sssd-users December 2016

sssd-users@lists.fedorahosted.org

26 participants
25 discussions

Re: SSSD, Password Policy, Service Accounts
by Douglas Duckworth 13 Dec '16

13 Dec '16

Lukas You're the best. So I removed the existing account used for binds and added it back with this entry: pwdPolicySubentry: cn=CustomBindAccountPolicy,ou=Policies,DN The custom policy: dn: cn=CustomBindAccountPolicy,ou=Policies,DN objectClass: pwdPolicy objectClass: person objectClass: top cn: passwordDefault sn: passwordDefault pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 0 pwdLockout: FALSE Moreover, I am now using the following settings in /etc/sysconfig/ldap: SLAPD_LDAP=yes <-- previously disabled so no Start TLS via TCP 389 was allowed. SLAPD_LDAPI=yes SLAPD_LDAPS=yes sssd.conf: ldap_uri = ldap://provider ldap_backup_uri = ldap://consumer ldap_default_bind_dn = uid=woohoo,ou=topsecret,DN ldap_default_authtok_type = password ldap_default_authtok = toolongtocrack ldap_search_base = DN ldap_tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer client sssd log: (Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as: uid=woohoo,ou=topsecret,DN (Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'provider' as 'working' (Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'provider' as 'working' provider /var/log/ldap: Dec 13 12:25:58 suntzu slapd[2614]: => bdb_entry_get: found entry: "uid=woohoo,ou=topsecret,DN" Dec 13 12:25:58 suntzu slapd[2614]: => bdb_entry_get: found entry: ""cn=custombindaccountpolicy,ou=policies,DN" Dec 13 12:25:58 suntzu slapd[2614]: => access_allowed: auth access to "uid=woohoo,ou=topsecret,DN" "userPassword" requested Dec 13 12:25:58 suntzu slapd[2614]: => acl_mask: access to entry ""uid=woohoo,ou=topsecret,DN, attr "userPassword" requested Dec 13 12:25:58 suntzu slapd[2614]: conn=1004 op=1 BIND dn="uid=woohoo,ou=topsecret,DN" mech=SIMPLE ssf=0 I then did several ldapsearches with the account used for binding. The account's not locked out even though I supplied the wrong password each time. I have halted both LDAP servers and it seems sssd cache with both autofs and my user / group attributes are working! However, I would like to be notified interactively that the LDAP servers are down. Can I have PAM let the user know upon login that the SSSD cache happens to be "active?" Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Mon, Dec 12, 2016 at 4:18 PM, