IBM AIX 7.2 – Common Problem 135 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

`lsuser ALL` returns `3004-687` and SSH logins via LDAP fall back to local users.

Environment & Reproduction

AIX 7.2 client bound to AD or IBM Directory Server with `ldap.cfg` and `secldapclntd`.

Root Cause Analysis

`secldapclntd` lost its bind because of expired TLS certificate or rotated bind DN password.

Quick Triage

Check `lssec -f /etc/security/ldap/ldap.cfg -s server -a bindpwd` and `ls-secldapclntd`.

Step-by-Step Diagnosis

Run `ldapsearch -h -D -w -b uid=root` to test bind.

Solution – Primary Fix

Refresh credentials: `mksecldap -c -h -a -p ` and `restart-secldapclntd`.

Solution – Alternative Approaches

Rotate to LDAPS with `ldap.cfg` `usessl=YES` and re-import the CA into `gskcapicmd`.

Verification & Acceptance Criteria

`lsuser -R LDAP ALL` lists directory users and `id ` resolves on the AIX host.

Rollback Plan

Stop `secldapclntd` and reset `/usr/lib/security/methods.cfg` to local-only as fallback.

Prevention & Hardening

Monitor `secldapclntd` via `errnotify` and pre-stage CA renewals before expiry.

Related Errors & Cross-Refs

Related to `secldapclntd` core dumps and `loginrestrictions` LDAP module errors.

Related tutorial: View the step-by-step tutorial for aix-7.2.

View all aix-7.2 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM Docs: AIX LDAP client integration, `mksecldap`, `secldapclntd`.