sssd-users August 2014

sssd-users@lists.fedorahosted.org

27 participants
36 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

sssd and sudo ldap problems with IPA.
by Lance Reed 29 Aug '14

29 Aug '14

Hello, Thanks in advance for any assistance. This is a long post - apologizes. I have a bit of an odd setup with IPA ipa-server-3.0.0-37.el6.x86_64 and sssd-1.9.2-129.el6_5.4.x86_64 CentOS 6.5. My goal is to get sudo work using IPA as a source. I setup the IPA server as normal. Since we are using this in a cloud environment (ec2) with hosts that may come and go quickly, we decided not to connect clients using the ipa-client code. Instead we have user auth working with SSSD as an LDAP provider. ( I know this complicates all things IPA). e.g: sssd.conf /etc/sssd/sssd.conf [domain/LDAP] enumerate = true cache_credentials = True debug_level = 8 id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_schema = IPA ldap_uri = ldaps://ipa-1b.ec2.example.net, ldaps://ipa-1.example.net ldap_user_search_base = dc=example,dc=net ldap_id_use_start_tls = true tls_reqcert = demand ldap_tls_cacert = /etc/ipa/ca.crt # Setting to correctly query public SSH keys from IPA server ldap_user_ssh_public_key = ipaSshPubKey [sssd] services = nss, pam, ssh config_file_version = 2 domains = LDAP So far this is working fine, with a minor issue around password expiration (a known issue). NOTE: The IPA server does not keep a list of hosts since we are not using the ipa-client / kerberos setup. At this point I am trying to get IPA working as a sudo provider. After reading through: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/ht… and https://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf I attempted to get sssd to use IPA as a sudo provider, I added the following to sssd.conf: [domain/LDAP] sudo_provider = ldap ldap_sudo_search_base = ou=sudoers,dc=example,dc=net [sssd] services = nss, pam, ssh, sudo and /etc/nsswitch.conf sudoers: files sss The setup did not resolve any rules, and I saw this in the logs: (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_init] (0x2000): Initializing sudo LDAP back end (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [ldap_get_sudo_options] (0x0400): Search base not set, trying to discover it later connecting to the LDAP server. (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [common_parse_search_base] (0x0100): Search base added: [SUDO][ou=sudoers,dc=example,dc=net][SUBTREE][] (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_object_class has value sudoRole (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_name has value cn (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_command has value sudoCommand (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_host has value sudoHost (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_user has value sudoUser (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_option has value sudoOption (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_runasuser has value sudoRunAsUser (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_runasgroup has value sudoRunAsGroup (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_notbefore has value sudoNotBefore (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_notafter has value sudoNotAfter (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_order has value sudoOrder (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_entry_usn has no value (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_ip_addresses] (0x2000): Found IP address: 10.0.1.105 in network 10.0.1.0/24 (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_ip_addresses] (0x2000): Found IP address: fe80::5054:ff:fe7b:abae in network fe80::/64 (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_hostnames_send] (0x2000): Found fqdn: lreed-sssd02.example.net (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_hostnames_send] (0x2000): Found hostname: lreed-sssd02 (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at: 1409237202 (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_full_refresh_send] (0x0400): Issuing a full refresh of sudo rules (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_refresh_connect_done] (0x0400): SUDO LDAP connection successful (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_next_base] (0x0400): Searching for sudo rules with base [ou=sudoers,dc=example,dc=net] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=lreed-sssd02.example.net)(sudoHost=lreed-sssd02)(sudoHost=10.0.1.105)(sudoHost=10.0.1.0/24)(sudoHost=fe80::5054:ff:fe7b:abae)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))][ou=sudoers,dc=example,dc=net]. (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoCommand] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoHost] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoUser] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOption] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsUser] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsGroup] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotBefore] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotAfter] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOrder] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_process] (0x0400): Receiving sudo rules with base [ou=sudoers,dc=example,dc=net] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_done] (0x0400): Received 0 rules (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sysdb_sudo_purge_byfilter] (0x0400): No rules matched (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_done] (0x0400): Sudoers is successfuly stored in cache (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_full_refresh_done] (0x0400): Successful full refresh of sudo rules (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at: 1409258802 (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_schedule_refresh] (0x0400): Smart refresh scheduled at: 1409238102 It seems “ Received 0 rules” means that IPA is note sending the full LDAP entries with sudo rules. I confirmed this by doing an ldap search using an authenticated user and could see them. I have since setup sudo-ldap.conf with an authenticated user. This seems to be working, however it seems a bit kludgy (I admit my entire setup is kludgy). Question #1 is that since this is going through sudo-ldap, sssd is not caching any of these rules. Is there a way to make sssd call sudo-ldap instead of setting it in nsswitch.conf: sudoers: files ldap vs sudoers: files sss ? It does not look like it but I may have something wrong. Question #2 is around hostname and sudo rules. Since we don’t have the hostnames in IPA by default, I can’t easily (AFAIK) add them to sudo rules. I can do rules for “ANY HOST” or I can add “external hosts” With file based sudo rules it is possible to use “wildcard” characters” for example with hostname to do “*-dev” and control rules thusly. The IPA web GUI does not seem to allow such rules. If I have to add each hostname this will become a possible show stopper. Thanks very much for any ideas on these problems.

