Logons very slow when using Winbind+AD group enumeration is configured and pam_listfile.so is used to allow only specific set of users and groups.

Solution Unverified - Updated -

Issue

  • The current version of pam_listfile is basically broken in modern environments, as it checks for group membership by enumerating the membership of every group on the system and looking to see if the given user is in it.

  • That doesn't really scale in an enterprise environment with tens of thousands of groups.

Environment

  • Red Hat Enterprise Linux 5 Update 4
  • pam-0.99.6.2-6.el5

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.