sssd-users March 2014

sssd-users@lists.fedorahosted.org

10 participants
6 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

SSSD + SSH Invalid Credentials
by Kevin Sullivan 26 Mar '14

26 Mar '14

I am pretty sure that invalid credentials means that I am typing in the incorrect password, but I promise I am not. I am having an issue where I cannot ssh as a user that is stored in LDAP. I can however use that same user and password to perform a successful ldapsearch and ldapmodify. I am guessing that I have something configured incorrectly. After a day of searching in vain, I have decided to ask people that know better than I do. I see a couple key parts: 1) In the /var/log/sssd/sssd_pam.log -- You can see that pam_reply is called with a result of 6, which I believe is invalid credentials. 2) In the /var/log/sssd/sssd_default.log -- You can see that things seem to be going well until the we get the message 'Bind result: Invalid credentials(49)'. The simple bind doesn't work. How is this different from ldapsearch? Any thoughts or ideas? Thanks, Kevin Note: I had to severely truncate some of my logs so I could get this email under the 40K size limit. I can send more log information upon request. /etc/password-auth: auth required pam_env.so debug auth [success=done new_authtok_reqd=done auth_err=die perm_denied=die default=ignore] pam_sss.so forward_pass auth sufficient pam_unix.so nullok use_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so debug /etc/sssd/sssd.conf: [domain/default] debug_level = 9 ldap_id_use_start_tls = False cache_credentials = False ldap_search_base = dc=example,dc=com id_provider = ldap auth_provider = ldap access_provider = ldap ldap_group_member = member chpass_provider = ldap ldap_uri = ldaps://test-server/ ldap_tls_cacert = /etc/openldap/certs/cacert.pem [sssd] debug_level = 9 services = pam config_file_version = 2 domains = default /etc/openldap/slapd.conf: TLSCertificateFile /etc/openldap/certs/server.pem TLSCertificateKeyFile /etc/openldap/certs/server.pem TLSCACertificateFile /etc/openldap/certs/cacert.pem TLSVerifyClient allow # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable users modifying their own passwords. access to dn.exact="" by * read access to attrs=userPassword by self write by anonymous auth by * break access to dn.subtree="dc=example,dc=com" by dn.exact="uid=jharden,ou=Users,dc=example,dc=com" manage by self write by anonymous read by * none ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=example,dc=com" checkpoint 1024 15 /var/log/sssd/sssd_default.log: (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_set_port_status] (0x0100): Marking port 636 of server 'test-server' as 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [set_server_common_status] (0x0100): Marking server 'test-server' as 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_connect_done] (0x4000): notify connected to op #1 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_send] (0x4000): Retrieving info for initgroups call (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [dc=example,dc=com] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=jharden)(objectclass=posixAccount))][dc=example,dc=com]. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 2 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_connect_done] (0x4000): caching successful connection after 1 notifies (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x16e7840], connected[1], ops[0x1791ec0], ldap[0x16e60a0] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x16e7840], connected[1], ops[0x1791ec0], ldap[0x16e60a0] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_parse_entry] (0x4000): OriginalDN: [uid=jharden,ou=Users,dc=example,dc=com]. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x16e7840], connected[1], ops[0x1791ec0], ldap[0x16e60a0] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_user] (0x4000): Receiving info for the user (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_user] (0x4000): Storing the user (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x4000): Save user (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x2000): Adding originalDN [uid=jharden,ou=Users,dc=example,dc=com] to attributes of [jharden]. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x1000): Original memberOf is not available for [jharden]. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_attrs_add_ldap_attr] (0x2000): Adding original mod-Timestamp [20140320231721Z] to attributes of [jharden]. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x0400): Storing info for user jharden (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_user] (0x4000): Process user's groups (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_initgr_common_store] (0x2000): Updating memberships for jharden (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): start ldb transaction (nesting: 1) (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): commit ldb transaction (nesting: 1) (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [acctinfo_initgroups_callback] (0x0080): NSS Service not conected (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x16e7840], connected[1], ops[(nil)], ldap[0x16e60a0] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 16DEE20 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sbus_message_handler] (0x4000): Received SBUS method [pamHandler] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler] (0x0100): Got request with the following data (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): domain: default (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): user: jharden (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): service: sshd (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): tty: ssh (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): ruser: (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): rhost: test-server (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): authtok type: 1 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): authtok size: 13 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): newauthtok size: 0 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): priv: 1 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100): cli_pid: 24982 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [get_server_status] (0x1000): Status of server 'test-server' is 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [get_port_status] (0x1000): Port status of port 636 for server 'test-server' is 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 10 seconds (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [get_server_status] (0x1000): Status of server 'test-server' is 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_resolve_server_process] (0x0200): Found address for server test-server: [127.0.0.1] TTL 7200 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [auth_resolve_done] (0x2000): [ldaps://test-server/] is a secure channel. No need to run START_TLS (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sss_ldap_init_send] (0x4000): Using file descriptor [20] for LDAP connection. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldaps://test-server:636/??base] with fd [20]. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_set_port_status] (0x0100): Marking port 636 of server 'test-server' as 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [set_server_common_status] (0x0100): Marking server 'test-server' as 'working' (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x17c0950 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x17c0a70 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Destroying timer event 0x17c0a70 "ltdb_timeout" (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Ending timer event 0x17c0950 "ltdb_callback" (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [find_password_expiration_attributes] (0x4000): No password policy requested. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_send] (0x0100): Executing simple bind as: uid=jharden,ou=Users,dc=example,dc=com (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_send] (0x2000): ldap simple bind sent, msgid = 1 (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x16e4410], connected[1], ops[0x1794440], ldap[0x1791f40] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_BIND] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_done] (0x1000): Server returned no controls. *(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_done] (0x0400): Bind result: Invalid credentials(49), no errmsg set* (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_handle_release] (0x2000): Trace: sh[0x16e4410], connected[1], ops[(nil)], ldap[0x1791f40], destructor_lock[0], release_memory[0] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler_callback] (0x0100): Sending result [6][default] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler_callback] (0x0100): Sent result [6][default] (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [cleanup_users] (0x4000): Cache expiration is set to 0 days /var/log/sssd/sssd_pam.log: (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_check_user_search] (0x0400): Returning info for user [jharden@default] (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_initgr_cache_set] (0x2000): [jharden] added to PAM initgroup cache (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data: (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): domain: default (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): user: jharden (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost: test-server (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok size: 13 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok size: 0 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 24982 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x2357220 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x41b300:3:jharden@default] (Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x2357220 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 23568B0 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching. (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [6][default] *(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [6].* (Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_reply] (0x0100): blen: 24 (Thu Mar 20 23:25:04 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x2358760][19] (Thu Mar 20 23:25:04 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x2358760][19] (Thu Mar 20 23:25:04 2014) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Thu Mar 20 23:25:04 2014) [sssd[pam]] [client_destructor] (0x2000): Terminated client [0x2358760][19] (Thu Mar 20 23:25:09 2014) [sssd[pam]] [pam_initgr_cache_remove] (0x2000): [jharden] removed from PAM initgroup cache

5 11

SSSD + PAM configuration
by Kevin Sullivan 22 Mar '14

22 Mar '14

After trying for several days, I want to ask if this is even possible: I am running CentOS 6.4 and I have sssd-1.9.2-82 installed. I would like to log into my machine by querying an OpenLDAP server running else where. The big difference that I have from the normal sssd setup, is I only want to use the local Unix accounts (/etc/passwd and /etc/shadow) if my LDAP server is offline. So how do I do this? Should I be able to do all of this through pam? Either way, the issue I am seeing with sssd is the return value of pam when sssd can't connect to my ldap server. It always returns 'user_unknown' instead of 'authinfo_unavail' as I would expect. Am I configuring something incorrectly? /etc/pam.d/password-auth: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [success=done new_authtok_reqd=done authinfo_unavail=ignore default=die] pam_sss.so forward_pass auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so /etc/sssd/sssd.conf: [domain/default] debug_level = 9 ldap_search_base = dc=example,dc=com id_provider = ldap auth_provider = ldap access_provider = ldap ldap_access_filter = memberOf=cn=group,ou=Roles,dc=example,dc=com ldap_group_member = memberUid ldap_group_search_base = ou=Roles,dc=example,dc=com chpass_provider = ldap ldap_uri = ldap://test-server/ [sssd] debug_level = 9 services = pam config_file_version = 2 domains = default [nss] debug_level = 9 [pam] debug_level = 9 [sudo] debug_level = 9 [autofs] debug_level = 9 [ssh] debug_level = 9 [pac] debug_level = 9 /var/log/sssd/sssd_default.log: (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_message_handler] (0x4000): Received SBUS method [getAccountInfo] (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [be_get_account_info] (0x0100): Got request for [3][1][name=user] (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x196b8f0 (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x196c2b0 (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Destroying timer event 0x196c2b0 "ltdb_timeout" (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Ending timer event 0x196b8f0 "ltdb_callback" (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 1,11,Offline (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000): dbus conn: 1964B00 (Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000): Dispatching. /var/log/sssd/sssd_pam.log: (Tue Mar 18 19:09:52 2014) [sssd[pam]] [accept_fd_handler] (0x0400): Client connected to privileged pipe! (Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x6cc030][19] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3]. (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3]. (Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x6cc030][19] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x6cc030][19] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'user' matched without domain, user is user (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): domain: not set (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): user: user (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost: test-server (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok size: 8 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok size: 0 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 10665 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/default/user] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [0x41b300:3:user@default] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [default][3][1][name=user] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x6cdf20 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [0x41b300:3:user@default] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x6cdf20 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 6C8DE0 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching. (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 1 errno: 11 error message: Offline (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_check_user_dp_callback] (0x0040): Unable to get information from Data Provider Error: 1, 11, Offline (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [user@default] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x6d7360 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x6d7480 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x6d7480 "ltdb_timeout" (Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x6d7360 "ltdb_callback" (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_check_user_search] (0x0080): No matching domain found for [user], fail! (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [10]. (Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_reply] (0x0100): blen: 8 (Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x41b300:3:user@default] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x6cc030][19] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x6cc030][19] (Tue Mar 18 19:09:52 2014) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Tue Mar 18 19:09:52 2014) [sssd[pam]] [client_destructor] (0x2000): Terminated client [0x6cc030][19] I tried to provide only the portions of files that I found relevant. I can provide more upon request. Thanks, Kevin

6 9

Re: [SSSD-users] no permission -sssd-1.11.1 Trusty automount nfs4+krb
by Longina Przybyszewska 12 Mar '14

