sssd-users April 2015

sssd-users@lists.fedorahosted.org

30 participants
21 discussions

RHEL/CentOS 6 problems with missing supplemental groups for AD users
by John Beranek 17 Apr '15

17 Apr '15

Hi, I've been investigating problems with the SSSD 1.11 versions supplied in RHEL/CentOS 6.6 for a while now. I've followed: https://access.redhat.com/solutions/1264443 https://fedorahosted.org/sssd/ticket/2472 and also created a case with Red Hat support. However, I'm still no closer to solving the issue. After updating servers to the SSSD in 6.6, intermittently (for particular users but not on all servers, and not necessarily all the time) users don't get their supplementary groups. e.g: [root@rhel6-template sssd]# id matthewbe uid=46721(matthewbe) gid=20513(domain users) groups=20513(domain users) This is with the latest SSSD on a RHEL6.6 server, i.e.: sssd-1.11.6-30.el6_6.3.x86_64 Our environment is Windows 2003 AD controllers, and users *without* POSIX attributes in their AD records. So, snippets of sanitised sssd.conf: [domain/AD] debug_level = 9 id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad ad_server = dc01.local,dc02.local ad_backup_server = ad.local ad_domain = ad.local # ID mapping min_id = 20000 ldap_idmap_range_min = 20000 #ldap_idmap_range_max = 220000 ldap_idmap_range_size = 200000 ldap_idmap_default_domain_sid = S-1-5-21-2365159532-2245169678-2931239768 ldap_schema = ad ldap_id_mapping = true override_homedir = /home/AD/%u override_shell = /bin/bash # access controls ldap_access_order = expire ldap_account_expire_policy = ad ldap_force_upper_case_realm = true # performance ldap_referrals = false I've tried a few config changes to fix the issue, but none has fixed it, including: ldap_use_tokengroups = False ldap_group_objectsid = objectSID ldap_user_objectsid = objectSID ldap_deref_threshold = 0 ldap_schema = rfc2307bis Given Red Hat support hasn't been able to fix our issue, what else can I do? Cheers, John -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake

2 7

authentication against IPA with SSSD takes long (more than 5 seconds)
by Qing Chang 16 Apr '15

16 Apr '15

OS: CentoOS 7.1 IPA: 4.1.0-18 SSSD: 1.12.2-58 With IPA any clients running CentOS7.1 authentication for ssh and sudo takes more than 5 seconds _after_ putting in password. If ssh to the IPA server itself, it authenticates instantly. Google did not provide much relevant information. Note that this is not a slow ssh session to get to authentication prompt, it always gets to the prompt without delay. Also it is not related to NFS performance, it is equally slow if I login to a NFS server (IPA client) locally or login to a server (also a IPA client) that has autofs home. IPA server is a fresh installation with just a couple of users. I had an installation previously that has more than a thousand user accounts on CentOS 6. Users did not have the slowness problem as with this new installation. Hope this list can provide some pointers. Thanks in advance. Qing Chang

6 19

sss_ssh_authorizedkeys: add a flag for ppolicy ?
by Olivier 16 Apr '15

16 Apr '15

Hi everyone, I saw couple of discussion around in this list as well as others about how to exploit ppolicy with ssh : here are some thought. Currently, I am in a situation where I have inserted my users public ssh keys in ldap (openssh-ldappubkey shema) and instructed sshd to consult ldap for ssh public keys, adding in ssh_config : AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys I also have authorized password authentication , in ssh_config: PasswordAuthentication yes My current policy is the following : - All my users must have a password in ldap (that is used by applications other than ssh) - not all my users may have an ssh key (some never use ssh) Everything works as I want. I now want to introduce ppolicy overlay and would like to enforce rules for password management even for users that mainly use ssh keys. Practically and basically : when a user with valid ssh key ask for an ssh connexion, I would like ssh to behave exactly as if this user had typed a correct "loging/password" and therefore check for ppolicy situation before granting access. aka : - if the account is 'ppolicy desactivated', ssh would refuse to provide the session - if the password is "ppolicy oudated", then ssh would warn to change it (and decrease 'pwdGraceAuthnLimit*'*?) ... and so on. I thought about two options/alternatives to do that : * try to tune pam (may be there would be a way to tell pam to check for user ppolicy fields once authentication has been done before granting access ?) * add some sort of flag (aka: --ppolicy) to sss_ssh_authorizedkeys to instruct sss_ssh_authorizedkeys to check for user ppolicy (use 'ldap_default_bind_dn' as a binding user) and if there is an issue return a "ppolicy error message" rather than the user ssh key ? These are just some thoughts. I'm currently exploring the first option (but I'm not a 'pam' expert and I'm even not sure that the ssh authentication process goes through pam if a valid key is found, even with 'UsePAM yes'). I would appreciate any guidance, advices or experiences from you on that particular issue. Thank you, -- Olivier

