Passwd hangs when using Winbind

[UxBoD]

Hi,

I have setup AD authentication which is working fine but have a odd problem. If I add winbind to /etc/nsswitch.conf for passwd and group when a *Unix* user issues the passwd command it just hangs. I have tried adding [NOTFOUND=continue] so when the Unix user matches /etc/passwd it should not then check winbind.

Any ideas on how to fix this please ?

[UxBoD]

Sorry should add this is on HP-UX 11.23.

[UxBoD]

After 10 minutes the password is verified. I have connected to the process using tusc and can see it enumerating through the whole of our Active Directory. Help !

[Steven E. Protter]

Shalom,

This processing delay is probably on the server side of the winbind. I'd check the domain controller for events, delays and error messages.

I'd like to see the relevant line in /etc/nsswitch.conf to provide further advice.

If winbind is first, it should not be. That would lend evidence to my processing delay theory.

Also, the 11.23 system should be patched with a recent bi-annual patch set.

SEP

[UxBoD]

#
# /etc/nsswitch.files:
#
# @(#)B11.23_LR
#
# An example file that could be copied over to /etc/nsswitch.conf; it
# does not use any name services.
#
passwd: files winbind
group: files winbind
hosts: files [NOTFOUND=CONTINUE UNAVAIL=CONTINUE] dns

[UxBoD]

SEP,

I have tested this on a fully patched 11.23 system aswell and experience exactly the same symptoms :(

[UxBoD]

With respect to processing on the server side we have a very large AD installation with ~10k users so winbind is enumerating through all of them which gives the illusion passwd has hung. As soon as I remove winbind from nsswitch.conf everything returns back to normal, apart from Samba no longer working for AD authentication.

[Dennis Handly]

>so winbind is enumerating through all of them which gives the illusion passwd has hung.

Is this every time or just once?
If every time, haven't they heard of hashing or a binary search?

[UxBoD]

This is every time :( And our users have just hit the password expiry date :( :(

[UxBoD]

I have increased the winbind cache time to 43200 (12 hours), then run the passwd command and watched the cache file grow. Once it asked me to enter the password again, I [CTRL-C] and then ran it again. Still the same, 10 minutes before the prompt comes back to enter password again :(