touch-packages team mailing list archive

[Ryan Tandy <1386194@xxxxxxxxxxxxxxxxxx>]

Hi,

Thank you for reporting this and helping to make Ubuntu better.

Peter Fodrek wrote:
> cat /etc/ldap.conf

This is the configuration file for libnss-ldap, which is not part of
OpenLDAP. If you need assistance with configuring libnss-ldap or libpam-
ldap, I suggest contacting the support channels for that software, or
asking on answers.ubuntu.com. You might also wish to try libnss-ldapd
/libpam-ldapd and see whether they have the same problem.

If you are experiencing a bug in OpenLDAP, please try to provide more
evidence of such; or if you are experiencing a bug (and are certain it's
a bug, not a misconfiguration) in libnss-ldap, please reassign this to
the appropriate package.

Thanks!

** Changed in: openldap (Ubuntu)
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openldap in Ubuntu.
https://bugs.launchpad.net/bugs/1386194

Title:
  openLDAP creates persistent connections into universisty LDAP- this is
  unwanted by university administrators

Status in “openldap” package in Ubuntu:
  Incomplete

Bug description:
  openLDAP creates persistent connections into universisty LDAP- this is
  unwanted by university administrators.

  
  I have ldap.conf

  
  cat /etc/ldap.conf
  ###DEBCONF###
  ##
  ## Configuration of this file will be managed by debconf as long as the
  ## first line of the file says '###DEBCONF###'
  ##
  ## You should use dpkg-reconfigure to configure this file via debconf
  ##

  #
  # @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $
  #
  # This is the configuration file for the LDAP nameservice
  # switch library and the LDAP PAM module.
  #
  # PADL Software
  # http://www.padl.com
  #

  # Your LDAP server. Must be resolvable without using LDAP.
  # Multiple \hosts may be specified, each separated by a 
  # space. How long nss_ldap takes to failover depends on
  # whether your LDAP client library supports configurable
  # network or connect timeouts (see bind_timelimit).
  #host 127.0.0.1
  #host ldap.stuba.sk ldap2.stuba.sk
  host ldap.stuba.sk 

  
  # The distinguished name of the search base.
  base ou=People,dc=stuba,dc=sk
  pam_template_login_attribute uid

  # Another way to specify your LDAP server is to provide an
  #uri ldapi://ldap.stuba.sk ldapi://ldap2.stuba.sk
  #uri ldaps://ldap.stuba.sk ldaps://ldap2.stuba.sk

  #TLS_REQCERT allow
  # Unix Domain Sockets to connect to a local LDAP Server.
  #uri ldap://127.0.0.1/
  #uri ldaps://127.0.0.1/   
  #uri ldapi://%2fvar%2frun%2fldapi_sock/
  # Note: %2f encodes the '/' used as directory separator

  # The LDAP version to use (defaults to 3
  # if supported by client library)
  ldap_version 3

  REFERRALS off
  TIMEOUT 60
  NETWORK_TIMEOUT 60
  TIMELIMIT 60


  
  refferrals off
  timeout 60
  network_timeout 60
  timelimit 60
  persistent-search off

  # The distinguished name to bind to the server with.
  # Optional: default is to bind anonymously.
  #binddn uid=fodrek,ou=People,dc=stuba,dc=sk

  # The credentials to bind with. 
  # Optional: default is no credential.
  #bindpw secret

  # The distinguished name to bind to the server with
  # if the effective user ID is root. Password is
  # stored in /etc/ldap.secret (mode 600)
  #rootbinddn cn=manager,dc=padl,dc=com

  # The port.
  # Optional: default is 389.
  #port 389

  # The search scope.
  #scope sub
  #scope one
  scope base

  # Search timelimit
  timelimit 1

  # Bind/connect timelimit
  bind_timelimit 12

  
  # Reconnect policy: hard (default) will retry connecting to
  # the software with exponential backoff, soft will fail
  # immediately.
  #bind_policy hard

  bind_policy soft

  # Idle timelimit; client will close connections
  # (nss_ldap only) if the server has not been contacted
  # for the number of seconds specified below.
  #idle_timelimit 3600

  idle_timelimit 60
  debug 99

  # Filter to AND with uid=%s
  #pam_filter objectclass=account
  #pam_filter objectclass=posixAccount

  # The user ID attribute (defaults to uid)
  pam_login_attribute uid

  # Search the root DSE for the password policy (works
  # with Netscape Directory Server)
  #pam_lookup_policy yes

  # Check the 'host' attribute for access control
  # Default is no; if set to yes, and user has no
  # value for the host attribute, and pam_ldap is
  # configured for account management (authorization)
  # then the user will not be allowed to login.
  pam_check_host_attr no

