Does not work offline. about nsscache

[jaqx0r]

Is libnsscache from https://github.com/google/libnss-cache installed?

…

On Thu, 27 Oct 2022, 18:27 William Mantly, ***@***.***> wrote: Hello, I am trying to use nsscache to allow login on desktops/laptops from a small openLDAP deployment while the device does not have a network connection. I have set up nsscache, did an update and verify and everything seems in order. I have changed the nsswitch.conf file to have ldap cache and just cachce. Both work while the system is online, but once the network connection is removed, user login does not work. How can I use nsscache offline? I do not understand why it doesn't work. — Reply to this email directly, view it on GitHub <#166>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXFX67BACSH2R4WQDSLWGTWFIVFRANCNFSM6AAAAAARPXXJYQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[wmantly]

Yes. When I try to login offline, this appears in the logs:

Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: reconnecting to LDAP server...
Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server

nsswitch.conf

passwd:         files systemd cache
group:          files systemd cache
shadow:         files cache
gshadow:        files 

hosts:          files mdns4_minimal [NOTFOUND=return] dns myhostname
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

nsscache.conf

[DEFAULT]

# Default NSS data source module name
source = ldap

# Default NSS data cache module name; 'files' is compatible with the
# libnss-cache NSS module.  'nssdb' is deprecated, and should not be used for
# new installations.
cache = files

# NSS maps to be cached
maps = passwd, group, shadow

# Directory to store our update/modify timestamps
timestamp_dir = /var/lib/nsscache

# Lockfile to use for update/repair operations
#lockfile = /var/run/nsscache

# Defaults for specific modules; prefaced with "modulename_"

##
# ldap module defaults.
#

# Enable to connect to Active Directory. If enabled (set to 1),
# default Active Directory attributes will be used for mapping.
# Leave disabled if connecting to openldap.
#ldap_ad = 0

# LDAP URI to query for NSS data
ldap_uri = ldap://10.1.0.55

# Base for LDAP searches
ldap_base = dc=theta42,dc=com

# Default LDAP search filter for maps
ldap_filter = (objectclass=posixAccount)

# Default LDAP search scope
#ldap_scope = one

# Default LDAP BIND DN, empty string is an anonymous bind
ldap_bind_dn = "cn=ldapclient service,ou=People,dc=theta42,dc=com"

# Default LDAP password, empty DN and empty password is used for
# anonymous binds
ldap_bind_password = "*******"

ldap_tls_require_cert = 'never'

# files module defaults

# Directory to store the plain text files
files_dir = /etc

# Suffix used on the files module database files
files_cache_filename_suffix = cache

[passwd]
ldap_base = ou=people,dc=theta42,dc=com

[group]

ldap_base = ou=groups,dc=theta42,dc=com
ldap_filter = (objectclass=posixGroup)

[shadow]

ldap_filter = (objectclass=posixAccount)

[jaqx0r]

This is a pam issue, not a nsscache issue. The log line indicates to me that pam requires an answer from LDAP, if I recall correctly you need to mark that source with "sufficient" or remove it entirely and rely only on db and cache.

