libnss_ldap.conf is not world-readable

[Sergey V. Udaltsov]

Binary package hint: libnss-ldap

I use ldap authentication. In order to check whether gnome-settings-daemon is allowed to access some system dbus services, dbus-daemon is trying to find out the details of the corresponding user. Since dbus-daemon runs as messagebus user (not root), it cannot read libnss_ldap.conf and fails the entire authentication process.

In my system, libnss_ldap.conf has permissions 600 while it should 644 (and it actually fixes failure at g-s-d startup).

[Gabriel Patiño (gepatino)]

I have a fresh edgy install and libnss_ldap.conf has permissions 644.

What version of ubuntu are you using?

If the file has permissions 600 and you run dpkg-reconfigure libnss-ldap, are permissions set to 644?

[Sergey V. Udaltsov (sergey-udaltsov)]

I have feisty, upgraded from edgy. I will try to rerun dpkg-reconfigure tonight and report.

[Sergey V. Udaltsov (sergey-udaltsov)]

From dpkg-reconfigure:
---
If you use passwords in your libnss-ldap configuration, it is usually a good idea to have the configuration set with mode 0600 (readable and writable only by the file's owner).

Note: As a sanity check, libnss-ldap will check if you have nscd installed and will only set the mode to 0600 if nscd is present.

Make the configuration file readable/writeable by its owner only?
---

So there is an option here to make it 600 or 644 - I do not really know what is the default value. Anyway, I think this bug can be closed - users have ability to make it 644 using dpkg-reconfigure (with some reasonable explanation). But before closing it - could you please make sure that default value is 644 so other people would not send you similar complains.

Thanks a lot for the help.

[Adam Niedling (krychek)]

Feisty is not supported anymore. Please reopen this report if this is still an issue in a later version of Ubuntu.