I have setup a OpenSUSE 12.3 workstation with SSO through KRB5 and LDAP.
This works pretty smoothly up to the point where GDM isn't very happy about that fact that it cannot access user's home directories that are actually nfs mounts with krb5p.
If no home directory is mounted GDM works fine. If at least one home directory is mounted then GDM will crash when attempting to open the greeter / login screen.
If I remove LDAP (sss) from
/etc/nsswitch.conf then GDM will work fine even if the home directories are mounted.
At first I used to have the nfs mount in fstab for
/home/users. There GDM would crash every time. Then I have tried to switch to autofs to mount
/home/users/* individually. There GDM would work at first but crash thereafter (when the user logs out). Now I have configured it to use pam_mount so that the home directories would get unmounted after a user logs out. Now GDM works as long as there is no other user logged on to the system.
So the problem must be somehow related to the fact that if the user
gdm that the GDM greeter uses tries to access any of the mounted home directories, its permission will be denied by the nfs server due to a missing kerberos ticket. Even root cannot access these directories.
Any attempt to give GDM access to these directories before the respective user logs in, would be a security issue.
Interestingly though if the home directory doesn't exist then GDM has absolutely no problem with it. So GDM does tolerate
file does not exist, but doesn't tolerate
So this makes me conclude that whatever GDM is trying to access from the home directories is not required at all.
So what is it that GDM is trying to get from the home directories? And more importantly, how can I disable it from trying to do so? How can I prevent it from hanging? Any ideas for some extra troubleshooting?
Or how can I make the mounted home directories invisible to GDM so that it won't trip over them?