case and at some point the authentication mechanism, PAM in this case, must check a hash of the password provided by the user at login against the stored hash which is contained in the LDAP database.

Each user's LDAP account stores their password hash and has the objectClasses of posixAccount and shadowAccount (among other values and settings).

Only system accounts have local entries in /etc/password and /etc/shadow. User accounts are all on LDAP (and only there). All users in LDAP have userPassword entries.

What might cause this or how can I run down the cause of it? Why doesn't getent shadow return password hashes for all LDAP users?

  • 2
    Wouldn't that depend on what's happening on the LDAP server? – Gilles Dec 12 '16 at 23:35
  • 1
    @gilles: Of course, but that's kind of a vague question. Presume that all the LDAP users can successfully log into the server that the getent command is run from. – Dennis Williamson Dec 12 '16 at 23:38
  • Uh, I may be missing something because I'm not familiar with LDAP. What does the user being able to log in have to do with the LDAP server exposing a password hash? – Gilles Dec 12 '16 at 23:43
  • @Gilles: LDAP is used to authenticate the user for login in this case and at some point the authentication mechanism, PAM in this case, must check a hash of the password provided by the user at login against the stored hash which is contained in the LDAP database. – Dennis Williamson Dec 12 '16 at 23:54
  • 1
    @roaima: I;m using nscd and libnss-ldap. The LDAP server is OpenLDAP. – Dennis Williamson Dec 13 '16 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.