5 10

problem with sssd using AD on Windows server 202R2
by Kristjan Elias 28 Aug '14

28 Aug '14

Hi all, I have been having some trouble lately with our setup of sssd what i will try to describe for you now. For the past year we have been using sssd to authenticate our RHEL6 local users from Corporate MS AD. This has been working without any problems so far. Last week the last of our DC AD servers were upgraded to Windows server 2012R2 and now the problems started. Firstly AD performance enhancements were lost. Snippet from logs: (Wed Aug 20 12:21:17 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 14:34:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 15:22:52 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 16:03:46 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 16:24:53 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 16:49:04 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 17:45:55 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 18:05:01 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Thu Aug 21 02:20:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 04:43:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 10:27:18 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 10:32:27 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 10:52:46 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 16:38:27 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 17:08:06 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 17:41:15 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements For this i filed a bug: https://fedorahosted.org/sssd/ticket/2418 Secondly when running without AD performance enhancements all logins fail when going through the users parent groups. This error disables the AD login for my RHEL servers. Here are the failure points in sssd log for 3 different users: >From my login attempt: (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #34 [SKYPEDWETL4] is not cached, need to add a fake entry (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [FTE_europe_2] objectSID to unix ID (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success] (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory] (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dfc50], connected[1], ops[(nil)], ldap[0x23dead0] (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! My colleague login attempt: (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #32 [SKYPEDWETL4] is not cached, need to add a fake entry (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success] (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory] (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070] (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! Another collegue: (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #34 [SKYPEDW_FILESHARE_TEST_TPUM_RO] is not cached, need to add a fake entry (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success] (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory] (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070] (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! My sssd.conf looks like this: ########################################################## [sssd] domains = MS_AD services = nss,pam config_file_version = 2 [nss] filter_users = root,etl,gpadmin,nws filter_groups = root,etl,gpadmin,nws default_shell = /bin/bash [pam] reconnection_retries = 3 offline_credentials_expiration = 1 offline_failed_login_attempts = 1 [domain/MS_AD] description = LDAP domain with MS AD server debug_level = 9 # caching credentials enumerate = false cache_credentials = false min_id = 1000 id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_tls_reqcert = never ldap_id_mapping = True ldap_schema = ad ldap_idmap_range_min = 10000 ldap_idmap_range_max = 2000100000 ldap_idmap_range_size = 20000000 ldap_uri = ldap://adserveraddress/ ldap_search_base = OU=UserAccounts,DC=something,DC=something ,DC=something,DC=com ldap_default_bind_dn = CN=Bind User Name,OU=UserAccounts,DC=something,DC= something,DC=something,DC=com ldap_default_authtok_type = password ldap_default_authtok = passwordgoeshere ldap_user_object_class = user ldap_group_object_class = group ldap_user_name = sAMAccountName ldap_user_objectsid = objectSid ldap_group_objectsid = objectGUID ldap_user_search_filter = memberOf=CN=SKYPEDWETL4,OU=UserAccounts,DC= something,DC=something,DC=something,DC=com override_homedir = /home/%u # performance ldap_disable_referrals = true ########################################################## Have any of you had experiences with errors like this? Many thanks for your attention! Thanks, Kristjan Elias

