LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

4. Once logging is enabled, run the HP-UX commands or applications that exhibit the problem.
5. Restore the file /etc/syslog.confto its previous state to stop logging.
6. Restart the syslogdaemon with the following command: (Refer to syslogd(1M) for details.)
kill -HUP 'cat /var/run/syslog.pid'
7. Remove the debug options from /etc/pam.conf.
8. Examine the log file at /var/adm/syslog/debug.log to see what actions were performed
and if any are unexpected. Look for lines containing PAM.
TIP: Enable PAM logging only long enough to collect the data you need because logging can
significantly reduce performance and generate large log files.
You may want to move the existing log file and start with an empty file: mv
/var/adm/syslog/debug.log /var/adm/syslog/debug.log.save. Restore the file
when finish.
Restart the syslog daemon with the following command (Refer to syslogd(1M) for details.)
kill -HUP 'cat /var/run/syslog.pid'
Viewing Active Directory Service Log Files
You can view Active Directory event log files using the Windows 2000 or 2003 Event Viewer. To
start the viewer, click Start->Programs->Administrative Tools->EventViewer.
User Cannot Log on to Client System
If a user cannot log in to a client system, perform the following checks.
• Use a command like pwget(1) with -n, or nsquery(1)
2
to verify that NSS is working:
pwget -n username
nsquery passwd username
If the output shows LDAP is not being searched, check /etc/nsswitch.conf to make
sure LDAP is specified. If username is not found, make sure that user is in the directory and,
if using a proxy user, make sure the proxy user is properly configured.
If nsquery(1) displays the user's information, make sure/etc/pam.conf is configured
correctly for Kerberos. If/etc/pam.conf is configured correctly, check the directory's
policy management status. It could be the directory's policy management is preventing the
bind because, for example the user's password has expired or the login retry limit has been
exceeded. To check this try an ldapsearch command and bind as the user, for example:
cd /opt/ldapux/bin
./ldapsearch -h servername -b "CN=Users,DC=cup,DC=hp,DC=com"
msSFUName=username -D <directory Administrator DN> -w passwd
./ldapsearch -h servername -b "CN=Users,DC=cup,DC=hp,DC=com"
-D userDN" -w passwd msSFUName=username
where userDN is the DN of the user who cannot log in and username is the login of the user.
If you cannot bind as the user, check if any directory policies are preventing access.
See below for an example of determining the user's bind DN.
• Display the current configuration profile and check all the values to make sure they are as
you expect:
cd /opt/ldapux/config
./display_profile_cache
2. nsquery(1) is a contributed tool included with the ONC/NFS product.
Troubleshooting 147