4 7

ldb_modify_failed invalid attribute syntax
by Christopher Butt 15 Apr '15

15 Apr '15

Hi, I'm trying to authenticate against an AD domain. The first domain I did this on was almost flawlessly easy, but this time, on a different domain I'm having problems. I've searched, but I've mostly got fixed bugs from old versions. Like this one: https://bugzilla.redhat.com/show_bug.cgi?id=886848 which suggests that case sensitivity might have been an issue. Is it still one? My symptoms: 1) Some domain users aren't being recognised at all, 2) Some users are not getting the full groups list, eg just 'domain users' 3) Some users are connecting apparently fine with lots of AD groups visible from an 'id' or 'groups' command. So far it seems that the domain admins all work fine, but it's not clear if that's a coincidence or not. I've set up SSDB using realmd as follows: realm join -v internal.mydomain.com --user jn-monty --computer-ou=OU=Linux\ Servers,OU=Member\ Servers,DC=internal,DC=mydomain,DC=com (jn-monty is a domain-admin in this case.) [root@myserver admin]# sssd --version 1.12.2 [root@myserver admin]# cat /etc/sssd/sssd.conf [sssd] domains = internal.mydomain.com config_file_version = 2 services = nss, pam, pac [domain/internal.mydomain.com] ad_domain = internal.mydomain.com krb5_realm = INTERNAL.MYDOMAIN.COM realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = ad debug_level = 5 auth_provider = ad If I 'id' a missing user I get the following in the logs: [root@myserver admin]# id bqt-pmimon(a)internal.mydomain.com (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=bqt-pmimon] (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Invalid attribute syntax] (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sysdb_set_entry_attr] (0x0040): Error: 22 (Invalid argument) (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sdap_save_user] (0x0020): Failed to save user [BQT-PMimon] (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. (Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success id: bqt-pmimon(a)internal.mydomain.com: no such user If I 'id' a working user I get the following: [root@myserver admin]# id bqt-imartin(a)internal.mydomain.com (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=bqt-imartin] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [child_sig_handler] (0x0100): child [14296] finished successfully. (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: myserver$ (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1002][1][idnumber=680800513] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is neutral (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1003][1][name=bqt-imartin] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'production-dc03v.internal.mydomain.com' in files (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'production-dc03v.internal.mydomain.com' in files (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'production-dc03v.internal.mydomain.com' in DNS (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.Prodtown._sites.trainline.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.trainline.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'AD_GC' as 'resolved' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://production-dc03v.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://production-dc03v.internal.mydomain.com:3268' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://production-dc03v.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://production-dc03v.internal.mydomain.com' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [child_sig_handler] (0x0100): child [14297] finished successfully. (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: myserver$ (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 3268 of server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'production-dc03v.internal.mydomain.com' as 'working' (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not remove member [bqt-imartin] from group [name=DLG-SC-vCenter Admin,cn=groups,cn=internal.mydomain.com,cn=sysdb]. Skipping (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute] (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not remove member [bqt-imartin] from group [name=DLG-SC-Linux Admins,cn=groups,cn=internal.mydomain.com,cn=sysdb]. Skipping (Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success uid=680803710(bqt-imartin(a)internal.mydomain.com) gid=680800513(domain users(a)internal.mydomain.com) groups=680800513(domain users(a)internal.mydomain.com) [root@myserver admin]# id bqt-imartin(a)internal.mydomain.com The information in this email (and any attachments) is confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you received this email in error please tell us by reply email (or telephone the sender) and delete all electronic copies on your system or other copies known to you. Trainline Investments Holdings Limited (Registered No.5776685), Trainline.com Limited (Registered No. 3846791) and Trainline International Limited (Registered No. 6881309) are all registered in England and Wales with registered office at 50 Farringdon Road, London, EC1M 3HE.

