[CentOS] openldap and nscd

[Manuel Monteiro]

Hi,

I applied all these suggestions and here's what happened:
- during boot it took a couple of minutes in "Applying ipv6tables firewall
rules:"
- sometimes it still fails to find a user
-----
May 19 23:03:33 mail postfix/local[26628]: 2E28F7686AE:
to=<xxxxx at astro.up.pt>, relay=local, delay=0.03, delays=0.01/0/0/0.02, d
sn=5.1.1, status=bounced (user unknown. Command output: procmail: Unknown
user "xxxxx" )
-----

Other suggestions?

Thanks.

Manuel




-----Original Message-----
From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf
Of Filipe Brandenburger
Sent: sexta-feira, 15 de Maio de 2009 19:57
To: CentOS mailing list
Subject: Re: [CentOS] openldap and nscd

Hi,

On Fri, May 15, 2009 at 12:52, Manuel Monteiro
<Manuel.Monteiro at astro.up.pt> wrote:
>> # Reconnect policy: hard (default) will retry connecting to
>> # the software with exponential backoff, soft will fail
>> # immediately.
>> #bind_policy hard
>
> As far as I remember we are using soft because system would take to long
> to boot trying to connect to LDAP, but I'll try this over the weekend
> with less users around!

You can add some local users that will not belong to LDAP groups to
the ignore list, that will probably fix most of your problems during
bootup before the network is up:

nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus

In the past I have had problems with OpenLDAP not being able to get
new connections because of the open file descriptors limit (of 1024)
being reached, so it was not able to create new sockets. IIRC, the
message on the logs was clear in that sense, saying the limit had been
reached. To increase the number of file descriptors I added this line
to /etc/sysconfig/ldap:

ulimit -n 8192

If you are reaching the file descriptor limit, it may also mean that
you do not have enough threads to work on the requests. You may
increase that number. I have in my /etc/openldap/slapd.conf:

threads 64

When I start it up, it gives me a warning that this is larger than 32
which they think should be enough for anyone, but I guess that number
is pretty outdated considering today's hardware. Anyway, I'd rather
have too many and have a small overhead for the task switching than
having too few and not being able to cope with a burst.

> Meanwhile I'm also getting some authentication problems with IMAP server
> (dovecot)... the only service that I didn't find any failure was with
> SSH, but it's only used occasionally.

Since I introduced the changes above my problems with OpenLDAP stopped
completely. I even implemented LDAP over SSL for all connections
(including user/group lookup) after that and had no noticeable
performance issues due to the overhead.

HTH,
Filipe
_______________________________________________
CentOS mailing list
CentOS at centos.org
http://lists.centos.org/mailman/listinfo/centos