sssd-users August 2015

sssd-users@lists.fedorahosted.org

26 participants
26 discussions

System Error 4 with CentOS 7.1 IPA clients attempting password authentication
by Ken Miller 27 Aug '15

27 Aug '15

Hello, I suspect this is a result of outdated software; however, the "Trouble-shooting" guide (URL https://fedorahosted.org/sssd/wiki/Troubleshooting ) requested I post occurrences of "System Error 4" encountered to this list... My IPA Server is RHEL65 running ipa-server-3.0.0-37.el6.x86_64 in a lab environment. Other RHEL65 clients haven't demonstrated this problem, but CentOS71 clients running ipa-client-4.1.0-18.el7.centos.3.x86_64 fail to accept password authentication and report messages similar to the following in /var/log/secure : Aug 24 10:34:49 testhost sshd[17787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=testhost.example.com user=testuser1 Aug 24 10:34:49 testhost sshd[17787]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost= testhost.example.com user=testuser1 Aug 24 10:34:49 testhost sshd[17787]: pam_sss(sshd:account): Access denied for user testuser1: 4 (System error) Aug 24 10:34:49 testhost sshd[17787]: Failed password for testuser1 from 10.10.1.232 port 39617 ssh2 Aug 24 10:34:49 testhost sshd[17787]: fatal: Access denied for user testuser1 by PAM account configuration [preauth] Help much appreciated in tracking down/fixing the root cause. Thanks in advance, == k+ ==

2 5

id command not returning group names. only sid is returned.
by Abhijit Tikekar 26 Aug '15

26 Aug '15

Hi, This is regarding the AD group name resolution in SSSD. We are using SSSD between CentOS and Microsoft AD. Integration works fine and users are able to authenticate without any issues. For SSSD installation, we were just using the Base repo and using yum to install the latest version available. Lately we noticed that after user login, the "id" command returns only the SID's and not the corresponding group name. I checked the installation and made sure no step was missed. This is causing issues when users use "sudo" (We have added specific group names under sudoers and the match fails because no group names were returned.. only SID's) Previously this used to work fine(Version 1.11.6). but the version currently being installed via yum is V 1.12.4. I could not find any reference to such behavior online with respect to V 1.12.4-47 and hence posting here.Has anyone experience similar issues with this version? Please advise. Thanks, ~ Abhi

3 7

Access denied by HBAC Rules
by Baird, Josh 21 Aug '15

21 Aug '15

Hi, I have a situation where an IPA/sssd client is not allowing an AD trusted user to login, even though HBAC rules allow the user: (Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [hbac_attrs_to_rule] (0x1000): Processing rule [allow_eitunixadmins] (Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [hbac_user_attrs_to_rule] (0x1000): Processing users for rule [allow_eitunixadmins] (Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [sysdb_search_users] (0x2000): Search users with filter: (&(objectclass=user)(originalDN=cn=eitunixadmins,cn=groups,cn=accounts,dc=unix,dc=follett,dc=com)) (Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules jbaird@impr-d1-dc01:~$ ipa hbactest User name: jbaird(a)na.follett.lan Target host: imqa-d1-cl05.corp.domain.com Service: ssh -------------------- Access granted: True -------------------- Matched rules: allow_eitunixadmins How would I go about troubleshooting this? Both client and server are running the newest RHEL 7.1.z packages. Thanks, Josh

2 3

Fetching Hosts Entries from OpenLDAP Database
by Rajnesh Kumar Siwal 20 Aug '15

20 Aug '15

Hi , We need to fetch the hosts entries from the OpenLDAP Database. We can use the nslcd, that worlks fine to fetch the hosts entries from the OpenLDAP. How do we configure sssd to fetch the same hosts entries from the LDAP database ? I am not able to figure out hos to set hosts base variable in sssd.conf like : base hosts ou=hosts,dc=example,dc=com -- Thanks, Rajnesh Kumar Siwal

6 9

ad_site syntax
by Ondrej Valousek 20 Aug '15

20 Aug '15

Hi folks, Just testing the ad_site option in sssd.conf - how is this supposed to work? Which syntax is it taking? Long DNS path or just site name? For me, it does not seem to work at all - sssd happily connect to DCs outside of the specified site. Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