…

On Fri, 28 Oct 2022, 03:56 William Mantly, ***@***.***> wrote: Yes. When I try to login offline, this appears in the logs: Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: reconnecting to LDAP server... Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server nsswitch.conf passwd: files systemd cache group: files systemd cache shadow: files gshadow: files hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname networks: files protocols: db files services: db files ethers: db files rpc: db files nsscache.conf [DEFAULT] # Default NSS data source module name source = ldap # Default NSS data cache module name; 'files' is compatible with the # libnss-cache NSS module. 'nssdb' is deprecated, and should not be used for # new installations. cache = files # NSS maps to be cached maps = passwd, group, shadow # Directory to store our update/modify timestamps timestamp_dir = /var/lib/nsscache # Lockfile to use for update/repair operations #lockfile = /var/run/nsscache # Defaults for specific modules; prefaced with "modulename_" ## # ldap module defaults. # # Enable to connect to Active Directory. If enabled (set to 1), # default Active Directory attributes will be used for mapping. # Leave disabled if connecting to openldap. #ldap_ad = 0 # LDAP URI to query for NSS data ldap_uri = ldap://10.1.0.55 # Base for LDAP searches ldap_base = dc=theta42,dc=com # Default LDAP search filter for maps ldap_filter = (objectclass=posixAccount) # Default LDAP search scope #ldap_scope = one # Default LDAP BIND DN, empty string is an anonymous bind ldap_bind_dn = "cn=ldapclient service,ou=People,dc=theta42,dc=com" # Default LDAP password, empty DN and empty password is used for # anonymous binds ldap_bind_password = "*******" ldap_tls_require_cert = 'never' # files module defaults # Directory to store the plain text files files_dir = /etc # Suffix used on the files module database files files_cache_filename_suffix = cache [passwd] ldap_base = ou=people,dc=theta42,dc=com [group] ldap_base = ou=groups,dc=theta42,dc=com ldap_filter = (objectclass=posixGroup) [shadow] ldap_filter = (objectclass=posixAccount) — Reply to this email directly, view it on GitHub <#166 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXFX64Q7WGWZH4EWK3H76LWFKX5DANCNFSM6AAAAAARPXXJYQ> . You are receiving this because you commented.Message ID: ***@***.***>

[jaqx0r]

Oh, I just realised you're looking at the nss config but not pam. Check out your /etc/pam.d and change how the LDAP module is configured.

…

On Fri, 28 Oct 2022, 09:43 Jamie Wilkinson, ***@***.***> wrote: This is a pam issue, not a nsscache issue. The log line indicates to me that pam requires an answer from LDAP, if I recall correctly you need to mark that source with "sufficient" or remove it entirely and rely only on db and cache. On Fri, 28 Oct 2022, 03:56 William Mantly, ***@***.***> wrote: > Yes. When I try to login offline, this appears in the logs: > > Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server > Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: reconnecting to LDAP server... > Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server > > nsswitch.conf > > passwd: files systemd cache > group: files systemd cache > shadow: files > gshadow: files > > hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname > networks: files > > protocols: db files > services: db files > ethers: db files > rpc: db files > > > nsscache.conf > > > [DEFAULT] > > # Default NSS data source module name > source = ldap > > # Default NSS data cache module name; 'files' is compatible with the > # libnss-cache NSS module. 'nssdb' is deprecated, and should not be used for > # new installations. > cache = files > > # NSS maps to be cached > maps = passwd, group, shadow > > # Directory to store our update/modify timestamps > timestamp_dir = /var/lib/nsscache > > # Lockfile to use for update/repair operations > #lockfile = /var/run/nsscache > > # Defaults for specific modules; prefaced with "modulename_" > > ## > # ldap module defaults. > # > > # Enable to connect to Active Directory. If enabled (set to 1), > # default Active Directory attributes will be used for mapping. > # Leave disabled if connecting to openldap. > #ldap_ad = 0 > > # LDAP URI to query for NSS data > ldap_uri = ldap://10.1.0.55 > > # Base for LDAP searches > ldap_base = dc=theta42,dc=com > > # Default LDAP search filter for maps > ldap_filter = (objectclass=posixAccount) > > # Default LDAP search scope > #ldap_scope = one > > # Default LDAP BIND DN, empty string is an anonymous bind > ldap_bind_dn = "cn=ldapclient service,ou=People,dc=theta42,dc=com" > > # Default LDAP password, empty DN and empty password is used for > # anonymous binds > ldap_bind_password = "*******" > > ldap_tls_require_cert = 'never' > > # files module defaults > > # Directory to store the plain text files > files_dir = /etc > > # Suffix used on the files module database files > files_cache_filename_suffix = cache > > [passwd] > ldap_base = ou=people,dc=theta42,dc=com > > [group] > > ldap_base = ou=groups,dc=theta42,dc=com > ldap_filter = (objectclass=posixGroup) > > [shadow] > > ldap_filter = (objectclass=posixAccount) > > — > Reply to this email directly, view it on GitHub > <#166 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAXFX64Q7WGWZH4EWK3H76LWFKX5DANCNFSM6AAAAAARPXXJYQ> > . > You are receiving this because you commented.Message ID: > ***@***.***> >

[jaqx0r]

Now I think I understand what you're doing. nsscache isn't for PAM and so isn't your solution here. The user database is cached locally to speed up and improve availability of nss lookups. It doesn't make authentication work offline. You'll need an alternative design to also allow offline logins.