12 Mar '14

I get crazy. I can login to the client with AD passwd but it seems that have no right credentials to access automounted homedir . But I can access homedir on the server as owner of homedir. Both, have the same sssd.conf, krb5.conf My configuration allows for accessing nfs share on machine level but not on user level on the client at least.. On nfs4+krb client: ====================== Ssh longina@jedi Could not chdir to home directory /home/longina: Permission denied -bash: /home/longina/.bash_profile: Permission denied longina@jedi:/$ cd /home/longina -bash: cd: /home/longina: Permission denied longina@jedi:/$ ----------------------------- root@jedi:~# less /proc/mounts proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 ....... ....... systemd /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,name=systemd 0 0 /etc/auto.home /home autofs rw,relatime,fd=12,pgrp=1934,timeout=300,minproto=5,maxproto=5,indirect 0 0 /etc/auto.msshare /Mshare autofs rw,relatime,fd=18,pgrp=1934,timeout=300,minproto=5,maxproto=5,indirect 0 0 gvfsd-fuse /run/user/111/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=111,group_id=117 0 0 jota.nat.c.example.org:/nfs4/jota/longina /home/longina nfs4 rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_lock=none,addr=10.144.4.254 0 0 =============================== On nfs-krb5 server - no problem with accessing homedir for user 'longina': root@jota:~# su - longina longina@jota:/$ cd /nfs4/jota/longina longina@jota:/nfs4/jota/longina$ mkdir created_by_longina_on_jota longina@jota:/nfs4/jota/longina$ ls -l total 12 drwxr-xr-x 2 longina domain users 4096 Mar 12 09:53 created_by_longina_on_jota -rw-r--r-- 1 longina domain users 0 Mar 10 10:21 created_by_long_on_jota drwxr-xr-x 2 longina domain users 4096 Feb 27 13:46 created_on_jota cat /etc/exports: .... /nfs4/jota 10.80.8.0/24(rw,sync,no_subtree_check,sec=krb5p:krb5i:krb5) .... Best Longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Longina Przybyszewska Sent: 10. marts 2014 12:59 To: 'dpal(a)redhat.com'; sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd The krb5.conf is configured differently on both machines: on server , is defined one realm, one domain. On client, multidomain, multi realm. User is from domain/realm known on both machines (NAT.C.EXAMPLE.COM) Best Longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Dmitri Pal Sent: 7. marts 2014 16:32 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd On 03/07/2014 06:02 AM, Longina Przybyszewska wrote: > Hi again, > The pieces of the automount works almost... ;( My transition step > towards getting automount on login with 'autofs' as sssd service, looks like that: > > -I can authenticate with sssd and AD as id/access/auth_provider > - can login to machine from login GUI directly into local home > directory /Lshare/long > - here from, using cd /home/long activates automount; Directory is mounted, but user has no permissions > to access it > - sssd on client is configured without 'autofs' service (as I have no sign of automount nis-schema > In AD, even if there is installed SFU) -nsswitch says : > automount: files sss If you are not using SSSD for delivering the maps then you do not need 'sss' here. But this is not the problem you are seeing. > > cat /proc/mounts: > > /etc/auto.home /home autofs > rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec > t 0 0 /etc/auto.nfs /nfs autofs > rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect > 0 0 /etc/auto.msshare /Mshare autofs > rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec > t 0 0 jota.a.domain.com:/nfs4/jota/long /home/long nfs4 > rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto > =tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_ > lock=none,addr=10.144.4.254 0 0 > > df -h shows ikke that mount. > > Both , client and server run the same version of sssd-1.11.1, and user 'long' is seen as a member of the same groups on both machines. Does it have same UID/GID on both machines? > > If I run as root on client 'cd /home/long', homdir is mounted: > > cat /proc/mounts > /etc/auto.home /home autofs > rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec > t 0 0 /etc/auto.nfs /nfs autofs > rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect > 0 0 /etc/auto.msshare /Mshare autofs > rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec > t 0 0 jota.a.domain.com:/nfs4/jota/long /home/long nfs4 > rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto > =tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_ > lock=none,addr=10.144.4.254 0 0 > > df -h > ... > jota.a.domain.com:/nfs4/jota/long 1.8T 2.1G 1.7T 1% /home/long > Any ideas ? > > Best > longina > > Med venlig hilsen > > Longina Przybyszewska > Systemprogrammør, IT-service > > Tlf. +45 6550 2359 > Mobil +45 6011 2359 > Email longina(a)sdu.dk > Web http://www.sdu.dk/ansat/longina > Adr. Campusvej 55, 5230 Odense M > > SYDDANSK UNIVERSITET > _______________________________________________________________ > Campusvej 55 * 5230 * Odense M * Tlf. +45 6550 1000 * www.sdu.dk > > > > -----Original Message----- > From: sssd-users-bounces(a)lists.fedorahosted.org > [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of > Longina Przybyszewska > Sent: 27. februar 2014 16:56 > To: 'End-user discussions about the System Security Services Daemon' > Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd > problem > > Hi, > Ubuntu Saucy nfs4+krb+sssd server > Ubuntu Trusty client,sssd+autofs > > I can manually mount directory (nfs4+krb) as root on the client. > > Is it possible on client, use SSSD with autofs service, with automounter referring to the flat files , /etc/auto.master ,/etc/auto.home, not to ldap? > > > How can I check if autofs delivered with distribution supports sssd? > > Best > longina > > > > -----Original Message----- > From: sssd-users-bounces(a)lists.fedorahosted.org > [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej > Valousek > Sent: 20. februar 2014 13:48 > To: End-user discussions about the System Security Services Daemon > Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb > problem) > > Created BZ: > https://bugzilla.redhat.com/show_bug.cgi?id=1067423 > > attached is a patch resolving the issue. > Ondrej > ________________________________________ > From: sssd-users-bounces(a)lists.fedorahosted.org > [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Simo Sorce > [simo(a)redhat.com] > Sent: Wednesday, February 19, 2014 7:35 PM > To: End-user discussions about the System Security Services Daemon > Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb > problem) > > On Wed, 2014-02-19 at 15:04 +0000, Ondrej Valousek wrote: >> Hi Simo, >> >> I are you getting on about this with Steve? > This is the current situation: > <steved> simo: post a patch with what you want and lets talk about it.... > > :-) > >> Would it be better to open a RFE for this? I would like to know where >> we are standing - whether there is any chance that RHEL6 will be >> fixed or it would only go to RHEL 7. > An RFE for RHEL7 would be nice. > > Simo. > > -- > Simo Sorce * Red Hat, Inc * New York > > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/ _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 5

Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd
by Longina Przybyszewska 10 Mar '14

10 Mar '14

Hi again, The pieces of the automount works almost... ;( My transition step towards getting automount on login with 'autofs' as sssd service, looks like that: -I can authenticate with sssd and AD as id/access/auth_provider - can login to machine from login GUI directly into local home directory /Lshare/long - here from, using cd /home/long activates automount; Directory is mounted, but user has no permissions to access it - sssd on client is configured without 'autofs' service (as I have no sign of automount nis-schema In AD, even if there is installed SFU) -nsswitch says : automount: files sss cat /proc/mounts: /etc/auto.home /home autofs rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0 /etc/auto.nfs /nfs autofs rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0 /etc/auto.msshare /Mshare autofs rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0 jota.a.domain.com:/nfs4/jota/long /home/long nfs4 rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_lock=none,addr=10.144.4.254 0 0 df -h shows ikke that mount. Both , client and server run the same version of sssd-1.11.1, and user 'long' is seen as a member of the same groups on both machines. If I run as root on client 'cd /home/long', homdir is mounted: cat /proc/mounts /etc/auto.home /home autofs rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0 /etc/auto.nfs /nfs autofs rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0 /etc/auto.msshare /Mshare autofs rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0 jota.a.domain.com:/nfs4/jota/long /home/long nfs4 rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_lock=none,addr=10.144.4.254 0 0 df -h ... jota.a.domain.com:/nfs4/jota/long 1.8T 2.1G 1.7T 1% /home/long Any ideas ? Best longina Med venlig hilsen Longina Przybyszewska Systemprogrammør, IT-service Tlf. +45 6550 2359 Mobil +45 6011 2359 Email longina(a)sdu.dk Web http://www.sdu.dk/ansat/longina Adr. Campusvej 55, 5230 Odense M SYDDANSK UNIVERSITET _______________________________________________________________ Campusvej 55 * 5230 * Odense M * Tlf. +45 6550 1000 * www.sdu.dk -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Longina Przybyszewska Sent: 27. februar 2014 16:56 To: 'End-user discussions about the System Security Services Daemon' Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd problem Hi, Ubuntu Saucy nfs4+krb+sssd server Ubuntu Trusty client,sssd+autofs I can manually mount directory (nfs4+krb) as root on the client. Is it possible on client, use SSSD with autofs service, with automounter referring to the flat files , /etc/auto.master ,/etc/auto.home, not to ldap? How can I check if autofs delivered with distribution supports sssd? Best longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej Valousek Sent: 20. februar 2014 13:48 To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) Created BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1067423 attached is a patch resolving the issue. Ondrej ________________________________________ From: sssd-users-bounces(a)lists.fedorahosted.org [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Simo Sorce [simo(a)redhat.com] Sent: Wednesday, February 19, 2014 7:35 PM To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem) On Wed, 2014-02-19 at 15:04 +0000, Ondrej Valousek wrote: > Hi Simo, > > I are you getting on about this with Steve? This is the current situation: <steved> simo: post a patch with what you want and lets talk about it.... :-) > Would it be better to open a RFE for this? I would like to know where > we are standing - whether there is any chance that RHEL6 will be fixed > or it would only go to RHEL 7. An RFE for RHEL7 would be nice. Simo. -- Simo Sorce * Red Hat, Inc * New York _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 4

