We recently had a minor outage on one of our systems. Users could no longer log in and users could no longer use a web GUI. The problem occurred sporadically and then disappeared again. During these times there were a lot of messages of the following types in the syslog:
Mar 4 07:56:05 aix01 daemon:err|error secldapclntd: LDAP failed to bind to server aixldapp11. Mar 4 07:56:05 aix01 daemon:err|error secldapclntd: LDAP failed to bind to server aixldapp12. Mar 4 07:56:10 aix01 daemon:err|error secldapclntd: LDAP failed to bind to server aixldapp11. Mar 4 07:56:10 aix01 daemon:err|error secldapclntd: LDAP failed to bind to server aixldapp12. ...
These messages indicated that both LDAP servers were temporarily unavailable. Investigations of the logs on the two LDAP servers did not reveal any connection attempts that were rejected. An examination of the firewall logs also showed that the firewall did not block any packets to the LDAP servers.
We then opened a case at IBM and promptly received instructions back for setting up special LDAP tracing. However, the problem then no longer occurred and therefore the tracing could not determine the cause.
The system in question can be reached via the Internet and therefore the number of ephemeral ports has been restricted for security reasons. Only about 1500 ephemeral ports are allowed through the firewall and configured on AIX (tcp_ephemeral_high and tcp_ephemeral_low). We then simulated on a test system what happens when the available ephemeral ports are exhausted. The above messages came immediately as soon as the LDAP client tried to open a new connection.
One reason for the LDAP client error message “LDAP failed to bind to server” can be the unavailability of ephemeral ports!