LDAP-UX strange behaviour

[support_5]

Hi all,

An update of where I am at:

I have RedHat directory server 7.1 installed on a HP-UX 11.11 server (called server1)(which is not trusted systems). I created a profile on the ldap server and configured ldapux. I have run the migration scripts on that host and imported the resulting ldif files into the directory server using "ldapmodify". I setup /etc/nsswitch.conf and /etc/pam.conf. Then I removed the imported entries from /etc/passwd (NB I didn't import important system users or grooups). What I found was that I was able to log into the system, and all my user files were fine. Even after a reboot, it worked fine.

I then removed the added entries so I had a fresh database again. I then did exactly what I had done above, except it was on an 11.23 server (which wasn't running trusted systems either) and the ldap server was still on 11.11.

What I found was that configuring ldapux was fine, it created the profile fine. I ran the migrations scripts and attempted to import the generated ldif files using ldapmodify, except this time I got the following error message:

[server2]:/etc # /opt/ldapux/bin/ldapmodify -a -c -e /tmp/rejects -f /tmp/server2_passwd.ldif -D uid=admin,ou=.....
ldap_simple_bind: Can't connect to the LDAP server - Connection refused

So I can't run ldapmodify on server2 (11.23) coz it can't connect to the ldap server. Why would that be? NB, I am using the "simple" option in the ldapux setup script.

Anyway, what I could do was copy the ldif files to server1 (11.11) and run the ldapmodify command there and that worked fine. So I now have an LDAP directory full of the user accounts that used to be on server2.

I checked and server2 can indeed read the ldap directory, because when I delete the users out of /etc/passwd, the files ownerships of those users still finds the correct username for that uid. Also, nsquery works when I run: nsquery passwd .telnet

However, I am unable to log in as a user on the system.

eg telnet says:
login: tmpusrac
Login incorrect
login:

And so it won't let me log in anymore.

By the way, I have setup nsswitch.conf correctly, and used the /etc/pam.ldap file and copied that over the top of /etc/pam.conf. I have done this on both server1 and server2. So they both should work, but only server1 does. Why is this? Remembering that server1 is also hosting the ldap server, but theoretically that shouldn't make any difference.

Can anyone tell me what's going on here, or any ideas?

Thanks all.

- Andy