16.04 server: enabling LDAP authentication causes systemd-logind to fail

Question

I'm stumped here, sorry if I'm missing something obvious. I had a 16.04 server authenticating against LDAP that stopped working last time I ran updates, and I built a clean 16.04 server from scratch, ran standard updates, and it works fine until I enable LDAP authentication. I can disable LDAP and then it works again.

me@myserver:/etc# systemctl status systemd-logind.service
● systemd-logind.service - Login Service
   Loaded: loaded (/lib/systemd/system/systemd-logind.service; static; vendor preset: enabled)
   Active: activating (start) since Tue 2016-07-12 15:13:07 EDT; 19s ago
     Docs: man:systemd-logind.service(8)
           man:logind.conf(5)
           http://www.freedesktop.org/wiki/Software/systemd/logind
           http://www.freedesktop.org/wiki/Software/systemd/multiseat
 Main PID: 2106 (systemd-logind)
    Tasks: 1
   Memory: 228.0K
      CPU: 2ms
   CGroup: /system.slice/systemd-logind.service
           └─2106 /lib/systemd/systemd-logind

Jul 12 15:13:07 myserver systemd[1]: Starting Login Service...

It will churn for a while, fail, then try starting again in endless loops. I can log in to a local account but it takes a long time.

me@myserver:/etc# systemd-analyze blame
Bootup is not yet finished. Please try again later.

Meanwhile journalctl -xe returns its own more verbose loop:

me@myserver:/etc# journalctl -xe
-- Subject: Unit systemd-logind.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit systemd-logind.service has failed.
-- 
-- The result is failed.
Jul 12 15:16:27 myserver systemd[1]: systemd-logind.service: Unit entered failed state.
Jul 12 15:16:27 myserver systemd[1]: systemd-logind.service: Failed with result 'exit-code'.
Jul 12 15:16:27 myserver systemd[1]: systemd-logind.service: Service has no hold-off time, scheduling restart.
Jul 12 15:16:27 myserver systemd[1]: Stopped Login Service.
-- Subject: Unit systemd-logind.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit systemd-logind.service has finished shutting down.
Jul 12 15:16:27 myserver systemd[1]: Starting Login Service...
-- Subject: Unit systemd-logind.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit systemd-logind.service has begun starting up.
Jul 12 15:16:52 myserver systemd-logind[2134]: Failed to enable subscription: Connection timed out
Jul 12 15:16:52 myserver systemd-logind[2134]: Failed to fully start up daemon: Connection timed out
Jul 12 15:16:52 myserver dbus[1012]: [system] Failed to activate service 'org.freedesktop.systemd1': timed out
Jul 12 15:16:52 myserver systemd[1]: systemd-logind.service: Main process exited, code=exited, status=1/FAILURE
Jul 12 15:16:52 myserver systemd[1]: Failed to start Login Service.

I've got two dozen or so 14.04 servers working fine w/ LDAP, same config.

I've tried manually restarting systemd-logind but it fails.

Any ideas? TIA.

(ETA: just built the exact same system on 14.04 and LDAP authentication works fine.)

Adding dpkg.log info: There's a lot of noise in this file, so not sure what's relevant and useful, but here's what appears to be the terminal lines of processing for related packages:

2016-07-11 13:52:08 status installed libldap-2.4-2:amd64 2.4.42+dfsg-2ubuntu3
2016-07-11 14:11:40 status installed libldap-2.4-2:amd64 2.4.42+dfsg-2ubuntu3.1
2016-07-11 15:02:45 status installed libnss-ldap:amd64 265-3ubuntu2
2016-07-11 15:02:45 status installed ldap-auth-client:all 0.5.3
2016-07-11 15:02:45 status installed ldap-auth-config:all 0.5.3
2016-07-11 15:02:45 status installed libpam-ldap:amd64 184-8.7ubuntu1
2016-07-11 15:04:12 status installed ldap-utils:amd64 2.4.42+dfsg-2ubuntu3.1

My LDAP server is elsewhere; this server only needs to authenticate against it as a client. The config files at /etc/ldap.conf and /etc/ldap/ldap.conf are identical and appear to have not changed between 14.04 and 16.04

It's worth noting that although LDAP authentication is not working, I can successfully do an ldapsearch query against the LDAP server.

Answer 1

Had the same problem with my 16.04 desktop clients.

Finally resolved replacing the libnss-ldap package with libnss-ldapd.

Seems the same issue as in this bug report: https://bugs.launchpad.net/ubuntu/+source/libnss-ldap/+bug/1024475

EDIT: more info about these packages from the Debian wiki:

There are currently two packages available to configure NSS lookups through LDAP: the libnss-ldap package and the libnss-ldapd package. Which one to choose depends on the needs. In general libnss-ldapd is simpler but newer and libnss-ldap is more mature but more complex. Also libnss-ldap has some known issues with serving host information and lookups during boot which should be addressed in libnss-ldapd. In addition, libnss-ldap breaks setuid programs (su, sudo) when using LDAP+SSL

Answer 2

A way to prevent this problem is to make sure the nss_initgroups_ignoreusers parameter - in /etc/ldap.conf (or /etc/libnss-ldap.conf, depending on your system) - is populated with all the (local) users in /etc/passwd:

NSS_IGNOREUSERS="$(cut -d: -f1 /etc/passwd | sort | tr '\n' ',' | sed 's|,$||')"
sed -i "s|^nss_initgroups_ignoreusers.*|nss_initgroups_ignoreusers ${NSS_IGNOREUSERS}|" /etc/ldap.conf

This way, when the system boots and users/groups name services are queried to start the local services, no more 'nss_ldap: Can't contact LDAP server' will be issued (since the corresponding local user/group are ignored by NSS LDAP).

(this issue has been around for years, independently from systemd)