  # Check the 'authorizedService' attribute for access
  # control
  # Default is no; if set to yes, and the user has no
  # value for the authorizedService attribute, and
  # pam_ldap is configured for account management
  # (authorization) then the user will not be allowed
  # to login.
  #pam_check_service_attr yes

  # Group to enforce membership of
  #pam_groupdn ou=People,dc=stuba,dc=sk

  # Group member attribute
  #pam_member_attribute uniquemember
  #pam_member_attribute uid

  # Specify a minium or maximum UID number allowed
  #pam_min_uid 0
  #pam_max_uid 0

  # Template login attribute, default template user
  # (can be overriden by value of former attribute
  # in user's entry)
  #pam_login_attribute userPrincipalName
  #pam_template_login_attribute uid
  #pam_template_login nobody

  # HEADS UP: the pam_crypt, pam_nds_passwd,
  # and pam_ad_passwd options are no
  # longer supported.
  #
  # Do not hash the password at all; presume
  # the directory server will do it, if
  # necessary. This is the default.
  pam_password md5

  # Hash password locally; required for University of
  # Michigan LDAP server, and works with Netscape
  # Directory Server if you're using the UNIX-Crypt
  # hash mechanism and not using the NT Synchronization
  # service. 
  #pam_password crypt

  # Remove old password first, then update in
  # cleartext. Necessary for use with Novell
  # Directory Services (NDS)
  #pam_password clear_remove_old
  #pam_password nds

  # RACF is an alias for the above. For use with
  # IBM RACF
  #pam_password racf

  # Update Active Directory password, by
  # creating Unicode password and updating
  # unicodePwd attribute.
  #pam_password ad

  # Use the OpenLDAP password change
  # extended operation to update the password.
  #pam_password exop

  # Redirect users to a URL or somesuch on password
  # changes.
  #pam_password_prohibit_message Please visit http://internal to change your password.

  # RFC2307bis naming contexts
  # Syntax:
  # nss_base_XXX		base?scope?filter
  # where scope is {base,one,sub}
  # and filter is a filter to be &'d with the
  # default filter.
  # You can omit the suffix eg:
  #nss_base_passwd	ou=People, 
  # to append the default base DN but this
  # may incur a small performance impact.
  nss_base_passwd		ou=People,dc=stuba,dc=sk?one
  #nss_base_shadow		ou=People,dc=stuba,dc=sk?one
  #nss_base_group		ou=People,dc=stuba,dc=sk?one
  #nss_base_hosts		ou=Hosts,dc=padl,dc=com?one
  #nss_base_services	ou=Services,dc=padl,dc=com?one
  #nss_base_networks	ou=Networks,dc=padl,dc=com?one
  #nss_base_protocols	ou=Protocols,dc=padl,dc=com?one
  #nss_base_rpc		ou=Rpc,dc=padl,dc=com?one
  #nss_base_ethers	ou=Ethers,dc=padl,dc=com?one
  #nss_base_netmasks	ou=Networks,dc=padl,dc=com?ne
  #nss_base_bootparams	ou=Ethers,dc=padl,dc=com?one
  #nss_base_aliases	ou=Aliases,dc=padl,dc=com?one
  #nss_base_netgroup	ou=Netgroup,dc=padl,dc=com?one

  # attribute/objectclass mapping
  # Syntax:
  #nss_map_attribute	rfc2307attribute	mapped_attribute
  #nss_map_objectclass	rfc2307objectclass	mapped_objectclass

  # configure --enable-nds is no longer supported.
  # NDS mappings
  #nss_map_attribute uniqueMember member

  # Services for UNIX 3.5 mappings
  #nss_map_objectclass posixAccount User
  nss_map_objectclass shadowAccount User
  #nss_map_attribute uid msSFU30Name
  #nss_map_attribute uniqueMember msSFU30PosixMember
  #nss_map_attribute userPassword msSFU30Password
  #nss_map_attribute homeDirectory msSFU30HomeDirectory
  #nss_map_attribute homeDirectory msSFUHomeDirectory
  #nss_map_objectclass posixGroup Group
  #pam_login_attribute msSFU30Name
  #pam_filter objectclass=User
  #pam_password ad

  # configure --enable-mssfu-schema is no longer supported.
  # Services for UNIX 2.0 mappings
  #nss_map_objectclass posixAccount User
  #nss_map_objectclass shadowAccount user
  #nss_map_attribute uid msSFUName
  #nss_map_attribute uniqueMember posixMember
  #nss_map_attribute userPassword msSFUPassword
  #nss_map_attribute homeDirectory msSFUHomeDirectory
  #nss_map_attribute shadowLastChange pwdLastSet
  #nss_map_objectclass posixGroup Group
  #nss_map_attribute cn msSFUName
  #pam_login_attribute msSFUName
  #pam_filter objectclass=User
  #pam_password ad

