sssd-users December 2015

sssd-users@lists.fedorahosted.org

21 participants
25 discussions

sssd simple access provider questions
by aaron wang 02 Dec '15

02 Dec '15

Hi all, For simple access provider, is there a way to configure it to deny every user from the domain(LDAP) by using some combinations of simple_allow_* and simple_deny_* ? I'm developing a base sssd configuration for the users to modify, right now the default is: simple_allow_group = (empty string here) This will allow everyone to login, but I want to keep the default config to deny every user from LDAP considering security. Thanks, Aaron

3 2

How do I disable SRV lookup?
by Ondrej Valousek 01 Dec '15

01 Dec '15

Hi list, How do I completely disable SRV lookups? This functionality is corrupted in SSSD so I wanted to disable it completely by defining ad servers explicitely: ad_server = myserver1, myserver2 ldap_uri = ldap://myserver1, ldap://myserver2 subdomains_provider = none ldap_use_tokengroups = False ad_domain = TEST.COM However, in logs I can still see the SRV plugin in action trying to populate AD servers automatically. Is it possible somehow? Many thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

4 9

sssd with krb5 auth and local ids
by Alexander 'Leo' Bergolth 01 Dec '15

01 Dec '15

Hi! I am trying to configure sssd-1.12.2-58.el7 with auth_provider=krb5 but ids from the local /etc/passwd and group files. According to https://fedorahosted.org/sssd/wiki/DesignDocs/KerberosPrincipalMappingToPro… ... I configured sssd to use id_provider=proxy with proxy_lib_name=files and auth_provider=krb5. However, krb5 srv discovery dosn't work with this setup. If I don't specify a krb5_server, sssd complains about: -------------------- 8< -------------------- (Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [resolve_srv_send] (0x0200): The status of SRV lookup is neutral (Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [resolve_srv_send] (0x0040): No SRV lookup plugin is set (Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [be_resolve_server_done] (0x1000): Server resolution failed: 14 (Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [be_mark_offline] (0x2000): Going offline! -------------------- 8< -------------------- Do you have any hints? Cheers, --leo P.S.: Full log output and config is available at http://leo.kloburg.at/tmp/sssd-krb5-proxy/ -- e-mail ::: Leo.Bergolth (at) wu.ac.at fax ::: +43-1-31336-906050 location ::: IT-Services | Vienna University of Economics | Austria

2 1

Kerberos ticket renewal with AD
by Andy Airey 01 Dec '15

01 Dec '15

Hello, I've been trying to get this working for several weeks now, but the kerberos tickets keep expiring after 7 days. They just expired again today. I think I have set up everything correctly, but it still doesn't seem to work. I hope someone on this list can point me in the right direction. Below is some more information. The machine is joined to an Active Directory realm with net ads join -k. [root@hostname ~] cat /etc/krb5.conf > [logging] > default = FILE:/var/log/krb5libs.log > kdc = FILE:/var/log/krb5kdc.log > admin_server = FILE:/var/log/kadmind.log > > > [libdefaults] > default_realm = EXAMPLE.COM > dns_lookup_realm = true > dns_lookup_kdc = true > ticket_lifetime = 24h > renew_lifetime = 7d > forwardable = true > > [realms] > # Define only if DNS lookups are not working > # example.com = { > # kdc = DC01 > # admin_server = DC01.example.com > # } > > # EXAMPLE.COM = { > # kdc = DC01.example.com > # kdc = DC02.example.com > # kdc = DC03.example.com > # kdc = DC04.example.com > # } > > [domain_realm] > # Define only if DNS lookups are not working > # .brain.com = EXAMPLE.COM > # example.com = EXAMPLE.COM > [root@hostname ~] cat /etc/samba/smb.conf > #removed commented lines > [global] > security = ads > passdb backend = tdbsam > realm = EXAMPLE.COM > > password server = dc01.example.com dc02.example.com > kerberos method = secrets and keytab > client signing = yes > client use spnego = yes > > load printers = yes > cups options = raw > > [homes] > comment = Home Directories > browseable = no > writable = yes > > [printers] > comment = All Printers > path = /var/spool/samba > browseable = no > guest ok = no > writable = no > printable = yes > [root@hostname ~] cat /etc/sssd/sssd.conf > [sssd] > domains = example.com > config_file_version = 2 > services = nss, pam, pac, sudo, autofs > debug_level = 6 > > [nss] > debug_level = 3 > > [pam] > debug_level = 3 > > [sudo] > debug_level = 3 > > [autofs] > debug_level = 3 > > [domain/example.com] > debug_level = 6 > > ad_domain = example.com > ad_hostname = hostname.example.com > krb5_realm = EXAMPLE.COM > cache_credentials = True > id_provider = ad > auth_provider = krb5 > krb5_store_password_if_offline = True > default_shell = /bin/bash > ldap_id_mapping = False > use_fully_qualified_names = False > fallback_homedir = /home/users/%u > access_provider = ad > > # LDAP settings > > ldap_schema = rfc2307bis > # Unless you know you need referrals, turn them off > ldap_referrals = false > # Uncomment if you need offline logins > # cache_credentials = true > enumerate = false > > ldap_sasl_mech = GSSAPI > > ldap_user_search_base = ou=Brain2HQ,dc=brain2,dc=com > ldap_user_object_class = user > > ldap_user_home_directory = unixHomeDirectory > ldap_user_principal = userPrincipalName > > ldap_group_search_base = ou=Groups,dc=brain2,dc=com > ldap_group_object_class = group > > ldap_access_order = expire > ldap_account_expire_policy = ad > ldap_force_upper_case_realm = true > > # sudo settings > sudo_provider = ldap > ldap_sudo_search_base = ou=sudoers,dc=brain2,dc=com > > # autofs settings > autofs_provider = ldap > ldap_autofs_search_base=ou=automount,dc=brain2,dc=com > ldap_autofs_map_object_class=nisMap > ldap_autofs_entry_object_class=nisObject > ldap_autofs_map_name=nisMapName > ldap_autofs_entry_key=cn > ldap_autofs_entry_value=nisMapEntry > > # shell settings > allowed_shells = /bin/sh,/bin/bash,/bin/zsh,/bin/fish,/bin/ksh, > vetoed_shells = /bin/csh,/bin/tcsh > shell_fallback = /bin/bash > > # kerberos settings > > # Probably required with sssd 1.8.x and newer > krb5_canonicalize = false > krb5_renewable_lifetime = 1d > krb5_renew_interval = 60s > krb5_lifetime = 1h #normally set by KDC > Kerberos tickets and logs of today: > [root@hostname ~] klist -f /var/lib/sss/db/ccache_example.com > Ticket cache: FILE:/var/lib/sss/db/ccache_example.com > Default principal: hostname$(a)example.com > > Valid starting Expires Service principal > 11/30/15 13:16:40 11/30/15 23:16:44 krbtgt/example.com(a)example.com > renew until 12/07/15 13:16:40, Flags: RIA > 11/30/15 13:16:44 11/30/15 23:16:44 ldap/dc02.example.com@ > renew until 12/07/15 13:16:40, Flags: RAO > 11/30/15 13:16:44 11/30/15 23:16:44 ldap/dc02.example.com(a)example.com > renew until 12/07/15 13:16:40, Flags: RAO > 11/30/15 13:16:44 11/30/15 23:16:44 DNS/dc01.example.com(a)example.com > renew until 12/07/15 13:16:40, Flags: RAO > [root@hostname ~] grep renew /var/log/sssd/sssd_example.com.log > (Mon Nov 30 08:28:49 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 09:55:42 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0100): Successfully renewed TGT for user [John Doe]. > (Mon Nov 30 10:26:42 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0100): Successfully renewed TGT for user [John Doe]. > (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0020): krb5_auth request failed. > (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0200): Giving back pam data. > (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0020): krb5_auth request failed. > (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0200): Giving back pam data. > (Mon Nov 30 11:38:07 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0020): krb5_auth request failed. > (Mon Nov 30 11:38:07 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0200): Giving back pam data. > (Mon Nov 30 11:38:13 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0020): krb5_auth request failed. > (Mon Nov 30 11:38:13 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0200): Giving back pam data. > (Mon Nov 30 11:47:35 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0020): Failed to renew TGT for user [John Doe]. > (Mon Nov 30 11:47:35 2015) [sssd[be[example.com]]] [renew_tgt_done] > (0x0020): Failed to renew TGT for user [Lucy Doe]. > (Mon Nov 30 14:16:07 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 17:19:34 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 18:20:26 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 18:21:36 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 19:11:06 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 19:26:31 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Mon Nov 30 23:30:05 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 00:16:56 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 01:18:39 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 01:32:16 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 03:22:02 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 04:34:30 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 06:27:39 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 06:38:20 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 07:34:20 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 07:56:02 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 08:33:09 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > (Tue Dec 1 10:40:41 2015) [sssd[be[example.com]]] [renew_handler] > (0x0100): Offline, disable renew timer. > To be clear, it all works fine up to the point where the TGT ticket expires. Kind Regards, Andy

6 20

sssd cache questions
by aaron wang 01 Dec '15

01 Dec '15

Hi all, I was testing a few things about cache and here is my understandings, please correct me if I'm wrong: 1) cache_credentials option turn it on will allow offline authentication. Testing 1: turn cache_credentials on, all other timeout value remains default change the password on ldap, try to authenticate again, and immediately, it asked for the new password From the test result, I'm assuming that if ldap server is online, this credentials cache won't be used , correct ? So this cache here is only for "high availability" but has nothing to do with "high performance". This confused me a bit, as I always think cache is a mechanism for high performance. 2) entry_cache_nowait_percentage and entry_cache_timeout options Testing 2: I set the timeout to 60 seconds, percentage remains default I moved one user from group1 to group2 on ldap, but I did an "id user" on client, still showing the old data. So this cache is for user identities , and it's for "high performance". Correct ? And is there any materials which cover all the sssd caching stuff ? Thanks, Aaron

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users December 2015