1

I have a server where I am running nslcd to query an AD server, and use it for authorization, and this is working as expected. Now, I introduced nscd to reduce the load on the AD servers. The results are a bit weird. If I am running the nscd process normally (as nscd user or even root user), the daemon doesn't return any result.

[root@ldap-auth-test ~]# id testuser1
id: testuser: No such user

Now, to see why it is not working, I tried to strace the process.

strace -p 8327 -f -s 1000

and simultaneously, I did an id on testuser1 again. This time,

[root@ldap-auth-test ~]# id testuser1
uid=10004(testuser1) gid=10046(A-TESTGROUP1) groups=10046(A-TESTGROUP1) context=root:system_r:unconfined_t:SystemLow-SystemHigh

I tried multiple times to see if this is a coincidence, and observed that it is not. I tried not to attach to the threads, and could see that nscd is not working when I am not attaching to the threads. Any help is greatly appreciated. 

[root@ldap-auth-test ~]# lsb_release -a
LSB Version:    :core-3.1-amd64:core-3.1-ia32:core-3.1-noarch:graphics-3.1-amd64:graphics-3.1-ia32:graphics-3.1-noarch
Distributor ID: CentOS
Description:    CentOS release 5.5 (Final)
Release:    5.5
Codename:   Final

PS: I have asked the same on Stackoverflow as well, since I am not sure where to ask. I will delete the irrelevant one if someone can point out which one is.

EDIT:: Running nslcd in debug mode showed that, unless stracing on nscd, the daemon doesn't even use the nslcd to query. In short, a query is not fired at all unless using strace.

Community
  • 1
nohup
  • 113
  • 5
  • Interesting observation. I would perhaps try stopping nscd, and removing the cache files (you'll find them somewhere like `rm /var/db/nscd/*` then start it again). I would further suggest that if you upgrade from 5.5, then you'll be able to use sssd, which is better for this task. Are you aware that nscd ignores TTL on DNS and resets it 3600 for everything? You can also check /etc/nscd.conf and enable further logging. – Cameron Kerr Oct 05 '15 at 13:03
  • SELinux perhaps -- nslcd_selinux(8) -- that would help explain a difference in behaviour when running under strace (as would a process that was expecting to be setuid) – Cameron Kerr Oct 05 '15 at 13:10
  • Yes, I am aware of that @CameronKerr. I am not using it for dns caching. Hosts caching is done with dnsmasq. And Thank You. SELinux was the culprit. If you could update the same as the answer, I shall gladly accept it. – nohup Oct 05 '15 at 13:28

1 Answers1

3

SELinux perhaps -- nslcd_selinux(8) -- that would help explain a difference in behaviour when running under strace (as would a process that was expecting to be setuid)

Cameron Kerr
  • 4,069
  • 19
  • 25