  # RFC 2307 (AD) mappings
  #nss_map_objectclass posixAccount user
  #nss_map_objectclass shadowAccount user
  #nss_map_attribute uid sAMAccountName
  #nss_map_attribute homeDirectory unixHomeDirectory
  #nss_map_attribute shadowLastChange pwdLastSet
  #nss_map_objectclass posixGroup group
  #nss_map_attribute uniqueMember member
  #pam_login_attribute sAMAccountName
  #pam_filter objectclass=User
  #pam_password ad

  # configure --enable-authpassword is no longer supported
  # AuthPassword mappings
  #nss_map_attribute userPassword authPassword

  # AIX SecureWay mappings
  #nss_map_objectclass posixAccount aixAccount
  #nss_base_passwd ou=aixaccount,?one
  #nss_map_attribute uid userName
  #nss_map_attribute gidNumber gid
  #nss_map_attribute uidNumber uid
  #nss_map_attribute userPassword passwordChar
  #nss_map_objectclass posixGroup aixAccessGroup
  #nss_base_group ou=aixgroup,?one
  #nss_map_attribute cn groupName
  #nss_map_attribute uniqueMember member
  #pam_login_attribute userName
  #pam_filter objectclass=aixAccount
  #pam_password clear

  # Netscape SDK LDAPS
  ssl on

  # Netscape SDK SSL options
  sslpath /etc/ssl/certs

  # OpenLDAP SSL mechanism
  # start_tls mechanism uses the normal LDAP port, LDAPS typically 636
  #ssl start_tls
  #ssl on
  #port=636

  # OpenLDAP SSL options
  # Require and verify server certificate (yes/no)
  # Default is to use libldap's default behavior, which can be configured in
  # /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for
  # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
  #tls_checkpeer yes
  tls_checkpeer no

  # CA certificates for server certificate verification
  # At least one of these are required if tls_checkpeer is "yes"
  #tls_cacertfile /etc/ssl/certs/stu_ca.cert
  #tls_cacertdir /etc/ssl/certs

  # Seed the PRNG if /dev/urandom is not provided
  #tls_randfile /var/run/egd-pool

  # SSL cipher suite
  # See man ciphers for syntax
  #tls_ciphers TLSv1

  # Client certificate and key
  # Use these, if your server requires client authentication.
  #tls_cert
  #tls_key

  # Disable SASL security layers. This is needed for AD.
  #sasl_secprops maxssf=0

  # Override the default Kerberos ticket cache location.
  #krb5_ccname FILE:/etc/.ldapcache

  # SASL mechanism for PAM authentication - use is experimental
  # at present and does not support password policy control
  #pam_sasl_mech DIGEST-MD5
  #nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dhcpd,dirmngr,dnsmasq,games,gdm,gnats,hplip,irc,jetty,kdm,kernoops,libuuid,lightdm,list,login,lp,mail,man,messagebus,news,nslcd,ntp,openldap,postfix,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,tftp,usbmux,uucp,whoopsie,www-data
  #nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dhcpd,dirmngr,dnsmasq,games,gdm,gnats,hplip,irc,jetty,kdm,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,nslcd,ntp,openldap,postfix,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,tftp,usbmux,uucp,whoopsie,www-data
  nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,debian-spamd,dhcpd,dirmngr,dnsmasq,games,gdm,gnats,hplip,irc,jetty,kdm,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,nslcd,ntp,openldap,postfix,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,tftp,usbmux,uucp,uuidd,whoopsie,www-data

  
  and 

  cat /etc/pam.d/login
  #
  # The PAM configuration file for the Shadow `login' service
  #

  # Enforce a minimal delay in case of failure (in microseconds).
  # (Replaces the `FAIL_DELAY' setting from login.defs)
  # Note that other modules may require another minimal delay. (for example,
  # to disable any delay, you should add the nodelay option to pam_unix)
  auth       optional   pam_faildelay.so  delay=3000000

  # Outputs an issue file prior to each login prompt (Replaces the
  # ISSUE_FILE option from login.defs). Uncomment for use
  # auth       required   pam_issue.so issue=/etc/issue

