Subject: Bug#787020: Trying systemd

From: Youssef Eldakar <[email-masked]>
Date: Mon, 1 Feb 2016 16:31:02 +0200

I am experiencing the same issue.

I thought that implementing the init as systemd units could be the
solution. I attempted the following, but nslcd-kstart.service so far fails
to start during the boot process, starts successfully when invoked manually
after the system is up:

# nslcd-kstart.service

[Unit]
Description=Keep alive Kerberos ticket for nslcd
After=network.target auditd.service systemd-resolved.service

[Service]
#EnvironmentFile=-/etc/default/nslcd-kstart
ExecStart=/usr/bin/k5start -b -p /var/run/nslcd/nslcd-kstart.pid -f
/etc/libnss-ldap.keytab -u nssldap -o nslcd -g nslcd -m 600 -k
/tmp/.nssldapcc -K 60
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target
Alias=nslcd-kstart.service

---

# nslcd.service

[Unit]
Description=LDAP connection daemon
After=network.target auditd.service nslcd-kstart.service

[Service]
#EnvironmentFile=-/etc/default/nslcd
ExecStart=/usr/sbin/nslcd
KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target
Alias=nslcd.service

---

I have no previous experience writing systemd unit files, and so I could be
doing something wrong. Any suggestions would be appreciated.

Youssef Eldakar
Bibliotheca Alexandrina

---

From: Youssef Eldakar <[email-masked]>
Date: Mon, 1 Feb 2016 17:25:51 +0200

It is silly, but if I add

RestartSec=2s

to both unit files, nslcd is successful during the boot process.

This does not feel like a real fix, however.

Youssef Eldakar
Bibliotheca Alexandrina

---

From: Youssef Eldakar <[email-masked]>
Date: Tue, 2 Feb 2016 16:54:13 +0200

To check, I put KDC IP address in krb5.conf. Yet, the issue persisted,
suggesting this does not have to do with name resolution not being
available early on in the boot process.

Youssef Eldakar
Bibliotheca Alexandrina

---

From: Youssef Eldakar <[email-masked]>
Date: Thu, 3 Mar 2016 09:08:42 +0200

This page on the systemd wiki sheds light on the issue:

https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/

According to the page, ideally, the ticket refresh (k5start) should be
implemented such that it is able to react in a friendly way to network
changes. I take this as implying that nslcd should start without
depending on Kerberos ticket initialization and instead attempt to
obtain credentials on demand.

As temporary workaround, I installed the following in cron.d:

*/3 * * * * root if [ \( ! -e /var/run/nslcd/k5start_nslcd.pid -o ! -e
/var/run/nslcd/nslcd.pid \) -a -f /etc/libnss-ldap.keytab -a -r
/etc/libnss-ldap.keytab ]; then systemctl restart nslcd; fi