4 8

Not getting any ticket in ccache in CentOS 6.6
by Ola Nystrom 15 Apr '15

15 Apr '15

I have a problem with getting a krb-ticket when logging in to my CentOS 6.6 server. Any idea on how to troubleshoot? after login with AD-credentionals > [ola@galaxy ~]$ klist > klist: No credentials cache found while retrieving principal name > [ola@galaxy ~]$ sssd --version 1.11.6 kerberos looks like it works, and the same config works on CentOS7.1 sssd -i -d9 log filtered with krb http://pastebin.com/XywvGEmR [ola@galaxy ~]$ kinit Password for ola(a)ENSKEDE.LOCAL: [ola@galaxy ~]$ klist Ticket cache: KEYRING:persistent:11103 Default principal: ola(a)ENSKEDE.LOCAL Valid starting Expires Service principal 04/14/15 19:11:12 04/15/15 05:11:15 krbtgt/ENSKEDE.LOCAL(a)ENSKEDE.LOCAL renew until 04/21/15 19:11:12 my sssd.conf [ola@galaxy ~]$ sudo cat /etc/sssd/sssd.conf [sudo] password for ola: [sssd] domains = ENSKEDE.LOCAL services = nss, pam, pac config_file_version = 2 [domain/ENSKEDE.LOCAL] id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad cache_credentials = true ldap_id_mapping = False ldap_referrals = false krb5_use_kdcinfo = false krb5_store_password_if_offline = true [ola@galaxy ~]$ cat /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = ENSKEDE.LOCAL dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_ccache_name = KEYRING:persistent:%{uid} Any idea on how to troubleshoot? -- Ola Nyström “OSI model jokes work on so many levels” — jorge_rbs

4 19

get ldap user by UPN with full name format
by Dimitar Dimitrov 14 Apr '15

14 Apr '15

Hello everyone. I managed to configure ssh login for users by using pam_sss to our AD. The users use their usePrincipalName to authenticate. The providers for each of the domains are: id_provider = ldap auth_provider = krb5 chpass_provider = krb5 access_provider = ldap For the main domain this configuration works perfectly because the sAMAccountName is the same as the name(the first part from the user(a)domain.tld). But when I tried to configure one of the other domains I stuck in a following problem: The sAMAccountName of the users is differ than the UPN. For example user with UPN "test.linksync(a)linkoffice.fr" has a SAM "LINKSYNC". When I try to get the user info for this by: getent passwd test.linksync(a)linkoffice.fr the authentication providers tries to get the user object from the LDAP with the following filter: [(&(userPrincipalName=test.linksync)(objectclass=user)(userPrincipalName=*)(objectSID=*))] I thing that the problem here is with the id_provider. I tried to configure the re_expression and full_name_format options but they did not change anything in the request filter. Is there а way to change the behavior with which the id_provider gets the user object from the tree. For example I want to ask the ldap with the format user@domain and not only name. For example users logs with "test.linksync(a)linkoffice.fr" and the request for the id should be [(&(userPrincipalName=test.linksync(a)linkoffice.fr)(objectclass=user)(userPrincipalName=*)(objectSID=*))] The problematic configuraion of the domain is the following: [domain/linkoffice.fr] debug_level = 10 cache_credentials = false id_provider = ldap auth_provider = krb5 chpass_provider = krb5 access_provider = ldap use_fully_qualified_names = true ldap_access_filter = memberOf=CN=008 VDI ACCESS,OU=Security,OU=Groups,OU=008,OU=Clients,DC=008dn,DC=domain,DC=tld ldap_uri = ldap://008-010-01.008dn.domain.tld ldap_sasl_mech = GSSAPI ldap_id_mapping = true ldap_schema = ad ldap_referrals = False ldap_search_base = dc=008dn,dc=domain,dc=tld ldap_user_search_base = dc=008dn,dc=domain,dc=tld ldap_user_object_class = user ldap_group_search_base = dc=008dn,dc=domain,dc=tld ldap_group_object_class = group ldap_user_name = userPrincipalName ldap_user_member_of = memberOf ldap_access_order = filter ldap_account_expire_policy = ad ldap_force_upper_case_realm = True krb5_realm = DOMAIN.TLD krb5_canonicalize = False krb5_server = 007-010-01.domain.tld:88 krb5_kpasswd = 007-010-01.domain.tld:88 krb5_use_enterprise_principal = True override_homedir = /home/%d-%u override_shell = /bin/bash Thanks in advance.

