Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • Are your users in /etc/passwd or though some other authentication scheme? It appears that lastlog uses the password file, not getent. Commented Jul 26, 2022 at 16:02
  • More correctly, /etc/passwd is used when a uid range is specified. getent is used when a username is specified. Commented Jul 26, 2022 at 16:26
  • The users I am interested in come from LDAP and are not in /etc/passwd, but using a range to obtain them worked up until recently (a CentOS update may however have changed things). Do you have a source for the information about /etc/passwd being used with a uid range? Commented Jul 27, 2022 at 6:35
  • I ran strace lastlog -u 1000- to look at system calls. I might have misread the trace. I use sssd to authenticate against AD and I do see the sss socket being opened. I have enumerate turned off so a uid search would not turn up anything. Have you changed your ldap configuration recently? Commented Jul 27, 2022 at 12:36
  • As far as I know the LDAP config hasn't changed recently. I now realize that specifying a range means that the actual existing UID have to be looked up somewhere before the lastlog database can be queried. Weirdly everything is working correctly on a second similarly configured server (see also unix.stackexchange.com/questions/712138/…). Commented Aug 2, 2022 at 13:20