7

I'm stumped here, sorry if I'm missing something obvious. I had a 16.04 server authenticating against LDAP that stopped working last time I ran updates, and I built a clean 16.04 server from scratch, ran standard updates, and it works fine until I enable LDAP authentication. I can disable LDAP and then it works again.

me@myserver:/etc# systemctl status systemd-logind.service
● systemd-logind.service - Login Service
   Loaded: loaded (/lib/systemd/system/systemd-logind.service; static; vendor preset: enabled)
   Active: activating (start) since Tue 2016-07-12 15:13:07 EDT; 19s ago
     Docs: man:systemd-logind.service(8)
           man:logind.conf(5)
           http://www.freedesktop.org/wiki/Software/systemd/logind
           http://www.freedesktop.org/wiki/Software/systemd/multiseat
 Main PID: 2106 (systemd-logind)
    Tasks: 1
   Memory: 228.0K
      CPU: 2ms
   CGroup: /system.slice/systemd-logind.service
           └─2106 /lib/systemd/systemd-logind

Jul 12 15:13:07 myserver systemd[1]: Starting Login Service...

It will churn for a while, fail, then try starting again in endless loops. I can log in to a local account but it takes a long time.

me@myserver:/etc# systemd-analyze blame
Bootup is not yet finished. Please try again later.

Meanwhile journalctl -xe returns its own more verbose loop:

me@myserver:/etc# journalctl -xe
-- Subject: Unit systemd-logind.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit systemd-logind.service has failed.
-- 
-- The result is failed.
Jul 12 15:16:27 myserver systemd[1]: systemd-logind.service: Unit entered failed state.
Jul 12 15:16:27 myserver systemd[1]: systemd-logind.service: Failed with result 'exit-code'.
Jul 12 15:16:27 myserver systemd[1]: systemd-logind.service: Service has no hold-off time, scheduling restart.
Jul 12 15:16:27 myserver systemd[1]: Stopped Login Service.
-- Subject: Unit systemd-logind.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit systemd-logind.service has finished shutting down.
Jul 12 15:16:27 myserver systemd[1]: Starting Login Service...
-- Subject: Unit systemd-logind.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit systemd-logind.service has begun starting up.
Jul 12 15:16:52 myserver systemd-logind[2134]: Failed to enable subscription: Connection timed out
Jul 12 15:16:52 myserver systemd-logind[2134]: Failed to fully start up daemon: Connection timed out
Jul 12 15:16:52 myserver dbus[1012]: [system] Failed to activate service 'org.freedesktop.systemd1': timed out
Jul 12 15:16:52 myserver systemd[1]: systemd-logind.service: Main process exited, code=exited, status=1/FAILURE
Jul 12 15:16:52 myserver systemd[1]: Failed to start Login Service.

I've got two dozen or so 14.04 servers working fine w/ LDAP, same config.

I've tried manually restarting systemd-logind but it fails.

Any ideas? TIA.

(ETA: just built the exact same system on 14.04 and LDAP authentication works fine.)

Adding dpkg.log info: There's a lot of noise in this file, so not sure what's relevant and useful, but here's what appears to be the terminal lines of processing for related packages:

2016-07-11 13:52:08 status installed libldap-2.4-2:amd64 2.4.42+dfsg-2ubuntu3
2016-07-11 14:11:40 status installed libldap-2.4-2:amd64 2.4.42+dfsg-2ubuntu3.1
2016-07-11 15:02:45 status installed libnss-ldap:amd64 265-3ubuntu2
2016-07-11 15:02:45 status installed ldap-auth-client:all 0.5.3
2016-07-11 15:02:45 status installed ldap-auth-config:all 0.5.3
2016-07-11 15:02:45 status installed libpam-ldap:amd64 184-8.7ubuntu1
2016-07-11 15:04:12 status installed ldap-utils:amd64 2.4.42+dfsg-2ubuntu3.1

My LDAP server is elsewhere; this server only needs to authenticate against it as a client. The config files at /etc/ldap.conf and /etc/ldap/ldap.conf are identical and appear to have not changed between 14.04 and 16.04

It's worth noting that although LDAP authentication is not working, I can successfully do an ldapsearch query against the LDAP server.

  • 1
    Can you look in /var/log/dpkg.log and see if any related packages were updated? If so can you add that information to the question? thanks! – Jorge Castro Jul 14 '16 at 15:33
  • Here is a full guided configuration of LDAP in Ubuntu 16.04, including details of the configuration file /etc/ldap.conf. They might be of help. ubuntuforums.org/showthread.php?t=2322679 – user308164 Jul 15 '16 at 17:04
  • added dpkg.log info. server is only an ldap client, but configs all match instructions and do not seem to have changed from 14.04 – oxtoe Jul 18 '16 at 14:53
  • Could you try downgrading libldap-2.4-2 and ldap-utils back down to version 2.4.42+dfsg-2ubuntu3? – Robie Basak Jul 19 '16 at 20:59
  • Downgraded those two packages, behavior remains unchanged. :( Thanks for the suggestion, though! For (probably not useful) reference, the working 14.04 system has 2.4.31-1+nmu2ubuntu8.3 for both packages. – oxtoe Jul 21 '16 at 13:01
4

Had the same problem with my 16.04 desktop clients.

Finally resolved replacing the libnss-ldap package with libnss-ldapd.

Seems the same issue as in this bug report: https://bugs.launchpad.net/ubuntu/+source/libnss-ldap/+bug/1024475

EDIT: more info about these packages from the Debian wiki:

There are currently two packages available to configure NSS lookups through LDAP: the libnss-ldap package and the libnss-ldapd package. Which one to choose depends on the needs. In general libnss-ldapd is simpler but newer and libnss-ldap is more mature but more complex. Also libnss-ldap has some known issues with serving host information and lookups during boot which should be addressed in libnss-ldapd. In addition, libnss-ldap breaks setuid programs (su, sudo) when using LDAP+SSL

  • Ah, thank you! Was beginning to wonder if it was just me. Will try that! (-: – oxtoe Aug 11 '16 at 14:02
3

A way to prevent this problem is to make sure the nss_initgroups_ignoreusers parameter - in /etc/ldap.conf (or /etc/libnss-ldap.conf, depending on your system) - is populated with all the (local) users in /etc/passwd:

NSS_IGNOREUSERS="$(cut -d: -f1 /etc/passwd | sort | tr '\n' ',' | sed 's|,$||')"
sed -i "s|^nss_initgroups_ignoreusers.*|nss_initgroups_ignoreusers ${NSS_IGNOREUSERS}|" /etc/ldap.conf

This way, when the system boots and users/groups name services are queried to start the local services, no more 'nss_ldap: Can't contact LDAP server' will be issued (since the corresponding local user/group are ignored by NSS LDAP).

(this issue has been around for years, independently from systemd)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.