  # Disallows root logins except on tty's listed in /etc/securetty
  # (Replaces the `CONSOLE' setting from login.defs)
  #
  # With the default control of this module:
  #   [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die]
  # root will not be prompted for a password on insecure lines.
  # if an invalid username is entered, a password is prompted (but login
  # will eventually be rejected)
  #
  # You can change it to a "requisite" module if you think root may mis-type
  # her login and should not be prompted for a password in that case. But
  # this will leave the system as vulnerable to user enumeration attacks.
  #
  # You can change it to a "required" module if you think it permits to
  # guess valid user names of your system (invalid user names are considered
  # as possibly being root on insecure lines), but root passwords may be
  # communicated over insecure lines.
  auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so

  # Disallows other than root logins when /etc/nologin exists
  # (Replaces the `NOLOGINS_FILE' option from login.defs)
  auth       requisite  pam_nologin.so

  # SELinux needs to be the first session rule. This ensures that any 
  # lingering context has been cleared. Without out this it is possible 
  # that a module could execute code in the wrong domain.
  # When the module is present, "required" would be sufficient (When SELinux
  # is disabled, this returns success.)
  session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

  # This module parses environment configuration file(s)
  # and also allows you to use an extended config
  # file /etc/security/pam_env.conf.
  # 
  # parsing /etc/environment needs "readenv=1"
  session       required   pam_env.so readenv=1
  # locale variables are also kept into /etc/default/locale in etch
  # reading this file *in addition to /etc/environment* does not hurt
  session       required   pam_env.so readenv=1 envfile=/etc/default/locale

  # Standard Un*x authentication.
  @include common-auth

  # This allows certain extra groups to be granted to a user
  # based on things like time of day, tty, service, and user.
  # Please edit /etc/security/group.conf to fit your needs
  # (Replaces the `CONSOLE_GROUPS' option in login.defs)
  auth       optional   pam_group.so

  # Uncomment and edit /etc/security/time.conf if you need to set
  # time restrainst on logins.
  # (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
  # as well as /etc/porttime)
  # account    requisite  pam_time.so

  # Uncomment and edit /etc/security/access.conf if you need to
  # set access limits.
  # (Replaces /etc/login.access file)
  # account  required       pam_access.so

  # Sets up user limits according to /etc/security/limits.conf
  # (Replaces the use of /etc/limits in old login)
  #session    required   pam_limits.so

  # Prints the last login info upon succesful login
  # (Replaces the `LASTLOG_ENAB' option from login.defs)
  session    optional   pam_lastlog.so

  # Prints the message of the day upon succesful login.
  # (Replaces the `MOTD_FILE' option in login.defs)
  # This includes a dynamically generated part from /run/motd.dynamic
  # and a static (admin-editable) part from /etc/motd.
  session    optional   pam_motd.so  motd=/run/motd.dynamic noupdate
  session    optional   pam_motd.so

  # Prints the status of the user's mailbox upon succesful login
  # (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
  #
  # This also defines the MAIL environment variable
  # However, userdel also needs MAIL_DIR and MAIL_FILE variables
  # in /etc/login.defs to make sure that removing a user 
  # also removes the user's mail spool file.
  # See comments in /etc/login.defs
  session    optional   pam_mail.so standard

  auth sufficient 	pam_ldap.so  use_first_pass
  #account sufficient 	pam_ldap.so
  #password required 	pam_ldap.so

  #password  sufficient	pam_ldap.so
  # Standard Un*x account and session
  @include common-account
  @include common-session
  @include common-password

  # SELinux needs to intervene at login time to ensure that the process
  # starts in the proper default security context. Only sessions which are
  # intended to run in the user's context should be run after this.
  session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
  # When the module is present, "required" would be sufficient (When SELinux
  # is disabled, this returns success.)

  
  #account	[success=ok new_authtok_reqd=done ignore=ignore user_unknown=ignore authinfo_unavail=ignore default=bad]	pam_ldap.so 
  password	[success=1 default=ignore]	pam_ldap.so try_first_pass
  #auth	[success=1 default=ignore]	pam_ldap.so use_first_pass
  #session	[success=ok default=ignore]	pam_ldap.so

  account         sufficient                      pam_permit.so

  
  cat /etc/pam.d/common-account
  #
  # /etc/pam.d/common-account - authorization settings common to all services
  #
  # This file is included from other service-specific PAM config files,
  # and should contain a list of the authorization modules that define
  # the central access policy for use on the system.  The default is to
  # only deny service to users whose accounts are expired in /etc/shadow.
  #
  # As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
  # To take advantage of this, it is recommended that you configure any
  # local modules either before or after the default block, and use
  # pam-auth-update to manage selection of other modules.  See
  # pam-auth-update(8) for details.
  #