2 4

sssd with ad backend, pam problems
by Stefan Schäfer 28 Aug '14

28 Aug '14

Hello list, this is my first try here. I've a problem with a sssd_ad setup with a samba 4 ad domain. Samba domain is created with rfc2307 scheme. sssd works, getent passwd shows users and groups with UNIX-attributes from the ad, but login is impossible. The setup is based on openSUSE 13.1 with sssd updated to version 1.12 and the sernet samba packages version 4.1.11. My sssd configuration: -------------------------------------------------- [sssd] services = nss,pam config_file_version = 2 domains = invis-ad.loc debug_level = 5 [nss] [pam] [domain/invis-ad.loc] # Using id_provider=ad sets the best defaults on its own id_provider = ad # In sssd, the default access provider is always 'permit'. The AD access # provider by default checks for account expiration access_provider = ad # Authentication auth_provider = ad # Uncomment to use POSIX attributes on the server ldap_id_mapping = false # Uncomment if the client machine hostname doesn't match the computer object on the DC. ad_hostname = invisad.invis-ad.loc # Uncomment if DNS SRV resolution is not working ad_server = invisad.invis-ad.loc # Uncomment if the domain section is named differently than your Samba domain ad_domain = invis-ad.loc # Enumeration is discouraged for performance reasons. enumerate = true --------------------------------------------------------------------------------------------------------------------------------- nsswitch.conf .... passwd compat sss group compat sss ..... ---------------------------------------------------------------------------------------------------------------------- getent passwd: .... hbecker:*:10000:10000:Heinz Becker:/home/hbecker:/bin/bash This is exactly what is stored in the ad. The pam configuration: common-auth ------------------------------------------------------------------------------------------------------------------ #%PAM-1.0 auth required pam_env.so auth sufficient pam_unix.so try_first_pass auth sufficient pam_sss.so use_first_pass common-account ------------------------------------------------------------------------------------------------------------------- #%PAM-1.0 account requisite pam_unix.so try_first_pass account sufficient pam_localuser.so account [default=bad success=ok user_unknown=ignore] pam_sss.so common-password ------------------------------------------------------------------------------------------------------------------- password requisite pam_cracklib.so password sufficient pam_unix.so use_authtok nullok try_first_pass password sufficient pam_sss.so use_authtok common-session -------------------------------------------------------------------------------------------------------------------- #%PAM-1.0 session required pam_limits.so session required pam_unix.so try_first_pass session optional pam_sss.so session optional pam_umask.so session optional pam_systemd.so session optional pam_env.so --------------------------------------------------------------------------------------------------------------------- Here the logs from different login tries: 1. non-existing user 2014-08-28T15:52:29.560167+02:00 invisad login: pam_unix(login:auth): check pass; user unknown 2014-08-28T15:52:29.560490+02:00 invisad login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= 2014-08-28T15:52:29.567475+02:00 invisad login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=oierwe 2014-08-28T15:52:29.569417+02:00 invisad login: pam_sss(login:auth): received for user oierwe: 10 (User not known to the underlying authentication module) 2014-08-28T15:52:29.572497+02:00 invisad login: pam_unix(login:account): could not identify user (from getpwnam(oierwe)) 2014-08-28T15:52:29.573783+02:00 invisad login: User not known to the underlying authentication module seems to be ok. 2. existing user, wrong password 2014-08-28T15:53:33.988971+02:00 invisad login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:53:34.090927+02:00 invisad [sssd[krb5_child[16213]]]: #020 2014-08-28T15:53:34.101970+02:00 invisad login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:53:34.103406+02:00 invisad login: pam_sss(login:auth): received for user hbecker: 17 (Failure setting user credentials) 2014-08-28T15:53:34.104581+02:00 invisad login: pam_sss(login:account): Access denied for user hbecker: 4 (System error) 2014-08-28T15:53:34.105607+02:00 invisad login: System error seems to be ok. 3. existing user, correct password: 2014-08-28T15:54:39.661506+02:00 invisad login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:54:39.780648+02:00 invisad [sssd[krb5_child[16218]]]: #020 2014-08-28T15:54:39.791159+02:00 invisad login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:54:39.793320+02:00 invisad login: pam_sss(login:auth): received for user hbecker: 4 (System error) 2014-08-28T15:54:39.795032+02:00 invisad login: pam_sss(login:account): Access denied for user hbecker: 4 (System error) 2014-08-28T15:54:39.796398+02:00 invisad login: System error 2 times "system error", definitely not the expected result. Any ideas? With hope for help, regards Stefan -- www.invis-server.org Stefan Schäfer Ludwigstr. 1-3 63679 Schotten

6 16

A prototype of merged domains ("views")
by Nordgren, Bryce L -FS 27 Aug '14

27 Aug '14

Over the past month, I rearranged my local systems for our collaboration environment. The essence of the work is to combine employee identities (defined in AD) with identities for external users (defined in FreeIPA), massage them so that they look the same, and export them to every posix desktop and web application I support. Defining cross-domain posix groups is included, and was successfully performed, but sssd doesn't have a vocabulary to describe a merged domain (one identity provider, multiple auth providers). Still trying to figure out if I can force this to work somehow. The activity may shine a light on some of the things "views" might be required to do. http://www.freeipa.org/page/V4/Use_Case_for_Views:_Collaboration Enjoy, Bryce This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

2 2

Re: [SSSD-users] Fwd: sssd auth issue on centos 5.10
by Lukas Slebodnik 27 Aug '14

27 Aug '14

On (26/08/14 10:14), Daniel Jung wrote: >trying again.. > >---------- Forwarded message ---------- >From: Daniel Jung <mimianddaniel(a)gmail.com> >Date: Tue, Aug 26, 2014 at 10:13 AM >Subject: Re: [SSSD-users] sssd auth issue on centos 5.10 >To: Jakub Hrozek <jhrozek(a)redhat.com>, islebodn(a)redhat.com > > >Hi Lukas, or Jakub, > >Don't mean to be pushy but do you guys have any idea why I would need to do >this to make TLS work on centos 5.6 and up ? I do appreciate that you guys ^^^^^^^^^^ you should use centos 5.10 >are helping out with this as centos doesnt fall under supported contract. > >Cheers I thought your problem has alredy been fixed [1]. I tried to test default version of sssd on centos 5.10 and it works with FreeIPA server (389-ds). sssd-1.9-6 from copr repo works as well. It seems that you have problem with certificate. Unfortunately, I am not able to help you with this part of configuration. Try to reply also to the sssd-users in future. LS [1] https://lists.fedorahosted.org/pipermail/sssd-users/2014-August/002117.html [2] https://copr.fedoraproject.org/coprs/sgallagh/sssd-1.9-rhel5/

3 2

Re: [SSSD-users] Fwd: sssd auth issue on centos 5.10
by Lukas Slebodnik 27 Aug '14

