local users when ldap is down? (was: Re: libuser's LDAP support (was Re: LDAP Performance))

[Gordon Messmer]

Tommy McNeely wrote:
> heh, so is that how to properly hijack a thread :)
> 
> I question whether Red Hat (or linux in general) has fixed the problem 
> that I have experienced from 7.x all the way through 9 so far where if 
> the "ldap server" is unreachable, not even *local* users or root can 
> login. The system hangs while looking up group information appearantly? 
> I have seen little hacks in my bug reports, but have any of those been 
> implemented into the mainstream yet?

No, they haven't.  Edit /etc/pam.d/system-auth and change this line:

account     required      /lib/security/$ISA/pam_unix.so

It should read:

account     sufficient    /lib/security/$ISA/pam_unix.so

Simple fix, but a longstanding bug.  It's bug 55193:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=55193