Package: nslcd Version: 0.7.15+squeeze2 Severity: important Tags: squeeze Dear maintener,
The last nslcd upgrades breaks our /etc/nslcd.conf without asking. The binddn for group resolution is broken, it can be a problem on file server, and has to be fixed by hand. It is specifically the "base group" option that is affected. It might be related to #671464 and to #670133. Here's some more information. /etc/nslcd.conf before the upgrade : # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://ldap2.enst.fr ldap://ldap3.enst.fr ldap://ldap.enst.fr ldap://ldap4.enst.fr # Les attribus scope one base passwd ou=People,dc=enst,dc=fr map passwd homeDirectory "/home/${uid}" base shadow ou=People,dc=enst,dc=fr base group ou=group,dc=enst,dc=fr filter group (|(cn=dsi_*)(cn=siav)) base netgroup ou=netgroup,dc=enst,dc=fr # SSL options ssl start_tls tls_reqcert demand tls_cacertfile /etc/ssl/IT.pem # Filtre PAM snip anonymized /etc/nslcd after the upgrade: # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://ldap2.enst.fr # Les attribus scope one base passwd ou=People,dc=enst,dc=fr map passwd homeDirectory "/home/${uid}" base shadow ou=People,dc=enst,dc=fr #base group ou=group,dc=enst,dc=fr filter group (|(cn=dsi_*)(cn=siav)) base netgroup ou=netgroup,dc=enst,dc=fr # SSL options ssl start_tls tls_reqcert demand tls_cacertfile /etc/ssl/IT.pem # Filtre PAM snip anonymized unchanged uri ldap://ldap3.enst.fr uri ldap://ldap.enst.fr uri ldap://ldap4.enst.fr # debconf-show nslcd nslcd/ldap-bindpw: (password omitted) nslcd/ldap-starttls: true * nslcd/ldap-reqcert: * nslcd/ldap-uris: ldap://ldap2.enst.fr ldap://ldap3.enst.fr ldap://ldap.enst.fr ldap://ldap4.enst.fr nslcd/ldap-binddn: * nslcd/ldap-base: # DEBCONF_DEBUG=developer debconf /var/lib/dpkg/info/nslcd.config debconf (developer): starting /var/lib/dpkg/info/nslcd.config debconf (developer): <-- VERSION 2.0 debconf (developer): --> 0 2.0 debconf (developer): <-- CAPB backup debconf (developer): --> 0 multiselect escape backup debconf (developer): <-- SET nslcd/ldap-uris debconf (developer): --> 0 value set debconf (developer): <-- SET nslcd/ldap-base debconf (developer): --> 0 value set debconf (developer): <-- SET nslcd/ldap-binddn debconf (developer): --> 0 value set debconf (developer): <-- SET nslcd/ldap-bindpw debconf (developer): --> 0 value set debconf (developer): <-- SET nslcd/ldap-starttls debconf (developer): --> 0 value set debconf (developer): <-- GET nslcd/ldap-uris debconf (developer): --> 0 debconf (developer): <-- SET nslcd/ldap-uris ldap://ldap2.enst.fr ldap://ldap3.enst.fr ldap://ldap.enst.fr ldap://ldap4.enst.fr debconf (developer): --> 0 value set debconf (developer): <-- GET nslcd/ldap-base debconf (developer): --> 0 debconf (developer): <-- GET nslcd/ldap-binddn debconf (developer): --> 0 debconf (developer): <-- SET nslcd/ldap-binddn debconf (developer): --> 0 value set debconf (developer): <-- GET nslcd/ldap-bindpw debconf (developer): --> 0 debconf (developer): <-- SET nslcd/ldap-bindpw debconf (developer): --> 0 value set debconf (developer): <-- GET nslcd/ldap-starttls debconf (developer): --> 0 debconf (developer): <-- SET nslcd/ldap-starttls true debconf (developer): --> 0 value set debconf (developer): <-- GET nslcd/ldap-reqcert debconf (developer): --> 0 debconf (developer): <-- SET nslcd/ldap-reqcert demand debconf (developer): --> 0 value set debconf (developer): <-- GET nslcd/ldap-starttls debconf (developer): --> 0 true debconf (developer): <-- INPUT high nslcd/ldap-uris debconf (developer): --> 30 question skipped debconf (developer): <-- INPUT high nslcd/ldap-base debconf (developer): --> 30 question skipped debconf (developer): <-- GO debconf (developer): --> 0 ok debconf (developer): <-- INPUT medium nslcd/ldap-binddn debconf (developer): --> 30 question skipped debconf (developer): <-- GO debconf (developer): --> 0 ok debconf (developer): <-- GET nslcd/ldap-binddn debconf (developer): --> 0 debconf (developer): <-- SET nslcd/ldap-bindpw debconf (developer): --> 0 value set debconf (developer): <-- GO debconf (developer): --> 0 ok debconf (developer): <-- GET nslcd/ldap-uris debconf (developer): --> 0 ldap://ldap2.enst.fr ldap://ldap3.enst.fr ldap://ldap.enst.fr ldap://ldap4.enst.fr debconf (developer): <-- INPUT medium nslcd/ldap-starttls debconf (developer): --> 30 question skipped debconf (developer): <-- GO debconf (developer): --> 0 ok debconf (developer): <-- GET nslcd/ldap-uris debconf (developer): --> 0 ldap://ldap2.enst.fr ldap://ldap3.enst.fr ldap://ldap.enst.fr ldap://ldap4.enst.fr debconf (developer): <-- GET nslcd/ldap-starttls debconf (developer): --> 0 true debconf (developer): <-- INPUT high nslcd/ldap-reqcert debconf (developer): --> 30 question skipped debconf (developer): <-- GO debconf (developer): --> 0 ok Thank you for your work, and your help, Best regards, Manuel Sabban -- System Information: Debian Release: 6.0.6 APT prefers stable-updates APT policy: (997, 'stable-updates'), (997, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to fr_FR.UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages nslcd depends on: ii adduser 3.112+nmu2 add and remove users and groups ii debconf [debconf-2. 1.5.36.1 Debian configuration management sy ii libc6 2.11.3-4 Embedded GNU C Library: Shared lib ii libgssapi-krb5-2 1.8.3+dfsg-4squeeze6 MIT Kerberos runtime libraries - k ii libldap-2.4-2 2.4.23-7.2 OpenLDAP libraries Versions of packages nslcd recommends: ii libnss-ldapd [libnss-lda 0.7.15+squeeze2 NSS module for using LDAP as a nam ii libpam-ldapd [libpam-lda 0.7.15+squeeze2 PAM module for using LDAP as an au ii nscd 2.11.3-4 Embedded GNU C Library: Name Servi Versions of packages nslcd suggests: pn kstart <none> (no description available) -- debconf information: nslcd/ldap-starttls: true nslcd/ldap-reqcert: nslcd/ldap-uris: ldap://ldap3.enst.fr ldap://ldap2.enst.fr ldap://ldap.enst.fr ldap://ldap4.enst.fr nslcd/ldap-binddn: nslcd/ldap-base: -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