  # here are the per-package modules (the "Primary" block)
  account	[success=2 new_authtok_reqd=done default=ignore]	pam_unix.so 
  account	[success=1 default=ignore]	pam_ldap.so 
  # here's the fallback if no module succeeds
  #account	requisite			pam_deny.so
  # prime the stack with a positive return value if there isn't one already;
  # this avoids us returning an error just because nothing sets a success code
  # since the modules above will each just jump around
  account	required			pam_permit.so
  # and here are more per-package modules (the "Additional" block)
  account	sufficient			pam_localuser.so 
  #account	[default=bad success=ok user_unknown=ignore]	pam_sss.so 
  # end of pam-auth-update config



   cat /etc/pam.d/common-session
  #
  # /etc/pam.d/common-session - session-related modules common to all services
  #
  # This file is included from other service-specific PAM config files,
  # and should contain a list of modules that define tasks to be performed
  # at the start and end of sessions of *any* kind (both interactive and
  # non-interactive).
  #
  # As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
  # To take advantage of this, it is recommended that you configure any
  # local modules either before or after the default block, and use
  # pam-auth-update to manage selection of other modules.  See
  # pam-auth-update(8) for details.

  # here are the per-package modules (the "Primary" block)
  session	[default=1]			pam_permit.so
  # here's the fallback if no module succeeds
  #session	requisite			pam_deny.so
  # prime the stack with a positive return value if there isn't one already;
  # this avoids us returning an error just because nothing sets a success code
  # since the modules above will each just jump around
  #session	required			pam_permit.so
  # The pam_umask module will set the umask according to the system default in
  # /etc/login.defs and user settings, solving the problem of different
  # umask settings with different shells, display managers, remote sessions etc.
  # See "man pam_umask".
  session optional			pam_umask.so
  # and here are more per-package modules (the "Additional" block)
  session	required                        pam_mkhomedir.so umask=0022 skel=/etc/skel
  session	required	pam_unix.so 
  #session	optional			pam_sss.so 
  #session	optional			pam_ldap.so 
  session	optional	pam_systemd.so 
  session	optional	pam_ecryptfs.so unwrap
  session	optional			pam_ck_connector.so nox11
  # end of pam-auth-update config


  cat /etc/pam.d/common-password
  #
  # /etc/pam.d/common-password - password-related modules common to all services
  #
  # This file is included from other service-specific PAM config files,
  # and should contain a list of modules that define the services to be
  # used to change user passwords.  The default is pam_unix.

  # Explanation of pam_unix options:
  #
  # The "sha512" option enables salted SHA512 passwords.  Without this option,
  # the default is Unix crypt.  Prior releases used the option "md5".
  #
  # The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
  # login.defs.
  #
  # See the pam_unix manpage for other options.

  # As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
  # To take advantage of this, it is recommended that you configure any
  # local modules either before or after the default block, and use
  # pam-auth-update to manage selection of other modules.  See
  # pam-auth-update(8) for details.

  # here are the per-package modules (the "Primary" block)
  password	requisite			pam_pwquality.so retry=3
  password	[success=3 default=ignore]	pam_unix.so obscure use_authtok try_first_pass sha512
  #password	sufficient			pam_sss.so use_authtok
  #password	[success=1 user_unknown=ignore default=die]	pam_ldap.so use_authtok try_first_pass
  # here's the fallback if no module succeeds
  #password	requisite			pam_deny.so
  # prime the stack with a positive return value if there isn't one already;
  # this avoids us returning an error just because nothing sets a success code
  # since the modules above will each just jump around
  #password	required			pam_permit.so
  # and here are more per-package modules (the "Additional" block)
  password	optional	pam_gnome_keyring.so 
  password	optional	pam_ecryptfs.so 
  # end of pam-auth-update config


  
  Myabe it is may fault to cause unwanted behaviour

  
  I look forward hearing form you

  Yours faithfully

  
  Peter Fodrek

  ProblemType: Bug
  DistroRelease: Ubuntu 14.10
  Package: ldap-utils 2.4.31-1+nmu2ubuntu11
  ProcVersionSignature: Ubuntu 3.16.0-23.31-generic 3.16.4
  Uname: Linux 3.16.0-23-generic x86_64
  ApportVersion: 2.14.7-0ubuntu8
  Architecture: amd64
  CurrentDesktop: Unity
  Date: Mon Oct 27 15:14:23 2014
  InstallationDate: Installed on 2014-09-10 (47 days ago)
  InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140722.2)
  SourcePackage: openldap
  SystemImageInfo:
   current build number: 0
   device name: ?
   channel: daily
   last update: Unknown
  UpgradeStatus: Upgraded to utopic on 2014-10-24 (2 days ago)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1386194/+subscriptions