2 1

How do I view multiple users groups using sssd?
by Leo K 13 Apr '15

13 Apr '15

SETUP OS = RHEL 6.4 Workstation System is part of a LDAP domain and was originally configured to authenticate using nscd. This is a NON-Windows / NON-Active Directory environment, straight up *NIX. All recommended SSSD packages have been installed. [root@sssd_system]# rpm -qa | grep sssd sssd-client-1.11.6-30.el6_6.4.x86_64 sssd-common-1.11.6-30.el6_6.4.x86_64 sssd-common-pac-1.11.6-30.el6_6.4.x86_64 sssd-krb5-common-1.11.6-30.el6_6.4.x86_64 sssd-ldap-1.11.6-30.el6_6.4.x86_64 sssd-proxy-1.11.6-30.el6_6.4.x86_64 sssd-tools-1.11.6-30.el6_6.4.x86_64 Files which have been created/modified to switch over to SSSD: /etc/nsswitch.conf [root@sssd_system]# ls -ld /etc/nsswitch.conf -rw-r--r-- 1 root root 560 Apr 9 12:07 /etc/nsswitch.conf cat /etc/nsswitch.conf passwd: files sss shadow: files sss group: files sss ethers: files sss services: files sss netgroup: files sss /etc/sssd/sssd.conf [root@sssd_system]# ls -ld /etc/sssd/sssd.conf -rw------- 1 root root 971 Apr 9 11:48 /etc/sssd/sssd.conf cat /etc/sssd/sssd.conf [domain/default] id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_schema = rfc2307bis ldap_uri = ldap://server1.domain.com,ldap://server2.domian.com,ldap://server3.domian.c… ldap_search_base = dc=domain,dc=com ldap_user_search_base = ou=People,dc=domain,dc=com ldap_group_search_base = ou=Group,dc=domain,dc=com ldap_group_member = uniqueMember ldap_id_use_start_tls = False cache_credentials = True ldap_tls_cacertdir = /etc/openldap/cacerts ldap_tls_cacert = /etc/openldap/cacerts/certname.pem debug_level = 9 [sssd] domains = default services = nss,pam,autofs config_file_version = 2 sbus_timeout = 30 [nss] filter_groups = root filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd [pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 [sudo] [autofs] [ssh] NOTE: The authconfig command was used to configure this system, so in theory, that means that all the right files were touch with the correct information. ISSUE [USERID@nscd_host]# groups USERID USERID: USERGRP USERGRP2 USERGRP3 USERGRP4 USERGRP5 [USERID@nscd_host]# ssh USERID@sssd_system Red Hat Enterprise Linux Workstation release 6.4 (Santiago) Last login: Thu Apr 9 11:51:38 2015 from nscd_host [USERID@sssd_system]# groups USERID USERID: USERGRP QUESTION What am I missing? I've been researching the dickens for a solution to what is likely a simple configuration error, but haven't been able to pinpoint the exact config file(s). I've also reference Red Hat's documentation on setting up SSSD in their Deployment Guide and found several helpful guides posted out on the web. And, I've also enabled debug level within sssd.conf file, but have not been able to find anything overtly meaningful within the logs /var/log/sssd/* log file(s) or /var/log/(message|secure) either. Any assistance to what I might be missing would be greatly appreciated. -LK

4 9

sssd - CentOS to Active Directory - no errmsg set and returning 0 results
by Sterling Sahaydak 09 Apr '15

