Home / server / Questions / 782446
Accepted
Christoph
Asked: 2016-06-08 03:25:23 +0800 CST

Weird behavior with ldap and getent or repquota

  • 772

I've observed a weird behavior in my network.

I have my network users stored in OpenLDAP 2.4 which also serves a samba 3.6 Domain.

I have user quotas on my NFS servers and that is where I stumbled over the "problem".

When I call repquota -up it displays the numeric ID instead of the uid up from a certain numeric ID.

If I call repquota -upC all LDAP user UIDs are displayed, so I assume it is not a real problem at the moment.

As far as I can tell everything works as it should. I can login, id displays the correct information. ls is also displaying the correct UIDs instead of the numeric IDs.

The behavior from repquota -up can be repoduced with genent passwd in so far, that the LDAP user after a certain point are not displayed.

And, on further thinking about this, we also have the Problem, that finger only works in both directions up to the UID in question. Meaning, that finger <Realname> only produces results for users with a smaller (and therefore older numeric ID). finger uid always produces correct results.

I read up on nscd and nslcd and played around with the nscd max-db-size but that changed nothing. I have the nscd install and running on all machines which do LDAP auth, but only installed nslcd on one for experimenting with this problem.

The operating systems vary from Debian 7 and 8, and Ubuntu Server LTS 14.04 and 16.04. I use libnss-ldap and libpam-ldap.

As I said, I have no real problem except, that I sometime see only numeric IDs if a user is over quota. That I can fix by changing the options of repquota. But I am a little afraid, that I have some misconfiguration which may cause problems at some point.

So my question is if someone has an idea where I can fix this? Or if it is some sort of expected behavior. At the moment I'm at a loss where to look for clues.

Cheers, Christoph

ldap quota pam-ldap nss

1 Answers

  1. Best Answer

    I suspect it's your LDAP server.

    olcSizeLimit: size[.{soft|hard|unchecked}]= [...]
    Specify the maximum number of entries to return from a search operation. The default size limit is 500. Use unlimited to specify no limits. The second format allows a fine grain setting of the size limits. Extra args can be added in the same value or as additional values. See olcLimits for an explanation of the different flags.
    slapd-config(5)

    • 1