Unable to authenticate locally when LDAP servers down

[Ryan Gro]

Hey,

So I have my hpux server configured to authenticate to 2 redundant ldap servers. That all works just fine, except when both ldap servers are shutdown I'm unable to login at all (even with local accounts) anymore.

My pam.conf file looks like this:

#
# Authentication management
#
login auth sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
login auth required /usr/lib/security/$ISA/libpam_unix.so.1 use_first_pass
su auth sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
su auth required /usr/lib/security/$ISA/libpam_unix.so.1 use_first_pass
dtlogin auth sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
dtlogin auth required /usr/lib/security/$ISA/libpam_unix.so.1 use_first_pass
dtaction auth sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
dtaction auth required /usr/lib/security/$ISA/libpam_unix.so.1 use_first_pass
ftp auth sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
ftp auth required /usr/lib/security/$ISA/libpam_unix.so.1 use_first_pass
OTHER auth sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
OTHER auth required /usr/lib/security/$ISA/libpam_unix.so.1 use_first_pass

#
# Account management
#
login account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
login account required /usr/lib/security/$ISA/libpam_unix.so.1
su account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
su account required /usr/lib/security/$ISA/libpam_unix.so.1
dtlogin account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
dtlogin account required /usr/lib/security/$ISA/libpam_unix.so.1
dtaction account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
dtaction account required /usr/lib/security/$ISA/libpam_unix.so.1
ftp account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
ftp account required /usr/lib/security/$ISA/libpam_unix.so.1
sshd account required /usr/lib/security/$ISA/libpam_authz.so.1
sshd account required /usr/lib/security/$ISA/libpam_unix.so.1
#sshd account sufficient /usr/lib/security/$ISA/libpam_unix.so.1
#sshd account required /usr/lib/security/$ISA/libpam_krb5.so.1
sshd account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
OTHER account sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
OTHER account required /usr/lib/security/$ISA/libpam_unix.so.1
#
# Session management
#
login session required /usr/lib/security/$ISA/libpam_krb5.so.1
#login session required /usr/lib/security/pam_mkhomedir.so
login session required /usr/lib/security/$ISA/libpam_unix.so.1
dtlogin session required /usr/lib/security/$ISA/libpam_krb5.so.1
dtlogin session required /usr/lib/security/$ISA/libpam_unix.so.1
dtaction session required /usr/lib/security/$ISA/libpam_krb5.so.1
dtaction session required /usr/lib/security/$ISA/libpam_unix.so.1
#OTHER session required /usr/lib/security/pam_mkhomedir.so
OTHER session required /usr/lib/security/$ISA/libpam_krb5.so.1
OTHER session required /usr/lib/security/$ISA/libpam_unix.so.1
#
# Password management
#
login password sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
login password required /usr/lib/security/$ISA/libpam_unix.so.1 try_first_pass
passwd password sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
passwd password required /usr/lib/security/$ISA/libpam_unix.so.1 try_first_pass
dtlogin password sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
dtlogin password required /usr/lib/security/$ISA/libpam_unix.so.1 try_first_pass
dtaction password sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
dtaction password required /usr/lib/security/$ISA/libpam_unix.so.1 try_first_pass
OTHER password sufficient /usr/lib/security/$ISA/libpam_krb5.so.1
OTHER password required /usr/lib/security/$ISA/libpam_unix.so.1 try_first_pass
OTHER password required /usr/lib/security/$ISA/pam_sso.hp.1
Can anyone give some insight as to why?

syslog error is pretty generic:
Jun 2 15:08:18 hpserver sshd[5762]: fatal: Timeout before authentication for 10.99.115.86

Thanks for the help, if you need more info (I'm sure you will) let me know.
Ryan

[Jeeshan]

Hi Ryan

Post your nsswitch.conf file content.

[Ryan Gro]

Sure here it is:

passwd: files ldap [NOTFOUND=return]
shadow: files ldap [NOTFOUND=return]
group: files ldap [NOTFOUND=return]

hosts: files dns

bootparams: files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files
publickey: files
automount: files
aliases: files


I tried removing this file while the servers were down to see if it would work, but it still didn't.

[Ryan Gro]

Oops that was the wrong file sorry.

Here's the correct one:

passwd: files ldap [TRYAGAIN=continue]
group: files ldap [TRYAGAIN=continue]
hosts: files dns
networks: files
protocols: files
rpc: files
publickey: files
netgroup: files
automount: files
aliases: files
services: files

[Ryan Gro]

Nobody knows anything about this?

[Doug Lamoureux_2]

It could be related to pam_authz being required:

sshd account required /usr/lib/security/$ISA/libpam_authz.so.1
sshd account required /usr/lib/security/$ISA/libpam_unix.so.1
#sshd account sufficient /usr/lib/security/$ISA/libpam_unix.so.1
#sshd account required /usr/lib/security/$ISA/libpam_krb5.so.1

Is pam_authz configured with LDAP entries? Turn on PAM debugging for sshd and you should get more details as to what is failing.

Cheers,
Doug