Since nss-pam-ldapd 0.8.4 the uniqueMember attribute was replaced by
using the member attribute by default. This means that you should use

map group member sAMAccountName

https://lists.arthurdejong.org/nss-pam-ldapd-users/2017/msg00012.htmlSigned-off-by: Adam Wujek <adam.wujek@cern.ch>

This will keep the suid bit for:
--sudo
--screen
--ssh-keysign
Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

dropbear was replaced, because it does not support correctly LDAP+kerberos.

It was almost working. With LDAP+Kerberos over PAM dropbear was prompting once
more for a password when the correct was given.
Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

It is assumed that authorization is done via LDAP

No need to give extra password when using sudo
Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

otherwise openssh complains at the root login
Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

--nslcd does not support uniqueMember, comment it out:
map    group  uniqueMember     member
--run nslcd as root, remove gid and uid
Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

add:
--glibc
--libkrb5
--nss-pam-ldapd
--openldap
--linux-pam
Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Signed-off-by: Adam Wujek <adam.wujek@cern.ch>

Downloaded from:
https://linux.web.cern.ch/linux/docs/nslcd.conf.exampleSigned-off-by: Adam Wujek <adam.wujek@cern.ch>

1/ wr_date script:
- Started before PPSi
- Set number of NTP retries to 10 if GM otherwise 1. GM info is
extracted from dot-config
- Clock source is controlled directly with wr_date tool
- Can be started any time without any risk to set a wrong date (see
point 2)
2/ wr_date
- 'set host' parameters take into account the time mode ( FR: set
sec+ns, BC: time cannot be set, GM: set seconds only+wait to be in a
middle of a second)
- function substrat_substrat() moved to time_lib.h. Also used by wr_mon
3/ wr_mon
- Print TAI-UTC
- Update Timing Mode & PLL locking state displayed values

- Check if we are in GM mode, if yes :
    - wait GM to be locked
    - Disable WR as kernel clock source
    - Increase retries for NTP
- Retries x time NTP until setting host time:
    - Set date from host to WR
    - Enable (back) WR as kernel clock source

By doing this we force to read again the FPGA register inside the loop
     and the compiler can not skip this loop thinking he is reading the
same value (that was not modified by him).

Conflicts:
	userspace/tools/wr_date.c

Fix TAI offset into kernel was done withing get function but this has
been removed in commit #91f4c8d. As it is still needed by slave, we
force its use using -n option. This will only fix tai offset into kernel
without applying ToD to WR/FPGA time.

Conflicts:
	userspace/tools/wr_date.c

Use gmtime instead of localtime (TAI should never used localtime)
Add verbose option to also display linux time

The output will be something like:

wr_date -v diff
TAI(HW)-UTC(SW): +36.602286
UTC(HW)-UTC(SW): -0.397714

Conflicts:
	userspace/tools/wr_date.c

In the previous version `wr_date get` would override kernel TAI time
(using local file) and this could cause some problems in case leap
second from /etc/leap-seconds.list was not the same than from PTP/WR
protocol.