3

I have been running this server with LDAP for about 6 months. The logins have always been fast. However, starting this week logins are taking 1-2 minutes to complete. This include ssh, sudo su, and local logins. The Openldap database is being hosted by the server that is having the speed problems. I have two other servers that use this same openldap database for authentication, they don't have any problems with speed. The server is ubuntu server 12.04 lts running OpenLDAP 2.4.28. The two working servers are both running ubuntu server 12.04 lts also. I did notice that when logging in I get a Failed to add entry for user mbrown. Just after the login completes. I have tried adding

UseDNS no 

to /etc/sshd_config and have also tried commenting out the line

session        optional pam_ck_connector.so nox11 

from /etc/pam.d/common-session.

Neither has sped up the login. I have also verified that my /etc/hosts file is correctly set up.

What else could be causing such a slow login?

0

3 Answers 3

1

I ended up digging through a backup and restoring all the files from /etc/pam.d. this appears to have fixed the slow login problem.

0

I had the same issue and finally what worked for me was a change in /etc/pam.d/common-session on the machine you see slow logins for (ie. the server).
The change:

session optional pam_systemd.so

To

#session optional pam_systemd.so

I saw that solution in the following question

0
0

You might consider disabling LDAP_Referals on your system's /etc/sssd/sssd.conf configuration file.

ldap_referrals = false

This is a known performance issue and is described on the sssd man-page: https://linux.die.net/man/5/sssd-ldap

ldap_referrals (boolean)

Specifies whether automatic referral chasing should be enabled.

  • Please note that sssd only supports referral chasing when it is compiled with OpenLDAP version 2.4.13 or higher.
  • Chasing referrals may incur a performance penalty in environments that use them heavily, a notable example is Microsoft Active Directory. If your setup does not in fact require the use of referrals, setting this option to false might bring a noticeable performance improvement.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .