sssd-users November 2012

sssd-users@lists.fedorahosted.org

14 participants
16 discussions

netgroups alternative?
by Ondrej Valousek 09 Nov '12

09 Nov '12

Hi List, Quick question (maybe not the right one for this list). Is there any alternative for netgroups in Linux? I mean netgroups are tightly bound to NIS which is insecure piece of crap so I wonder if there is any new alternative which should (can) be used in any new deployment. Thanks! Ondrej

5 6

Multi-domain logon problem
by Bolesław Tokarski 09 Nov '12

09 Nov '12

Hello, I stumbled upon a problem that I believe to be a bug, but perhaps I am wrong. Basically what happens is that if I have a line in /etc/hosts: 127.0.1.1 machine1.europe.example.com machine1 then I can only log in from europe.example.com domain. I reported this as: https://fedorahosted.org/sssd/ticket/1633 but perhaps this is a 'feature'? That sssd resolves the current machine domain and only allows to log in from this domain? Cheers, Ballock

3 3

SSSD 1.8.0-32 and AD with RHEL6
by James Chambers 09 Nov '12

09 Nov '12

Hello, I was told by a user in linuxquestions.org to try this list for help. So we've been trying to get SSSD working with AD on RHEL 6 for about a week now. we've been trying to following http://www.redhat.com/resourcelibrary/reference-architectures/integrating-r… As 1.8.0-32 is part of the latest install of RHEL 6, that's the version we need to use. We can get configuration number 6.4 kerboros/ldap working just fine and SSH with that, but we want option 6.3 SSSD/kerboros/ldap for the caching features. When 6.3 option is enabled, we can do a ldapsearch just fine with ldapsearch -Y GSSAPI -N "(sAMAccountName=username)" It's when we try to SSH on the server is when we are unable to get it to work. We do ssh -vvvv username@servername and get a permission denied when we do the password In /var/log/messages we get: GSSAPI Error: Unspecified GSS failure. Minor code may prove more information (Matching credential not found) In /var/log/secure, we get: Invalid user username from ipaddress input_userauth_request: invalid user username pam_unix(sshd:auth): check pass; user unknown pam_unix(sshd:auth: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=servername pam_succeed_if(sshd:auth): error retriving information about user username Failed password for invalid user username from ipaddress port portid SSH2 Here is the /var/sssd/sssd.conf file: [sssd] services = nss, pam config_file_version = 2 debug_level = 9 domains = default [nss] [pam] [domain/default] debug_level = 9 enumerate = false id_provider = ldap chpass_provider = krb5 case_sensitive = false ldap_uri = ldap://ldapservername.domain.domain.domain ldap_search_base = dc=domain,dc=domain,dc=domain ldap_user_search_base = dc=domain,dc=domain,dc=domain ldap_group_search_base = dc=domain,dc=domain,dc=domain ldap_id_use_start_tls = true ldap_schema = rfc2307bis ldap_sasl_mech = GSSAPI ldap_force_upper_case_realm = true ldap_krb5_keytab = /etc/krb5.keytab ldap_sasl_authid = host/servername.domain.domain.domain(a)DOMAIN.DOMAIN.DOMAIN auth_provider = krb5 cache_credentials = true krb5_realm = DOMAIN.DOMAIN.DOMAIN krb5_server = ldapservername.DOMAIN.DOMAIN.DOMAIN krb5_ccachedir = /tmp krb5_auth_timeout = 15 ldap_user_object_class = user ldap_user_modify_timestamp = whenChanged ldap_user_home_directory = unixHomeDirectory ldap_user_princical = userPrincipalName ldap_user_name = sAMAccountName ldap_user_shell = loginShell ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_group_object_class = group ldap_group_modify_timestamp = whenChanged ldap_group_name = sAMAccountName ldap_group_gid_number = gidNumber krb5_kpasswd = ldapservername.domain.domain.domain access_provider = ldap ldap_access_order = expire ldap_account_expire_policy = ad ldap_tls_cacertdir = /etc/openldap/cacerts ldap_disable_referrals = true [sudo] [autofs] [ssh] I've tried changing around access_provider to simple or permit and it didn't work. I tried added ladp_access_filter to allow my id and tried objectClass=user and it didn't work. I modified the sssd.conf file based on another one I found at zews.org/rhel6-active-directory Here is the password_auth file: auth required pam_env.so auth sufficient pam.unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry_3 type= password sufficient pam_unix.so shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so nsswitch.conf has the following: passwd: files sss shadow: files sss group: files sss ldap_child.log gives me the following: [unpack_buffer] (0x1000): total buffer size 94 [unpack_buffer] (0x1000): realm_str size: 15 [unpack_buffer] (0x1000): got realm_str: DOMAIN.DOMAIN.DOMAIN [unpack_buffer] (0x1000): princ_str size: 47 [unpack_buffer] (0x1000): got princ_str: host/server.domain.domain.domain(a)DOMAIN.DOMAIN.DOMAIN [unpack_buffer] (0x1000): keytab_name size = 16 [unpack_buffer] (0x1000): got keytab_name: /etc/krb5.keytab [unpack_buffer] (0x1000): lifetime: 86400 [ldap_child_get_tgt_sync] (0x0100): Principal name is: [host/server.domain.domain.domain(a)DOMAIN.DOMAIN.DOMAIN] That's it. The AD side sees that we are doing the query and doesn't see anything on their end in terms of errors and such. At a loss right now on what configuration we are doing wrong that works with option 6.3. We have a working key tab for kerboros. We know we can see AD with ldapsearch. We just can't get it to work with SSSD and SSH.