2 2

autofs will not find auto.master in LDAP
by Brendan Kearney 18 Aug '15

18 Aug '15

i have a fedora 20 install on a desktop that is working and autofs will read the auto.master from ldap and i can mount the shares specified in auto.shares listed. i have a fedora 20 install on a laptop that will not work and cannot read the auto.master from ldap. i have done everything i can think of to make the 2 as "apples to apples" identical as i can, but still cannot get autofs to read the auto.master from ldap. [root@laptop ~]# automount -fd -vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv Starting automounter version 5.0.7-42.fc20, master map auto.master using kernel protocol version 5.02 lookup_nss_read_master: reading master sss auto.master parse_init: parse(sun): init gathered global options: (null) spawn_mount: mtab link detected, passing -n to mount spawn_umount: mtab link detected, passing -n to mount setautomntent: lookup(sss): setautomntent: No such file or directory lookup_nss_read_master: auto.master not found, replacing '.' with '_' parse_init: parse(sun): init gathered global options: (null) spawn_mount: mtab link detected, passing -n to mount spawn_umount: mtab link detected, passing -n to mount setautomntent: lookup(sss): setautomntent: No such file or directory no mounts in table ^Cautofs stopped i believe i am hung up by the setautomntent: no such file or directory line. the configs are pretty much copied from the working desktop. any help is appreciated. *sssd.conf**:* [sssd] domains = bpk2.com services = nss, pam, sudo, autofs config_file_version = 2 #debug_level = 4 [nss] filter_groups = root filter_users = root [pam] [sudo] [autofs] [domain/bpk2.com] #debug_level = 4 id_provider = ldap ldap_schema = rfc2307bis ldap_uri = _srv_,ldap://ldap1.bpk2.com,ldap://ldap2.bpk2.com ldap_search_base = dc=bpk2,dc=com ldap_sasl_mech = GSSAPI ldap_sasl_authid = host/laptop.bpk2.com ldap_sasl_realm = BPK2.COM auth_provider = krb5 krb5_server = _srv_,kerberos.bpk2.com krb5_realm = BPK2.COM krb5_renewable_lifetime = 7d krb5_lifetime = 24h krb5_renew_interval = 1h krb5_store_password_if_offline = true cache_credentials = true sudo_provider = ldap ldap_sudo_search_base = ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com autofs_provider = ldap ldap_autofs_search_base = cn=autofs,ou=Daemons,dc=bpk2,dc=com ldap_autofs_map_object_class = automountMap ldap_autofs_entry_object_class = automount ldap_autofs_map_name = automountMapName ldap_autofs_entry_key = automountKey ldap_autofs_entry_value = automountInformation #min_id = 1000 #max_id = 2000 enumerate = false *autofs_ldap_auth.conf**:* <?xml version="1.0" ?>  <autofs_ldap_sasl_conf usetls="no" tlsrequired="no" authrequired="yes" authtype="GSSAPI" clientprinc="host/laptop.bpk2.com(a)BPK2.COM" /> */etc/sysconfig/autofs |grep -v \^\#**:* TIMEOUT=300 BROWSE_MODE="no" MOUNT_NFS_DEFAULT_PROTOCOL=4 LDAP_URI="ldap:///dc=bpk2,dc=com" SEARCH_BASE="cn=autofs,ou=Daemons,dc=bpk2,dc=com" MAP_OBJECT_CLASS="automountMap" ENTRY_OBJECT_CLASS="automount" MAP_ATTRIBUTE="automountMapName" ENTRY_ATTRIBUTE="automountKey" VALUE_ATTRIBUTE="automountInformation" AUTH_CONF_FILE="/etc/autofs_ldap_auth.conf" USE_MISC_DEVICE="yes"

4 12

SSSD seriously broken in RHEL 6.7 again?
by Ondrej Valousek 18 Aug '15

18 Aug '15

Hi list, Is sssd broken again in 6.7? It was working fine for me as of 1.11.7 - but that was not official version. Now I upgraded to the latest one (1.12.4-47) hoping I'll be on the official fixed version, and it is even worse. I am experiencing frequent messages like: (Wed Aug 12 17:20:55 2015) [sssd[be[default]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks. (Wed Aug 12 17:20:55 2015) [sssd[be[default]]] [ad_subdomains_root_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline (Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [fo_resolve_service_timeout] (0x0080): Service resolving timeout reached (Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) (Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [be_ptask_enable] (0x0080): Task [Check if online (periodic)]: already enabled (Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks. (Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [ad_subdomains_root_conn_done] (0x0080): No AD server is available, cannot get the subdomain list After cleaning cache, sssd refuses to list all groups for user, etc. Is sssd going to be stable at some stage? This is really disappointing :( Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

4 7

sss_cache fails sometimes
by Ondrej Valousek 18 Aug '15

18 Aug '15

Hi folks, I have just found out that when I try to use sss_cache against some item which is in negative cache (i.e. not found) it does not work. Is this expected behavior? I would expect negative cache is cleared, sssd attempts to go online and get current result. Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

2 1

Load individual group members when ignore_group_members = true
by Tim Biedert 17 Aug '15

17 Aug '15

Hi, I’m using SSSD in Ubuntu 15.04 to connect to my university’s Active Directory. Using ignore_group_members = true speeds things up significantly, that’s great. Now I was wondering: Is there a possibility to make the SSSD load and cache the group members of individual given groups, such that getent group name works again only for certain groups of interest? Thank you very much! Best, Tim

3 2

SSSD-1.12.5 and group membership problem
by Longina Przybyszewska 17 Aug '15

17 Aug '15

Hi, I have an issue with SSSD-1.12.5 with resolving group membership. Only Posix primary group is displayed for users accounts. Group is visible on the system but not displayed from 'id' or 'groups' commands. getent group 30000005 data-adm-lnx-nfs0a-rw-id-00001:*:30000005: getent group data-adm-lnx-nfs0a-rw-id-00001 data-adm-lnx-nfs0a-rw-id-00001:*:30000005: id user1 uid=xxxxxxx(user1) gid=30000000(lnx-primary) groups=30000000(lnx-primary) Group object has Posix gid and is setup as universal group in realm A.C.DOM.ORG: ... gidNumber = 30000005 memberUid: user1, user2 .... I have AD as id_,access_auth_provider. Users have got Posix attributes in AD. Computer and group objects are from the same realm: A.C.DOM.ORG. User objects are in all realms: N.C.DOM.ORG, A.C.DOM.ORG, C.DOM.ORG With my setup I can achieve: - login with short names across realm - access kerberized nfs homedir Is there a way to resolve correctly group's membership with this setup?? My sssd.conf : [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd [sssd] debug_level = 6 domains = n.c.dom.org,a.c.dom.org,c.dom.org config_file_version = 2 services = nss,pam,ssh [pam] pam_verbosity = 3 debug_level = 9 [domain/n.c.dom.org] debug_level = 9 dyndns_update = false id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ad_domain = n.c.dom.org krb5_realm = N.C.DOM.ORG #cache_credentials = True default_shell = /bin/bash use_fully_qualified_names = False ldap_id_mapping = False subdomains_provider = none ad_gpo_access_control = disabled [domain/a.c.dom.org] debug_level = 9 dyndns_update = false id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ad_domain = a.c.dom.org krb5_realm = A.C.DOM.ORG default_shell = /bin/bash use_fully_qualified_names = False ldap_id_mapping = False subdomains_provider = none ad_gpo_access_control = disabled [domain/c.dom.org] debug_level = 9 dyndns_update = true dyndns_update_ptr = false ad_hostname = adm-lnx101.a.c.dom.org id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ad_domain = c.dom.org krb5_realm = C.DOM.ORG default_shell = /bin/bash use_fully_qualified_names = False ldap_id_mapping = False subdomains_provider = none ad_gpo_access_control = disabled Best, longina [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd #override_home_directory = /home/%u [sssd] debug_level = 6 domains = nat.c.sdu.dk,adm.c.sdu.dk,c.sdu.dk #default_domain_suffix = c.sdu.dk config_file_version = 2 services = nss,pam [pam] pam_verbosity = 3 debug_level = 9 [domain/LOCAL] description = local machine accounts id_provider = local enumerate = true min_id = 101 max_id = 1100 [domain/nat.c.sdu.dk] debug_level = 9 dyndns_update = false id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ad_domain = nat.c.sdu.dk krb5_realm = NAT.C.SDU.DK #cache_credentials = True #krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = False ldap_id_mapping = False subdomains_provider = none [domain/adm.c.sdu.dk] debug_level = 9 dyndns_update = false id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ad_domain = adm.c.sdu.dk krb5_realm = ADM.C.SDU.DK #cache_credentials = True #krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = False ldap_id_mapping = False subdomains_provider = none [domain/c.sdu.dk] debug_level = 9 dyndns_update_ptr = false id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ad_domain = c.sdu.dk krb5_realm = C.SDU.DK #cache_credentials = True #krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = False ldap_id_mapping = False subdomains_provider = none dyndns_update = true ad_hostname = test-lnx03.a.c.dom.org The topology of Mange hilsner Longina

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2015