27 Aug '14

On (27/08/14 00:53), Daniel Jung wrote: >Hi Lukas, > >Yes it does work after recompling nss with libnsspem and upgrading openldap >lib. I do agree that 5.6 should really be upgraded . > >I had tested the cert using openssl s_client and ldapsearch -ZZ and both >worked fine. However, sssd didnt work. Curious did you compile SSSD to use >openssl instead of nss ? > I did not recompile anything. It means libnss3.so was used. LS

1 0

Same user name and group name in AD
by Andre Pitanga 25 Aug '14

25 Aug '14

Hi list- I'm working on a project using Active Directory 2008 R2 with Identity Management for UNIX service to provide authentication and identity for Linux users via sssd. Using this setup, is it possible to have the Linux username and group name be the same (e.g. user apache, group apache)? I've learned that the sAMAccountName attribute must be unique across the domain but I'm not sure if sssd uses this attribute to "translate" the UID and GID to names in Linux. Hope this makes sense! Our sssd.conf is: [sssd] config_file_version = 2 debug_level = 0 domains = example.com services = nss, pam [domain/example.com] id_provider = ad access_provider = ad # We rely on UNIX extended attributes in AD ldap_id_mapping = false enumerate = true -- Andre Pitanga RHCE 100-077-478 (917) 745-6256 andre.pitanga(a)redhat.com Red Hat, Inc. Red Hat Consulting

5 8

problem sudo with centos 6.5
by alireza baghery 25 Aug '14

25 Aug '14

hi i integrated AD windows 208 R2 with IPA server (centos 6.5) i write a sudo policy and access for specified user and host with allow any command. user can execute sudo in centos 7 but when user loggin on centos 6.5 can not execute sudo and get error below user@AD is not in sudoers file. i write email to IPA guys but they tell there is a bug in 6.5 around sudo and AD users. i can not migrate to centOS 7.please tell me how to solve this problem. i configure /etc/nsswitch.conf --sudoers: file sss /etc/sss/sss.conf----service nss, pam,ssh,sudo /etc/sysconfig/network ----- NISDOMAIN=ad.com thanks

1 0

Command in ~/.ssh/authorized_keys not triggered
by XuQing Tan 24 Aug '14

24 Aug '14

Hi, folks I have successfully setup sssd that the project members can login with their LDAP credentials. we also have gitlab installed in the same server, gitlab relies on the SSH trigger (command="..." in authorized_keys file) for git ssh auth. but the problem is I can't get git ssh auth login success because the gitlab-shell comamnd not triggered: cat ~/.ssh/authorized_keys command="*date >> a.log;* /opt/git/gitlab-shell/bin/gitlab-shell key-2",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsIDug9GByMA0KWakMxt2jJTKhR4Rr53zA3iIGNyI5FFszppaAaKLyEjwi46IcPD6247eiudhNkptqAk5Ao71+iydbkuT882F+IEzgD6f4nl2fBqWyZPN/AtG8ojnQJWVOwN2W02IPgXYx+Kpbg9LAk2ac8nW/JK9A90X8+BmCcdWJzjXzoXp2RsOPeofcXcAyjr5vhHP4ES1xxC+jZ4UcpCbOLhIC1EwHGZk1Kwc1WV7IeZBd0tjjuJs1q9zDzAKNFG93U9cVZ6/92N46TNgHRcp+BRuYpGO/vK1sn2Or3x/hq/ruvjGpes+kFQ35VwSAA2DncPV0CPfn9opUXkcXw== jenkins-ci(a)example.com i added "date >> a.log" in front of the gitlab-shell, the expect result is ~/a.log should be generated and datetime are logged in the file. (i test this on a normal server, which means without SSSD setup, it worked as expected) but on the SSSD enabled server, i did not see ~/a.log created, that means the command not triggered. so do you have any clue why the command not triggered? let me know if need to provide more info, like conf file, etc. Thanks & Best Regards! /// (. .) --------ooO--(_)--Ooo-------- | Nick Tan | ------------------------------------

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2014