On Wed, 2013-11-20 at 12:58 -0600, Michael Lustfield wrote: > I have some servers that have users that log in that are members of > many groups in an LDAP directory. When I watch debug output from nscd > I see that the user is looked up, then the members of each group the > user is a member of are looked > up. In my case, looking up users that are members of the group that > the user logging in is a member of causes a delay of up to one minute. > As far as I can see, this also provides no value. > > Instead of pasting the entire log that I have, I'll share a link to > it. This log has been trimmed in the middle... ""[...] A few hundred > more of these...""
Judging from earlier examination of the log it seems that after the lookup of the groups for the user, the application requests each group (probably to lookup the group name). Group lookups with lots of members can be slow, especially if the member attribute is used. For this reason nslcd caches DN to username lookups. The upcoming 0.9.3 release includes a configuration option to set the timeout for these cached entries (by default 15 minutes) and allows disabling the member attribute. Other than the above, there is not much more that nslcd can do. It may be a good idea to use (u)nscd to cache group lookups (this may improve performance for subsequent lookups). Another point is that sshd may be doing the group lookups due to the use of AllowGroups/DenyGroups (haven't tested this). Perhaps disabling this is an option? Similarly it could be a pam_group or similar module that initiates the extra lookups. -- -- arthur - [email protected] - http://people.debian.org/~adejong --
signature.asc
Description: This is a digitally signed message part
