Novell Home

My Favorites

Close

Please to see your favorites.

eDirectory root server hit by useless LDAP searches from ZCM-managed SLES servers

This document (7013258) is provided subject to the disclaimer at the end of this document.

Environment


NetIQ eDirectory
Novell Open Enterprise Server 2 (OES 2) Linux Support Pack 3

Situation

While diagnosing utilization and performance issues on a OES2 SP3 server holding the [Root] of a large tree, numerous searches (over 5,000 in a 10 minute trace) for Posix objects were seen in LDAP traces. These took the form

1689246016 LDAP: [2013/07/04 13:42:35.622] (10.59.0.100:51064)(0x0266:0x63) Search request:
base: "o=XXX"
scope:2  dereference:0  sizelimit:1  timelimit:0  attrsonly:0
filter: "(&(objectClass=posixAccount)(uid=root))"
no attributes

The searches were looking for a specific object uid=root (which did not exist) with a scope that was effectively the entire tree. The IP addresses they came from were the customer's branch SLES servers managed by ZCM. Suspicion fell on ZCM, but there was no known reason why it should trigger such searches.

Resolution

These are the changes made to silence the excessive requests made. The default SLES configuration was to contact the LDAP server for searches prior to local server.  Editing nsswitch.conf changed the order of the search. The changes made to the SLES servers were:

*   Execute visudo  (Rem out references to any group that refers to a Group in the Edirectory Tree.  Actually rem out any unnecessary Group or User references.)

*   vi /etc/nsswitch.conf  (Place the parameter "files" into the lines below)

passwd: files compat
group:  files compat

passwd_compat:  files ldap
group_compat:   files ldap

Cause

The customer's standard SLES server build referenced the eDirectory server in its /etc/ldap.conf file.  This was probably the result of a question asking to provide an LDAP server during the server build.

The excessive LDAP requests commenced after Nagios was installed on the branch SLES servers.  Nagios runs various queries or scripts regularly.  Each query requires elevated permissions, so the "Sudoers" file is interrogated.  Each time this occurred the LDAP server referenced in /etc/ldap.conf was contacted, and a search of the eDirectory Tree was conducted for the "root" user, and a Group that was configured in the Sudoers file.

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7013258
  • Creation Date:11-SEP-13
  • Modified Date:11-SEP-13
    • NovellOpen Enterprise Server
    • NetIQeDirectory

Did this document solve your problem? Provide Feedback