Problem Authenticating with Sun DS 5.2
by Matt Mencel 06 Mar '14

06 Mar '14

I am running Centos 6.5 and installed the latest SSSD from the IPA repo, 1.11.90. I've got it working to the point where I can run the 'id' command and it will return an LDAP user. When I try to authenticate using SSH however I just get "Permission denied". The SSSD log shows the bind is invalid, as if I'm using a bad password or bind DN. (Tue Mar 4 15:20:29 2014) [sssd[be[LDAP]]] [simple_bind_done] (0x0400): Bind result: Invalid credentials(49), no errmsg set On my LDAP server I see that it is returning err=49. [04/Mar/2014:15:22:52 -0600] conn=2287156 op=-1 msgId=-1 - fd=520 slot=520 LDAPS connection from 10.50.2.35 to 10.50.2.10 [04/Mar/2014:15:22:52 -0600] conn=2287156 op=-1 msgId=-1 - SSL 128-bit RC4 [04/Mar/2014:15:22:52 -0600] conn=2287156 op=0 msgId=1 - BIND dn="uid=ACCOUNT,ou=People,dc=here,dc=com" method=128 version=3 [04/Mar/2014:15:22:52 -0600] conn=2287156 op=0 msgId=1 - RESULT err=49 tag=97 nentries=0 etime=0 [04/Mar/2014:15:22:52 -0600] conn=2287156 op=1 msgId=2 - UNBIND [04/Mar/2014:15:22:52 -0600] conn=2287156 op=1 msgId=-1 - closing - U1 [04/Mar/2014:15:22:52 -0600] conn=2287156 op=-1 msgId=-1 - closed. I've tested over and over and I know I'm using the correct password. Tried multiple accounts all with their correct passwords and get the same result. I'm not using TLS, just LDAPS on port 636. Could it be that SSSD is using RC4 encryption and our LDAP server doesn't support RC4? Just not sure where else to go with this. This is my SSSD config. [domain/LDAP] auth_provider = ldap cache_credentials = True chpass_provider = ldap entry_cache_timeout = 600 enumerate = false id_provider = ldap ldap_id_use_start_tls = False ldap_schema = rfc2307bis ldap_search_base = dc=here,dc=com ldap_user_search_base = ou=people,dc=here,dc=com ldap_user_object_class = myObjClass ldap_user_name = uid ldap_group_seach_base = ou=groups,dc=here,dc=com ldap_group_object_class = groupofuniquenames ldap_page_size = 100 ldap_uri = ldaps://ldap.here.com:636 debug_level = 9 ldap_default_bind_dn = cn=BINDUSER,ou=applications,dc=here,dc=com ldap_default_authtok = XXXXXXXX ldap_network_timeout = 3 ldap_tls_cacertdir = /etc/openclad/cacert ldap_tls_reqcert = never ldap_access_filter = (department=My Department) [sssd] config_file_version = 2 services = nss, pam domains = LDAP [nss] filter_users = root,named,avahi,haldaemon,dbus,radiusd,news,nscd [pam]

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2014