☰

CentOS 5.8-NSCD 无法缓存密码

tag-icon • tag-icon linux openldap pam-ldap
CentOS 5.8-NSCD 无法缓存密码

我尝试配置 NSCD 以将 ldap 用户连接到我的电脑。

我喜欢用户可以在这台电脑上离线登录（在线 ldap 用户工作正常）。

实际上，我可以使用该用户，但是当我尝试输入密码时，PC 正在等待，最后它说密码不正确。

我认为，缓存密码是个问题，因为用户接受得非常快，如果我清理 nscd 缓存，则用户错了。

这是我的 nscd.conf

    logfile                 /var/log/nscd.log
    server-user             nscd
    debug-level             0
    paranoia                no
    restart-interval        3600

    enable-cache            passwd          yes
    positive-time-to-live   passwd          3600
    negative-time-to-live   passwd          20
    suggested-size          passwd          211
    check-files             passwd          yes
    persistent              passwd          yes
    shared                  passwd          yes
    max-db-size             passwd          33554432
    auto-propagate          passwd          yes

    enable-cache            group           yes
    positive-time-to-live   group           3600
    negative-time-to-live   group           60
    suggested-size          group           211
    check-files             group           yes
    persistent              group           yes
    shared                  group           yes
    max-db-size             group           33554432
    auto-propagate          group           yes

    enable-cache            hosts           no

我的 authconfig --test

    authconfig --test:

    caching is enabled
    nss_files is always enabled
    nss_compat is disabled
    nss_db is disabled
    nss_hesiod is disabled
    hesiod LHS = ""
    hesiod RHS = ""
    nss_ldap is enabled
    LDAP+TLS is disabled
    LDAP server = "ldap://xxxxxxxxxxxxxxxx"
    LDAP base DN = "dc=xxxxxxxxxxxxxxx,dc=xxx"
    nss_nis is disabled
    NIS server = ""
    NIS domain = ""
    nss_nisplus is disabled
    nss_winbind is disabled
    SMB workgroup = "MYGROUP"
    SMB servers = ""
    SMB security = "user"
    SMB realm = ""
    Winbind template shell = "/bin/false"
    SMB idmap uid = "16777216-33554431"
    SMB idmap gid = "16777216-33554431"
    nss_sss is disabled by default
    nss_wins is disabled
    pam_unix is always enabled
    shadow passwords are enabled
    password hashing algorithm is md5
    pam_krb5 is disabled
    krb5 realm = "EXAMPLE.COM"
    krb5 realm via dns is disabled
    krb5 kdc = "kerberos.example.com:88"
    krb5 kdc via dns is disabled
    krb5 admin server = "kerberos.example.com:749"
    pam_ldap is enabled

     LDAP+TLS is disabled
     LDAP server = "ldap://xxxxxxxxxxxxxxxxxx"
     LDAP base DN = "dc=xxxxxxxxxxxxxxxxxxxx,dc=xxxxx"
    pam_pkcs11 is disabled

     use only smartcard for login is disabled
     smartcard module = "coolkey"
     smartcard removal action = "Ignorar"
    pam_smb_auth is disabled
     SMB workgroup = "MYGROUP"
     SMB servers = ""
    pam_winbind is disabled
     SMB workgroup = "MYGROUP"
     SMB servers = ""
     SMB security = "user"
     SMB realm = ""
    pam_sss is disabled by default
    pam_cracklib is enabled (try_first_pass retry=3)
    pam_passwdqc is disabled ()
    pam_access is disabled ()
    pam_mkhomedir is disabled ()
    Always authorize local users is disabled ()
    Authenticate system accounts against network services is disabled

如果有人有任何想法，请回答我！

PD：抱歉，我的英语不好！

答案1

nscd 并非设计用于缓存密码。请查看ssd 的或者pam_ccreds

答案2

如果我是你，我需要创建一些与 ldap“管理员”用户同名的额外本地“管理员”用户。

因为如果 ldap/winbind 服务不可用，或者某些特殊情况（如维护模式），则非常危险，我可能会遇到 ldap/winbind authen 的巨大问题

相关内容