On Wed, Aug 27, 2008 at 05:07:26PM -0400, Mark Hennessy wrote:
With networking, no trouble at all, but with those timeouts of 30 seconds and without those changes to nsswitch.conf, it takes a while for the first root login to succeed even though it is using local auth.
If you have ldap groups and the ldap server isn't reachable then logins _can_ take a long time (depending on why the ldap server isn't reachable; if a "telnet ldapserver ldap" returns immediately then it shouldn't) because a login has to go through _every_ group to determine if you're in the group or not.
It doesn't do a "getent group blah" it does the equivalent of while (getgrent()) { } which means it tries to parse the whole local _and_ ldap group entries.
It needs to do this to get your secondary group list.
Even root would need to do this.