topic Re: Passwd hangs when using Winbind in Operating System - HP-UX

Passwd hangs when using Winbind

UxBoD — Mon, 22 Dec 2008 13:52:34 GMT

Hi,

I have setup AD authentication which is working fine but have a odd problem. If I add winbind to /etc/nsswitch.conf for passwd and group when a *Unix* user issues the passwd command it just hangs. I have tried adding [NOTFOUND=continue] so when the Unix user matches /etc/passwd it should not then check winbind.

Any ideas on how to fix this please ?

Re: Passwd hangs when using Winbind

UxBoD — Mon, 22 Dec 2008 16:30:39 GMT

Sorry should add this is on HP-UX 11.23.

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 10:10:30 GMT

After 10 minutes the password is verified. I have connected to the process using tusc and can see it enumerating through the whole of our Active Directory. Help !

Re: Passwd hangs when using Winbind

Steven E. Protter — Tue, 23 Dec 2008 10:14:32 GMT

Shalom,

This processing delay is probably on the server side of the winbind. I'd check the domain controller for events, delays and error messages.

I'd like to see the relevant line in /etc/nsswitch.conf to provide further advice.

If winbind is first, it should not be. That would lend evidence to my processing delay theory.

Also, the 11.23 system should be patched with a recent bi-annual patch set.

SEP

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 10:35:57 GMT

#
# /etc/nsswitch.files:
#
# @(#)B11.23_LR
#
# An example file that could be copied over to /etc/nsswitch.conf; it
# does not use any name services.
#
passwd: files winbind
group: files winbind
hosts: files [NOTFOUND=CONTINUE UNAVAIL=CONTINUE] dns

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 12:28:18 GMT

SEP,

I have tested this on a fully patched 11.23 system aswell and experience exactly the same symptoms :(

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 12:30:18 GMT

With respect to processing on the server side we have a very large AD installation with ~10k users so winbind is enumerating through all of them which gives the illusion passwd has hung. As soon as I remove winbind from nsswitch.conf everything returns back to normal, apart from Samba no longer working for AD authentication.

Re: Passwd hangs when using Winbind

Dennis Handly — Tue, 23 Dec 2008 13:03:20 GMT

>so winbind is enumerating through all of them which gives the illusion passwd has hung.

Is this every time or just once?
If every time, haven't they heard of hashing or a binary search?

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 13:04:38 GMT

This is every time :( And our users have just hit the password expiry date :( :(

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 13:17:25 GMT

I have increased the winbind cache time to 43200 (12 hours), then run the passwd command and watched the cache file grow. Once it asked me to enter the password again, I [CTRL-C] and then ran it again. Still the same, 10 minutes before the prompt comes back to enter password again :(

Re: Passwd hangs when using Winbind

UxBoD — Tue, 23 Dec 2008 14:56:24 GMT

Setting :-

winbind enum users = No
winbind enum groups = No

in /etc/opt/samba/smb.conf resolved the issue. Still no not know why winbind is checked if the entry is found in /etc/passwd according to how nsswitch.conf should work. Ho hum it works so I have happy users again.