Subject: nslcd: k5start still fails during boot

From: Lars Hanke <[email-masked]>
Date: Wed, 27 May 2015 22:44:34 +0200

Package: nslcd
Version: 0.9.4-3
Severity: important

Dear Maintainer,

the behaviour reported for Wheezy in #766606 still persists with Jessie. I see
it now on a fresh install: k5start doesn't come up on boot. Issuing
/etc/init.d/nslcd restart after boot works perfectly.

Situation after boot:

root@frengel:~# systemctl status nslcd -l
● nslcd.service - LSB: LDAP connection daemon
  Loaded: loaded (/etc/init.d/nslcd)
  Active: active (running) since Mi 2015-05-27 21:51:15 CEST; 1min 16s ago
  Process: 630 ExecStart=/etc/init.d/nslcd start (code=exited, status=0/SUCCESS)
  CGroup: /system.slice/nslcd.service
          └─674 /usr/sbin/nslcd

Mai 27 21:51:39 frengel nslcd[674]: [b71efb] <group/member="administrator"> no available LDAP server found: Local error
Mai 27 21:51:39 frengel nslcd[674]: [b71efb] <group/member="administrator"> no available LDAP server found: Server is unavailable
Mai 27 21:51:42 frengel nslcd[674]: [e2a9e3] <group/member="administrator"> no available LDAP server found: Server is unavailable
Mai 27 21:51:42 frengel nslcd[674]: [e2a9e3] <group/member="administrator"> no available LDAP server found: Server is unavailable
Mai 27 21:51:42 frengel nslcd[674]: [45e146] <group/member="administrator"> no available LDAP server found: Server is unavailable: Resource temporarily unavailable
Mai 27 21:51:42 frengel nslcd[674]: [45e146] <group/member="administrator"> no available LDAP server found: Server is unavailable: Resource temporarily unavailable
Mai 27 21:51:47 frengel nslcd[674]: [5f007c] <group/member="root"> no available LDAP server found: Server is unavailable
Mai 27 21:51:47 frengel nslcd[674]: [5f007c] <group/member="root"> no available LDAP server found: Server is unavailable
Mai 27 21:51:47 frengel nslcd[674]: [d062c2] <group/member="root"> no available LDAP server found: Server is unavailable
Mai 27 21:51:47 frengel nslcd[674]: [d062c2] <group/member="root"> no available LDAP server found: Server is unavailable

Fortunately both users are local. Situation after restart of nslcd:

● nslcd.service - LSB: LDAP connection daemon
  Loaded: loaded (/etc/init.d/nslcd)
  Active: active (running) since Mi 2015-05-27 21:53:40 CEST; 8s ago
  Process: 1118 ExecStop=/etc/init.d/nslcd stop (code=exited, status=0/SUCCESS)
  Process: 1132 ExecStart=/etc/init.d/nslcd start (code=exited, status=0/SUCCESS)
  CGroup: /system.slice/nslcd.service
          ├─1140 /usr/bin/k5start -b -p /var/run/nslcd/k5start_nslcd.pid -o nslcd -g nslcd -m 600 -f /etc/krb5.keytab -K 60 -u [email-masked] -k /var/run/nslcd/nslcd.tkt
          └─1143 /usr/sbin/nslcd

Mai 27 21:53:40 frengel nslcd[1132]: Starting Keep alive Kerberos ticket: k5start.
Mai 27 21:53:40 frengel nslcd[1143]: version 0.9.4 starting
Mai 27 21:53:40 frengel nslcd[1143]: accepting connections
Mai 27 21:53:40 frengel nslcd[1132]: Starting LDAP connection daemon: nslcd.

This is in the logs about k5start:

root@frengel:~# grep k5start /var/log/syslog
May 27 21:51:15 frengel nslcd[630]: Starting Keep alive Kerberos ticket: k5startk5start: error getting credentials: Cannot contact any KDC for realm 'AD.MICROSULT.DE'
May 27 21:53:40 frengel nslcd[1118]: Stopping Keep alive Kerberos ticket: k5startNo process in pidfile '/var/run/nslcd/k5start_nslcd.pid' found running; none killed.
May 27 21:53:40 frengel nslcd[1132]: Starting Keep alive Kerberos ticket: k5start.

It smells like the resolver is not up when k5start tries to figure out the KDC.
The system is configured by DHCP.

-- System Information:
Debian Release: 8.0
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages nslcd depends on:
ii  adduser                3.113+nmu3
ii  debconf [debconf-2.0]  1.5.56
ii  libc6                  2.19-18
ii  libgssapi-krb5-2       1.12.1+dfsg-19
ii  libldap-2.4-2          2.4.40+dfsg-1

Versions of packages nslcd recommends:
ii  bind9-host [host]           1:9.9.5.dfsg-9
ii  host                        1:9.9.5.dfsg-9
ii  ldap-utils                  2.4.40+dfsg-1
ii  libnss-ldapd [libnss-ldap]  0.9.4-3
ii  libpam-krb5                 4.6-3+b1
ii  libpam-ldapd [libpam-ldap]  0.9.4-3
pn  nscd                        <none>
ii  nslcd-utils                 0.9.4-3

Versions of packages nslcd suggests:
ii  kstart  4.1-3

-- Configuration Files:
/etc/default/nslcd changed:
K5START_PRINCIPAL="FRENGEL\[email-masked]"

-- debconf information:
  nslcd/ldap-bindpw: (password omitted)
  nslcd/ldap-cacertfile: /etc/ssl/certs/ca-certificates.crt
  nslcd/ldap-sasl-authzid:
  nslcd/ldap-reqcert:
  libraries/restart-without-asking: false
  nslcd/ldap-sasl-authcid:
  nslcd/ldap-binddn:
  nslcd/ldap-sasl-secprops:
  nslcd/restart-services:
  nslcd/ldap-auth-type: none
* nslcd/ldap-uris: ldap://ad.microsult.de
  nslcd/ldap-sasl-realm:
  nslcd/xdm-needs-restart:
  nslcd/ldap-starttls: false
  nslcd/disable-screensaver:
  nslcd/ldap-sasl-mech:
  nslcd/restart-failed:
* nslcd/ldap-base: DC=ad,DC=microsult,DC=de
  nslcd/ldap-sasl-krb5-ccname: /var/run/nslcd/nslcd.tkt