2 1

sssd 1.9.2 & autofs & AD does not work
by Ondrej Valousek 09 Nov '12

09 Nov '12

Hi, I am using sssd 1.9.2 with AD provider and I would like to use it for autofs support, too. Unfortunately 'autofs_provider = ad' is not working at all. I tried 'autofs_provider = ldap', it tries to search for maps, but eventually it fails as well: (Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_autofs_handler] (0x0200): Requested refresh for: auto.master (Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_get_automntmap_next_base] (0x0400): Searching for automount maps with base [CN=dublin,xxx] (Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(nisMapName=auto.master)(objectclass=nisMap))][CN=dublin,xxx]. (Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_autofs_setautomntent_done] (0x0040): sdap_get_automntmap_recv failed [5]: Input/output error Is this configuration supported please? Thanks, Ondrej

2 2

Re: [SSSD-users] startup problem/port status 0
by Longina Przybyszewska 08 Nov '12

08 Nov '12

Hi again, Thanks a lot for guiding me so far :) I have got sssd-1.9.2 package from Timo, Ubuntu sssd package maintainer for Ubuntu Quantal. SSSD is configured against AD as auth/id - provider sssd.conf [sssd] debug_level = 0x1310 config_file_version = 2 services = nss, pam domains = nat.c.sdu.dk [nss] filter_groups = root filter_users = root [pam] [domain/nat.c.sdu.dk] debug_level = 0x1310 enumerate = False min_id = 1000 max_id = 20000 auth_provider = ad id_provider = ad access_provider = ad chpass_provider = ad ad_server = nat.c.sdu.dk ad_hostname = testina4$.nat.c.sdu.dk ad_domain = nat.c.sdu.dk From log: (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [be_resolve_server_process] (0x0200): Found address for server nat.c.sdu.dk: [10.144.5.18] TTL 455 (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: testina4$ (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_set_port_status] (0x0100): Marking port 0 of server 'nat.c.sdu.dk' as 'not working (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_server_status] (0x1000): Status of server 'nat.c.sdu.dk' is 'name resolved' (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_port_status] (0x1000): Port status of port 0 for server 'nat.c.sdu.dk' is 'not working' (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5 (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 1,11,Offline (Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.NAT.C.SDU.DK], [2][No such file or directory ----- The error "port status of port 0 .." is not working - jumps out. Testina4 is my linux host, joined to the AD by msktutils application - but maybe it hasn't get enough permissions granted to make a query in domain??? root@testina4:/etc/sssd# klist -e -k Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 13 testina4$(a)NAT.C.SDU.DK (arcfour-hmac) 13 testina4$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 13 testina4$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 14 testina4$(a)NAT.C.SDU.DK (arcfour-hmac) 14 testina4$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 14 testina4$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 14 host/testina4(a)NAT.C.SDU.DK (arcfour-hmac) 14 host/testina4(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 14 host/testina4(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 