Upgrade from 10.04 to 12.04 server breaks configuration of nslcd

There recently were a few bugs regarding upgrades (some fixed) in Debian, see:
  http://bugs.debian.org/670133
  http://bugs.debian.org/672301
Perhaps this is a duplicate of one of these bugs?

It would be helpful if you could post versions of nslcd before and after the upgrade and the contents of nslcd.conf.

http://bugs.debian.org/670133 describes exactly what I experienced.

If this is useful for Ubuntu, I can prepare a patch, although I would recommend against using 0.8.4 in a stable release because the 0.8 series is still in development (but now reaching stability with 0.8.8-3).

Hi Arthur,

If you prepare a patch you'll want to attach additional SRU information to the bug ticket for this to go into Precise.

https://wiki.ubuntu.com/StableReleaseUpdates#SRU_Bug_Template

It just happened again. The upgrade to nslcd / libnss-ldapd version 0.8.4ubuntu0.1 released on 2012-06-29 broke my setup again. The directives binddn and bindpw in /etc/nslcd.conf were both commented out and the password in bindpw was replaced with the string *removed*.

On Sun, 2012-07-01 at 05:29 +0000, William Van Hevelingen wrote:
> If you prepare a patch you'll want to attach additional SRU
> information to the bug ticket for this to go into Precise.

Ok, here is my best shot at this.

[IMPACT]

This bug affects people who use a mix of debconf and manual
configuration of the nslcd.conf file or possibly people who are
upgrading from an earlier release that does not include the
ldap-auth-type debconf configuration setting (there could be more
cases).

This breaks LDAP authentication on upgrades quietly removing LDAP users
from the system and will break it again if the package is
upgraded/reinstalled.

[TESTCASE]

The easiest way to trigger the underlying bug is to use debconf to
configure no authentication, then change the config by hand with the
binddn and bindpw options and then reinstall or upgrade.

apt-get purge nslcd
apt-get install libnss-ldapd nslcd
[with debconf choose no authentication]
[edit /etc/nslcd.conf and set binddn and bindpw]
[restart nslcd and verify that getent passwd returns LDAP users]
apt-get --reinstall install nslcd

You need an LDAP server to test this obviously.

[Regression Potential]

This fix was in Debian unstable (#670133, fixed in 0.8.8-1) and has not
seen any regressions so far. The change could have an affect for debconf
preseeding which is quite complex to do right.

Preconfiguring nslcd is much simpler when pre-installing an nslcd.conf
file (which will be preserved on installation) although debconf
preseeding should work for most configurations.

[Other Info]

While the attached patch fixes this bug it is probably a much better
idea to ship 0.8.10 which is targeted towards the next Debian stable
release. It is much better tested and fixes a number of known bugs in de
0.8.4 version which was never meant for production use.

An overview of the most important packaging changes from 0.8.4 to
0.8.10:

  * consistently handle whitespace in configuration file during package
    configuration (thanks Nick) (closes: #641619)
  * add a versioned dependency on libpam0g to ensure the PAM
    libraries are multiarch-aware
  * in debconf, treat the "hard" value for tls_reqcert as if it was
    "demand" (closes: #642347)
  * keep nslcd running during package upgrades (closes: #644892)
  * enable hardening options during build
  * automatically comment out mapping of uniqueMember to member on
    upgrades because member is default now
  * update the X-Start-Before header in the init script to ensure that
    nslcd is started before the display managers
  * use the configuration file contents to determine the authentication
    type, not the debconf database (closes: #670133) (LP: #1000205)
  * don't clear the tls_reqcert option when using ssl without the
    start_tls option or an ldaps:// URL (closes: #672301)

An overview of the most important upstream changes from 0.8.4 to 0.8.10:

  * support larger gecos values (closes: #640781)
  * reduce loglevel of user not found messages to avoid spamming the
    logs with useless information (thanks Wakko Warner)
    (closes: #641820)
  * fix an issue where changes in /etc/nsswitch.conf were not correctly
    picked up and could lead to loo...

The attachment "nss-pam-ldapd-fix-debconf-authentication-0.8.4.patch" of this bug report has been identified as being a patch in the form of a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-sponsors team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

This is presumably fixed in quantal as it has version 0.8.10 in it.

I've uploaded the debdiff to precise-proposed and it is now awaiting approval from a member of the SRU team.

Reverting the precise task to In Progress, Fix Commited is for packages that are in the -proposed pocket, this package is still in the Unapproved queue.

Hello Wolfram, or anyone else affected,

Accepted nss-pam-ldapd into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/nss-pam-ldapd/0.8.4ubuntu0.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I can verify that nss-pam-ldapd 0.8.4ubuntu.02 fixes the problem.

Verification procedure:

1. Added precise-proposed repository
2. apt-get install -t precise-proposed nslcd libnss-ldapd
3. verify the contents of /etc/nslcd.conf -> unchanged
4. log in to the system with ldap account -> still works

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

This bug was fixed in the package nss-pam-ldapd - 0.8.4ubuntu0.2

---------------
nss-pam-ldapd (0.8.4ubuntu0.2) precise-proposed; urgency=low

  * use the configuration file contents to determine the authentication
    type, not the debconf database (closes: #670133) (LP: #1000205)
 -- Arthur de Jong <email address hidden> Wed, 18 Jul 2012 12:36:45 -0700