Strange LDAP searches for time, IP address and system users

[MI <mi.lists.ldap@alma.ch>]

I see very strange searches in my slapd.log, and wonder what I my have misconfigured.

On every SSH connection (with ssh key, not password) :

Search for the TTY:

    slapd[3183]: conn=1000 op=307 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 
filter="(&(objectClass=posixAccount)(uid=pts/2))"
    slapd[3183]: conn=1000 op=307 SRCH attr=uid userPassword uidNumber gidNumber cn 
homeDirectory loginShell gecos description objectClass

For the date:

    slapd[3183]: conn=1000 op=308 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 
filter="(&(objectClass=posixAccount)(uid=2015-12-03))"

The time:

    slapd[3183]: conn=1000 op=309 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 
filter="(&(objectClass=posixAccount)(uid=16:28))"

The IP:

    slapd[3183]: conn=1000 op=310 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 
filter="(&(objectClass=posixAccount)(uid=\28192.168.99.206\29))"


(But I don't see "uid=root" when logging in over SSH with a key.)

I wouldn't expect to see a search for "root", since it's a system account, and I use 
a key, so I would expect LDAP to be completely out of the picture.

However, I do see many searches in the logs for other system accounts:

    filter="(&(objectClass=posixAccount)(uid=www-data))"
    filter="(&(objectClass=posixAccount)(uid=man))"
    filter="(&(objectClass=posixAccount)(uid=root))"
    filter="(&(objectClass=posixAccount)(uid=postfix))"
    filter="(&(objectClass=posixAccount)(uid=debian-spamd))"
    filter="(&(objectClass=posixAccount)(uid=amavis))"
    filter="(&(objectClass=posixAccount)(uid=\2A))"
    ...

Most seem to be triggered by the standard system cron jobs or service restarts etc.


The system is Debian 8.2 "Jessie". The following packages related to ldap or pam are 
installed:

    ldap-utils                        2.4.40+dfsg-1+deb8u1
    libaprutil1-ldap:amd64            1.5.4-1
    libldap-2.4-2:amd64               2.4.40+dfsg-1+deb8u1
    libnss-ldap:amd64                 265-3+b1
    libpam0g:amd64                    1.1.8-3.1
    libpam-ldap:amd64                 184-8.7+b1
    libpam-modules:amd64              1.1.8-3.1
    libpam-modules-bin                1.1.8-3.1
    libpam-runtime                    1.1.8-3.1
    nscd                              2.19-18+deb8u1
    slapd                             2.4.40+dfsg-1+deb8u1


At this point, it's difficult for me to know what may be relevant, so I'm afraid I 
have to paste a lot of stuff here in the hope that it includes some clue for someone...

# egrep 'cache|check' /etc/nscd.conf
    enable-cache        passwd        yes
    check-files         passwd        yes
    enable-cache        group        yes
    check-files         group        yes
    enable-cache        hosts        yes
    check-files         hosts        yes
    enable-cache        services    yes
    check-files         services    yes
    enable-cache        netgroup    yes
    check-files         netgroup    yes

# grep ldap /etc/nsswitch.conf
passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap

# listconf /etc/pam_ldap.conf
host 127.0.0.1
base dc=mydomain,dc=lan
ldap_version 3
rootbinddn cn=admin,dc=mydomain,dc=lan
pam_password crypt

# listconf /etc/pam.d/common-auth
auth    [success=2 default=ignore]    pam_unix.so nullok_secure
auth    [success=1 default=ignore]    pam_ldap.so use_first_pass
auth    requisite            pam_deny.so
auth    required            pam_permit.so

# listconf /etc/pam.d/common-account
account    [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so
account    [success=1 default=ignore]    pam_ldap.so
account    requisite            pam_deny.so
account    required            pam_permit.so

# listconf /etc/pam.d/common-password
password    [success=2 default=ignore]    pam_unix.so obscure sha512
password    [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok 
try_first_pass
password    requisite            pam_deny.so
password    required            pam_permit.so

# listconf /etc/pam.d/common-session
session    [default=1]            pam_permit.so
session    requisite            pam_deny.so
session    required            pam_permit.so
session    required    pam_unix.so
session    optional            pam_ldap.so


My LDAP olcLogLevel is "filter stats sync". Please let me know if the other lines of 
that log may be useful, or if other log levels should be enabled (I tried, but didn't 
notice anything interesting).

Well, if you have read so far, now is the time to tell me that this is all useless 
and that I should have posted that other essential config file which I missed ... :-)

Thanks for any help in solving this mystery,

MI