 | | | Can 't login to server that uses LDAP if no network | Can 't login to server that uses LDAP if no network 2005-06-21 - By Isauro Michael Napolis
Back
On Mon, 2005-06-20 at 15:21, Tim Edwards wrote:
> We've noticed a problem with our RHEL3 machines that are setup in the
> nsswitch.conf file to authenticate of both local files and LDAP. With
> these machines if they are rebooted and the network doesn't come up then
> they will not allow you to login, even as the root user.
>
> The network issues we had were simple cases of wrong IP addresses in
> config files, eg. wrong gateways, wrong IP addresses on interfaces,
> interfaces being switched around etc. Once the nsswitch.conf was edited
> to remove any LDAP references (using the recovery mode on the RHEL
> install CD) the machine boots up and logs in normally.
>
> Is there anyway to fix this so that even if there's no LDAP available
> the machine will still allow you to login as a local user (ie. root)
> without having to edit nsswitch.conf and disable LDAP authentication?
>
> Thanks
tim,
maybe the kbase article below can help.
http://kbase.redhat.com/faq/FAQ_43_5652.shtm
basically you need to use the pam_localuser.so module in the /etc/pam.d/system
-auth file.
example:
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass
auth required /lib/security/$ISA/pam_deny.so
account required /lib/security/$ISA/pam_unix.so
account sufficient /lib/security/$ISA/pam_localuser.so
account [default=bad success=ok user_unknown=ignore service_err=ignore
system_err=ignore authinfo_unavail=ignore] /lib/security/$ISA/pam_ldap.so
password required /lib/security/$ISA/pam_cracklib.so retry=3 type=
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5
shadow
password sufficient /lib/security/$ISA/pam_ldap.so use_authtok
password required /lib/security/$ISA/pam_deny.so
session required /lib/security/$ISA/pam_limits.so
session required /lib/security/$ISA/pam_unix.so
session optional /lib/security/$ISA/pam_ldap.so
regards,
Michael
--
Taroon-list mailing list
Taroon-list@(protected)
http://www.redhat.com/mailman/listinfo/taroon-list
Earn $52 per hosting referral at Lunarpages.
|
|
|