ldap client causes boot to be very slow on 13.10, causes hang on 14.04

Question

I have successfully configured ubuntu as an ldap client following the howtos found on this site. i do the following.

1) apt-get install libpam-ldap nscd

2) configure ldap-auth-config

3) change /etc/nsswitch.conf

passwd: ldap compat

group: ldap compat

shadow: ldap compat

4) add the line

session required pam_mkhomedir.so skel=/etc/skel umask=0022

to /etc/pam.d common-session

5) do a /etc/init.d/nscd restart

6) change lightdm.conf to allow user login with name and password

everything works fine. users can login and all works as expected. the problem i have is: on startup (cold start, reboot) ubuntu takes about 6 minutes to boot on 13.10.

on 14.04 it hangs completely.

as soon as i deactivate ldap (e.g renaming ldap.conf, or entering a wrong ldap uri) boot runs normal and takes about 20 seconds.

any ideas?

Answer 1

Current workaround is changing the existing script /etc/init.d/libnss-ldap to include:

[...]

case "$1" in
    start)
            cp -f /etc/nsswitch.conf.ldap /etc/nsswitch.conf
            ;;
    stop)
            cp -f /etc/nsswitch.conf.local /etc/nsswitch.conf
            ;;

[...]

you may need to first create nsswitch.conf.ldap and nsswitch.conf.local

.ldap file HAS the ldap for users, groups, shadow

.local file does NOT have the ldap setting for users, groups, shadow

Answer 2

I have had this problem so many times the past year or so, and I'd like to post my solution here in case someone else stumbles into this issue. The primary source of my solution was the bug report here. My environment is a LDAP server (Ubuntu 14.04 desktop/LDAP server), configured using the Digital Ocean LDAP server guide and a bunch of Ubuntu 14.04 servers and desktops configured per the Digital Ocean guide for LDAP clients. In addition to LDAP, the home directories were also mounted from an external source (using NFS). The issue is that they would hang at bootup (per the bug report). My fixes were:

(a) assign static IP using configuration in /etc/network/interfaces

auto eth0
iface eth0 inet static
address 10.10.1.102
netmask 255.255.255.0
network 10.10.1.0
broadcast 10.10.1.255
gateway 10.10.1.1
dns-nameservers 8.8.8.8

(b) Remove the network manager: sudo apt-get remove --purge network-manager

(c) Edit /etc/ldap.conf for adding some additional configuration (see the bug report):

timelimit 120
bind_timelimit 120
nss_reconnect_tries 2
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 1
nss_reconnect_maxconntries 1
bind_policy soft

(d) Set up /etc/init.d/libnss-ldap correctly-add, per user249806's answer above:

[...]
case "$1" in
        start)
                cp -f /etc/nsswitch.conf.ldap /etc/nsswitch.conf
                ;;
        stop)
                cp -f /etc/nsswitch.conf.local /etc/nsswitch.conf
                ;;
esac
[...]

and,

(e) create /etc/nsswitch.conf.local file without the ldap entry for passwd, group and shadow and /etc/nsswitch.ldap file with the ldap entry.

It is quite irritating that the Ubuntu community has still not fixed this problem.

Answer 3

I think I have a similar problem. You could try, if taking the ldap-entry away from "group:" helps, though this is not a solution.

It is probably connected to: https://bugs.launchpad.net/ubuntu/+source/libnss-ldap/+bug/1024475

And if you speak German: http://forum.ubuntuusers.de/topic/ldap-nsswitch-conf-hosts-ldap-system-bootet-ni/