…

On Fri, 28 Oct 2022, 09:45 Jamie Wilkinson, ***@***.***> wrote: Oh, I just realised you're looking at the nss config but not pam. Check out your /etc/pam.d and change how the LDAP module is configured. On Fri, 28 Oct 2022, 09:43 Jamie Wilkinson, ***@***.***> wrote: > This is a pam issue, not a nsscache issue. The log line indicates to me > that pam requires an answer from LDAP, if I recall correctly you need to > mark that source with "sufficient" or remove it entirely and rely only on > db and cache. > > On Fri, 28 Oct 2022, 03:56 William Mantly, ***@***.***> > wrote: > >> Yes. When I try to login offline, this appears in the logs: >> >> Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server >> Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: reconnecting to LDAP server... >> Oct 27 11:13:09 i7-william-alder su[8858]: pam_ldap: ldap_simple_bind Can't contact LDAP server >> >> nsswitch.conf >> >> passwd: files systemd cache >> group: files systemd cache >> shadow: files >> gshadow: files >> >> hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname >> networks: files >> >> protocols: db files >> services: db files >> ethers: db files >> rpc: db files >> >> >> nsscache.conf >> >> >> [DEFAULT] >> >> # Default NSS data source module name >> source = ldap >> >> # Default NSS data cache module name; 'files' is compatible with the >> # libnss-cache NSS module. 'nssdb' is deprecated, and should not be used for >> # new installations. >> cache = files >> >> # NSS maps to be cached >> maps = passwd, group, shadow >> >> # Directory to store our update/modify timestamps >> timestamp_dir = /var/lib/nsscache >> >> # Lockfile to use for update/repair operations >> #lockfile = /var/run/nsscache >> >> # Defaults for specific modules; prefaced with "modulename_" >> >> ## >> # ldap module defaults. >> # >> >> # Enable to connect to Active Directory. If enabled (set to 1), >> # default Active Directory attributes will be used for mapping. >> # Leave disabled if connecting to openldap. >> #ldap_ad = 0 >> >> # LDAP URI to query for NSS data >> ldap_uri = ldap://10.1.0.55 >> >> # Base for LDAP searches >> ldap_base = dc=theta42,dc=com >> >> # Default LDAP search filter for maps >> ldap_filter = (objectclass=posixAccount) >> >> # Default LDAP search scope >> #ldap_scope = one >> >> # Default LDAP BIND DN, empty string is an anonymous bind >> ldap_bind_dn = "cn=ldapclient service,ou=People,dc=theta42,dc=com" >> >> # Default LDAP password, empty DN and empty password is used for >> # anonymous binds >> ldap_bind_password = "*******" >> >> ldap_tls_require_cert = 'never' >> >> # files module defaults >> >> # Directory to store the plain text files >> files_dir = /etc >> >> # Suffix used on the files module database files >> files_cache_filename_suffix = cache >> >> [passwd] >> ldap_base = ou=people,dc=theta42,dc=com >> >> [group] >> >> ldap_base = ou=groups,dc=theta42,dc=com >> ldap_filter = (objectclass=posixGroup) >> >> [shadow] >> >> ldap_filter = (objectclass=posixAccount) >> >> — >> Reply to this email directly, view it on GitHub >> <#166 (comment)>, >> or unsubscribe >> <https://github.com/notifications/unsubscribe-auth/AAXFX64Q7WGWZH4EWK3H76LWFKX5DANCNFSM6AAAAAARPXXJYQ> >> . >> You are receiving this because you commented.Message ID: >> ***@***.***> >> >

[wmantly]

oh, i see, Thank you for the help.