9 testina4$(a)NAT.C.SDU.DK (arcfour-hmac) 9 testina4$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 9 testina4$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) I can get object data for 'testina4' and AD 'imadatestuser' from command line run from 'testina4' (after I run kinit as AD adminuser) : ldapsearch -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI -b 'ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=computer)(name=testina4))' # extended LDIF # # LDAPv3 # base <ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk> with scope subtree # filter: (&(objectClass=computer)(name=testina4)) # requesting: ALL # with pagedResults control: size=1000 # # testina4, Linux computers, ADResources, nat.c.sdu.dk dn: CN=testina4,OU=Linux computers,OU=ADResources,DC=nat,DC=c,DC=sdu,DC=dk objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user objectClass: computer cn: testina4 distinguishedName: CN=testina4,OU=Linux computers,OU=ADResources,DC=nat,DC=c,D C=sdu,DC=dk instanceType: 4 whenCreated: 20121019130319.0Z whenChanged: 20121105144001.0Z uSNCreated: 158837247 uSNChanged: 161473679 name: testina4 objectGUID:: os+KTql470WRz9dZ/6U3Tw== userAccountControl: 4096 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 129959868084813523 lastLogoff: 0 lastLogon: 129966788793794911 localPolicyFlags: 0 pwdLastSet: 129959870279509463 primaryGroupID: 515 objectSid:: AQUAAAAAAAUVAAAANYoCGg16WjOCi6YoRy4AAA== accountExpires: 9223372036854775807 logonCount: 42 sAMAccountName: testina4$ sAMAccountType: 805306369 dNSHostName: testina4.nat.c.sdu.dk servicePrincipalName: host/testina4 objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=c,DC=sdu,DC=dk isCriticalSystemObject: FALSE dSCorePropagationData: 16010101000000.0Z lastLogonTimestamp: 129966000010645525 msDS-SupportedEncryptionTypes: 28 # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.319 false MIQAAAAFAgEABAA= pagedresults: cookie= # numResponses: 2 # numEntries: 1 alongina@testina4:~$ ldapsearch -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI -b 'ou=ADusers,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=person)(sAMAccountName=imadatestuser))' SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired) alongina@testina4:~$ kinit Password for alongina(a)NAT.C.SDU.DK: alongina@testina4:~$ ldapsearch -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI -b 'ou=ADusers,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=person)(sAMAccountName=imadatestuser))' SASL/GSSAPI authentication started SASL username: alongina(a)NAT.C.SDU.DK SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <ou=ADusers,dc=nat,dc=c,dc=sdu,dc=dk> with scope subtree # filter: (&(objectClass=person)(sAMAccountName=imadatestuser)) # requesting: ALL # with pagedResults control: size=1000 # # IMADAtest Testesen, Odense, Institut for Matematik og Datalogi, ADUsers, na t.c.sdu.dk dn: CN=IMADAtest Testesen,OU=Odense,OU=Institut for Matematik og Datalogi,OU=A DUsers,DC=nat,DC=c,DC=sdu,DC=dk objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: IMADAtest Testesen sn: Testesen l: Odense M title: Professor postalCode: 5230 givenName: IMADAtest distinguishedName: CN=IMADAtest Testesen,OU=Odense,OU=Institut for Matematik o g Datalogi,OU=ADUsers,DC=nat,DC=c,DC=sdu,DC=dk instanceType: 4 whenCreated: 20091005131413.0Z