09 Apr '15

***Thanks in advance for taking the time to help and respond! - greatly appreciated!!!! I've setup Active Directory Windows Server 2012 R2 and trying to get ssh and sudo access working from CentOS 6.6 (Final) and using sssd 1.11.6 Note: NOT using Kerberos, samba, adcli,realmd, etc. Using: sssd, pam, nsswitch I'm using also OpenLDAP 2.4.39 and was able to get ssh and sudo working against it, so familar with the process. Now, switching the process to work with AD, I've installed the sudo.schema, rule in AD and added a user, ***but the underlying issue is can't seem to get users to authenticate nor retrieve group information. ldap_search_ext called, msgid = 8 Search result: No such object(32), no errmsg set Search for users, returned 0 results. Failed to retrieve users --------------------------------------------------- [root@ldap users]# cat /etc/*release CentOS release 6.6 (Final) [root@ldap users]# sssd --version 1.11.6 I setup a user in AD with the following configuration attributes: For the User: cn=abrown displayName = Angela Brown distinguishName = CN=abrown,OU=Users,OU=example,DC=ad,DC=example,DC=com gidNunber = 1500 givenName = Angela homeDirectory = /home/abrown mail = abrown(a)example.com objectCategory = CN=Person,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com objectClass = top,organizationPerson,person,user objectGUID = F8 B2 23 2D AD B7 26 48 81 29 D0 DA 3D 00 DC B5 objectSid = 01 05 00 00 00 00 00 05 15 00 00 00 F9 F2 D8 AC AE FF 7F B8 FA EA AC 43 66 06 00 00 primaryGroupID = 513 = (GROUP_RID_USERS) sAMAccountName = abrown sAMAccountType = 805306368 = (NORMAL_USER_ACCOUNT) sn = Brown uid = abrown userPrincipalName = abrown(a)example.com For the Group: cn = allowedusers distinguishName = CN=allowedusers,OU=Groups,OU=example,DC=ad,DC=example,DC=com gidNumber = 1500 member = CN=abrown,OU=Users,OU=example,DC=ad,DC=example,DC=com objectCategory = CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com objectClass = top; group objectGUID = 45 47 DA 79 D7 9E 5E 4B 87 17 E4 7C 71 D0 2E 1F objectSid = 01 05 00 00 00 00 00 05 15 00 00 00 F9 F2 D8 AC AE FF 7F B8 FA EA AC 43 3D 08 00 00 sAMAccountName = allowedusers sAMAccountType = 268435456 = (GROUP_OBJECT) ------------------------------------------ THE ISSUE(S): So, when I run the 'ls -l' command it's not displaying the name for the user = 2000 and Group name = 1500. When I do this connected to OpenLDAP it will display as abrown and allowedusers, but not to AD as shown: [root@ldap users]# ls -l total 24 drwxr-xr-x. 2 2000 1500 4096 Apr 8 13:46 abrown I had to manually add this: mkdir abrown and then: chown 2000:1500 abrown but if I: "getent passwd abrown" - nothing comes back! Running sssd: [root@ldap log]# /usr/sbin/sssd -i ..... (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [be_get_account_info] (0x0100): Got request for [4097][1][idnumber=2000] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [be_req_set_domain] (0x0400): Changing request domain from [LDAP] to [LDAP] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [ou=Users,ou=example,dc=ad,dc=example,dc=com] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uidNumber=2000)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=example,dc=ad,dc=example,dc=com]. (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixUserPassword] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [msSFU30LoginShell] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [displayName] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSid] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 8 (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x1cc4a30], connected[1], ops[0x1cc4990], ldap[0x1cbda50] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0400): Search result: No such object(32), no errmsg set (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040): Failed to retrieve users (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_id_op_done] (0x4000): releasing operation connection (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x1d80d70 (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x1d81850 (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Running timer event 0x1d80d70 "ltdb_callback" (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Destroying timer event 0x1d81850 "ltdb_timeout" (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Ending timer event 0x1d80d70 "ltdb_callback" (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sysdb_search_user_by_uid] (0x0400): No such entry (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x1cc4a30], connected[1], ops[(nil)], ldap[0x1cbda50] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000): dbus conn: 