Home / server / Questions / 586214
In Process
Josh Kelley
Asked: 2014-04-03 08:20:25 +0800 CST

Apache + PAM + Winbind slow logins

  • 772

Since upgrading our old Debian Lenny server to Ubuntu 12.04, we've noticed intermittent slow or failed access to Apache. Many or most web requests work fine, but occasionally, a Subversion client will effectively lock up while waiting on a reply, Firefox will load for a long time then re-request a password, etc.

This is very noticeable when using Subversion clients, presumably because of all of the WebDAV requests that a Subversion client issues, but it occasionally happens with access to other pages hosted by the web server.

It's a standard Apache + mod_auth_pam setup:

<Location /software>
  AuthType Basic
  AuthName "Subversion"
  AuthBasicAuthoritative off
  AuthPam_Enabled on
  require group engineering
</Location>

It's a standard PAM and Winbind setup. I've added www-data to the winbindd_priv group since (as far as I can tell) this helps Apache do Winbind authentication.

We haven't seen any other Winbind problems; for example, SSH logins work just fine (although, since we often use public key authentication, maybe we just haven't run into the problem).

Turning up the log levels in Winbind and Apache reveals some occasional trouble communicating, but no explanation as to why:

/var/log/samba/log.winbindd:

[2014/04/02 11:41:36.837645,  3] winbindd/winbindd_misc.c:384(winbindd_interface_version)
  [32654]: request interface version
[2014/04/02 11:41:36.837720,  2] winbindd/winbindd.c:732(winbind_client_response_written)
  Could not write response[32654:INTERFACE_VERSION] to client: Broken pipe
[2014/04/02 11:41:36.837789,  3] winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send)
  getpwnam jkelley
[2014/04/02 11:41:36.837984,  3] winbindd/winbindd_misc.c:384(winbindd_interface_version)
  [32655]: request interface version
[2014/04/02 11:41:36.838057,  2] winbindd/winbindd.c:732(winbind_client_response_written)
  Could not write response[32655:INTERFACE_VERSION] to client: Broken pipe

/var/log/apache2/error.log:

[Wed Apr 02 11:41:38 2014] [error] [client 10.75.20.168] PAM: user 'jkelley' - not authenticated: Authentication failure
[Wed Apr 02 11:41:38 2014] [error] [client 10.75.20.168] PAM: user 'jkelley' - not authenticated: Authentication failure

Any ideas as to what's wrong? Any suggestions for where to troubleshoot next?

apache-2.2

0 Answers