whenChanged: 20121019141347.0Z displayName: IMADAtest Testesen uSNCreated: 20103944 memberOf:: Q049Y29tbW9uX3VzZXJzLE9VPUbDpmxsZXMsT1U9SW5zdGl0dXR0ZXIsT1U9QURHcm9 1cHMsREM9bmF0LERDPWMsREM9c2R1LERDPWRr memberOf:: Q049bmF0LWxlY3R1cmVzLE9VPUbDpmxsZXMsT1U9SW5zdGl0dXR0ZXIsT1U9QURHcm9 1cHMsREM9bmF0LERDPWMsREM9c2R1LERDPWRr memberOf: CN=Imada-terminal-users,OU=Institut for Matematik og Datalogi (IMADA ),OU=Institutter,OU=ADGroups,DC=nat,DC=c,DC=sdu,DC=dk uSNChanged: 117297654 department: Institut for Matematik og Datalogi name: IMADAtest Testesen objectGUID:: xevmnsllekOUPs5dy6xBUw== userAccountControl: 512 badPwdCount: 0 codePage: 0 countryCode: 0 homeDirectory: \\sdu-data0.c.sdu.dk\staff\imadatestuser homeDrive: M: badPasswordTime: 129951292226925867 lastLogoff: 0 lastLogon: 129951296097614099 logonHours:: //////////////////////////// pwdLastSet: 129951295698649008 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAANYoCGg16WjOCi6YolSgAAA== accountExpires: 0 logonCount: 1 sAMAccountName: imadatestuser sAMAccountType: 805306368 userPrincipalName: imadatestuser(a)nat.c.sdu.dk objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=c,DC=sdu,DC=dk dSCorePropagationData: 20121026084647.0Z dSCorePropagationData: 20120525083005.0Z dSCorePropagationData: 20120328164019.0Z dSCorePropagationData: 20111214110440.0Z dSCorePropagationData: 16010714223649.0Z lastLogonTimestamp: 129951296097540185 unixHomeDirectory: /home/imadatestuser # search result search: 4 result: 0 Success control: 1.2.840.113556.1.4.319 false MIQAAAAFAgEABAA= pagedresults: cookie= # numResponses: 2 # numEntries: 1 Longina -----Original Message----- From: Stephen Gallagher [mailto:sgallagh@redhat.com] Sent: 26. oktober 2012 15:22 To: End-user discussions about the System Security Services Daemon Cc: Longina Przybyszewska; Timo Aaltonen Subject: Re: [SSSD-users] startup problem On Fri 26 Oct 2012 09:15:16 AM EDT, Longina Przybyszewska wrote: > I have compiled 1.9.2 version and installed in the /usr/local/ > > This way the other programs cant' use the new libraries > > The preferable way would be installing in the same places as native package would do. > > The native version In Ubuntu-quantal is 1.9.1 so the worse case > would be event. regular upgrade to 1.9.2 some day. > > What are the relevant install options to 'configure' ? > SSSD has some pieces that *must* be in the standard locations or it will not function properly. These are the nss_sss.so.2 NSS libraries and the pam_sss.so PAM library. If you are not familiar with packaging, you might have better luck coordinating with Timo Aaltonen, the Ubuntu/Debian maintainer for SSSD. I believe he keeps an Ubuntu PPA with the latest bits somewhere. CCing him on the conversation.

2 4

libsss_autofs & rhel-x86_64-server-optional-6 repo
by Ondrej Valousek 02 Nov '12

02 Nov '12

Hi, Is there any reasoning why is the library libsss_autofs: 1. not installed automatically along with autofs (the lookup_sss.so module, an integral part of autofs, is not functioning without this library) 2. If there is a reason for it, then why is it put in the optional repo? I mean, both sssd and autofs are in the main stream repo so I do not quite understand why is just this library in the optional repo. Thanks! Ondrej

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users November 2012