0x1cbe2b0 (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000): Dispatching. (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_message_handler] (0x4000): Received SBUS method [getAccountInfo] (Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit .... ------------------------------- If I take the filter from within the debug of: (&(gidNumber=1500)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0))) and perform a ldapsearch, it pulls back the correct results: [root@ldap ~]# ldapsearch -D "cn=adaccess,ou=adaccts,ou=example,dc=ad,dc=example,dc=com" -w 'password here' -b "DC=ad,DC=example,DC=com" -h adservername.example.com '(&(gidNumber=1500)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0))))' # extended LDIF # # LDAPv3 # base <DC=ad,DC=example,DC=com> with scope subtree # filter: (&(gidNumber=1500)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0)))) # requesting: ALL # # allowedusers, Groups, example, ad.example.com dn: CN=allowedusers,OU=Groups,OU=example,DC=ad,DC=example,DC=com objectClass: top objectClass: group cn: allowedusers member: CN=abrown,OU=Users,OU=example,DC=ad,DC=example,DC=com distinguishedName: CN=allowedusers,OU=Groups,OU=example,DC=ad,DC=example,DC= com instanceType: 4 whenCreated: 20150408174301.0Z whenChanged: 20150408174359.0Z uSNCreated: 81925 uSNChanged: 81931 name: allowedusers objectGUID:: RUfaedeeXkuHF+R8cdAuHw== objectSid:: AQUAAAAAAAUVAAAA+fLYrK7/f7j66qxDPQgAAA== sAMAccountName: allowedusers sAMAccountType: 268435456 groupType: -2147483646 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com dSCorePropagationData: 16010101000000.0Z gidNumber: 1500 # search reference ref: ldap://DomainDnsZones.ad.example.com/DC=DomainDnsZones,DC=ad,DC=example ,DC=com # search reference ref: ldap://ForestDnsZones.ad.example.com/DC=ForestDnsZones,DC=ad,DC=example ,DC=com # search reference ref: ldap://ad.example.com/CN=Configuration,DC=ad,DC=example,DC=com # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 1 # numReferences: 3 -------------------------------------- Setup of sssd.conf [root@ldap sssd]# cat sssd.conf [domain/default] ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=example,dc=com id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://ldap.va.example.com ldap_tls_cacertdir = /etc/pki/tls/certs [sssd] config_file_version = 2 services = nss, pam, sudo domains = LDAP [nss] filter_users = root filter_groups = root [pam] [sudo] [domain/LDAP] access_provider = ldap auth_provider = ldap chpass_provider = ldap id_provider = ldap sudo_provider = ldap debug_level = 9 cache_credentials = true enumerate = false ldap_uri = ldaps://ldapservername.example.com ldap_default_bind_dn = CN=Manager,DC=example,DC=com ldap_default_authtok_type = password ldap_default_authtok = passwordhere ldap_access_filter = ou=users,ou=example,dc=ad,dc=example,dc=com ldap_search_base = dc=example,dc=com ldap_schema = ad ldap_user_principal = userPrincipalName ldap_user_fullname = displayName ldap_user_name = sAMAccountName ldap_user_object_class = user ldap_user_home_directory = unixHomeDirectory ldap_user_shell = msSFU30LoginShell ldap_user_principal = userPrincipalName ldap_user_objectsid = objectSid ldap_group_object_class = group ldap_group_objectsid = objectGUID ldap_sudo_search_base = ou=sudoers,dc=ad,dc=example,dc=com ldap_user_search_base = ou=Users,ou=example,dc=ad,dc=example,dc=com ldap_group_search_base = ou=Groups,ou=example,dc=ad,dc=example,dc=com ldap_tls_cacert = /etc/pki/tls/certs/certnamehere.crt

4 7

automount Problem
by Günther J. Niederwimmer 09 Apr '15

09 Apr '15

Hello, On my system centos 7 my automount is not working. IPA 4.1 sssd 1.12 I have this Error ? automount[1899]: lookup_read_map: lookup(sss): getautomntent_r: No such file or directory have I to configure more in sssd ? Now I have this from ipa autofs_provider = ipa ipa_automount_location = default -- mit freundlichen Grüßen / best Regards, Günther J. Niederwimmer

3 8

default filters for group search
by rone 07 Apr '15

07 Apr '15

>From sssd.conf: ldap_group_search_base = ou=Accounts_Group,dc=corp,dc=example,dc=com >From sssd_LDAP.log: (Thu Apr 2 17:32:32 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(&(cn=admin)(objectclass=group)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))(gidNumber=*))][ou=Accounts_Group,dc=corp,dc=example,dc=com] The hitch here is that our groups (in our Active Directory schema) don't have a gidNumber element, so this returns nothing. Is it possible to change the default filter so that it doesn't go looking for gidNumber=*? thanks rone -- Inanitas inanitatum et omnia inanitas <rone(a)ennui.org>

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users April 2015