sssd-users July 2012

sssd-users@lists.fedorahosted.org

9 participants
4 discussions

sssd cache statistics?
by Olaf Gellert 31 Jul '12

31 Jul '12

Hi there, is there anything in place to get statistics of the cache usage of sssd? With "nscd" you could run "nscd -g" to get this, would be a nice feature. Did not find anything in the man pages nor any extra tool or command line option. Olaf -- Olaf Gellert email gellert(a)dkrz.de Deutsches Klimarechenzentrum GmbH phone +49 (0)40 460094 214 Bundesstrasse 45a fax +49 (0)40 460094 270 D-20146 Hamburg, Germany www http://www.dkrz.de Sitz der Gesellschaft: Hamburg Geschäftsführer: Prof. Dr. Thomas Ludwig Registergericht: Amtsgericht Hamburg, HRB 39784

3 3

sssd and netgroups
by Olaf Gellert 31 Jul '12

31 Jul '12

Hi there, I am new to sssd. I have setup a CentOS sssd (1.8.0) and LDAP authentication. The LDAP stuff seems to work. I want to restrict logins to users of certain netgroups. Usually we do this with "compat" in /etc/nsswitch.conf and entries like "+@groupname" in /etc/passwd. Does this mechanism work with sssd? Right now I have: passwd: files sss shadow: files sss group: files sss and it seems that all users from the users LDAP subtree could login, "getent passwd" shows all LDAP users. If I change this to passwd: compat shadow: compat group: compat passwd_compat: sss group_compat: sss "getent passwd" only shows local users from the passwd file. Thanks for any help, Olaf -- Olaf Gellert email gellert(a)dkrz.de Deutsches Klimarechenzentrum GmbH phone +49 (0)40 460094 214 Bundesstrasse 45a fax +49 (0)40 460094 270 D-20146 Hamburg, Germany www http://www.dkrz.de Sitz der Gesellschaft: Hamburg Geschäftsführer: Prof. Dr. Thomas Ludwig Registergericht: Amtsgericht Hamburg, HRB 39784

4 5

AD Server 2008r2, Sasl, encoded packet size too big
by David Warden 19 Jul '12

19 Jul '12

Following https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%2… on Oracle Linux (RHEL clone) 6.3, 64-bit, sssd version 1.8.0 gets us all the way to the point where we can kinit with /etc/krb5.keytab and successfully run the test ldapsearch command. When we start sssd and try getent on a user in AD we get this to /var/log/messages: "Jul 18 14:58:44 wardentest3 sssd_be: encoded packet size too big (813957120 > 16777215)" Setting debug_level to 0x7850 (the highest, I believe) doesn't yield any additional helpful info. I did deviate a bit from the SSSD/AD document in that I did not bind the host but instead created a keytab for a generic user we use to give our linux hosts access to LDAP on AD. I didn't think this would be a problem since the kinit/ldapsearch test worked fine. Here's the safe bits of our keytab (we're using mailuser(a)W2K.GENESEO.EDU as our principal): Keytab name: WRFILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 25 HOST/mail.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 HOST/mailtest.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 IMAP/mail.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 IMAP/mailtest.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 SMTP/mail.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 SMTP/mailtest.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 HTTP/mail.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 HTTP/mailtest.geneseo.edu(a)W2K.GENESEO.EDU (arcfour-hmac) 25 mailuser(a)W2K.GENESEO.EDU (arcfour-hmac) Google searches seemed to indicate that this may be some kind of sasl issue and possibly out of SSSD's control. Has anyone experience a similar problem or have advice on what to try? -- David Warden Mail Administrator State University of New York at Geneseo "There's only one rule that I know of, babies—God damn it, you've got to be kind."

4 10

server side password policy error
by Angel Bosch 06 Jul '12

06 Jul '12

hi, my journey to server policies has begun. I'm testing with a single user. I get warning but I can't change password: ####################################################################### Last login: Mon Jul 2 12:11:07 2012 from a4badba022d5.example.net WARNING: Your password has expired. You must change your password now and login again! Current Password: passwd: Authentication token manipulation error passwd: password unchanged Connection to cprli0554 closed. e10000@cprli0555:~$ ####################################################################### relevant info in logs: ####################################################################### (Mon Jul 2 12:15:29 2012) [sssd[be[example.net]]] [sdap_pam_chpass_handler] (0x0040): starting password change request for user [a10023]. (Mon Jul 2 12:15:29 2012) [sssd[be[example.net]]] [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, <NULL>) [Internal Error (System error)] (Mon Jul 2 12:15:29 2012) [sssd[be[example.net]]] [be_pam_handler_callback] (0x0100): Sending result [4][example.net] (Mon Jul 2 12:15:29 2012) [sssd[be[example.net]]] [be_pam_handler_callback] (0x0100): Sent result [4][example.net] (Mon Jul 2 12:15:29 2012) [sssd[be[example.net]]] [be_pam_handler] (0x0100): Got request with the following data ####################################################################### What I I'm missing? Ask for further info if you need it, àngel

3 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users July 2012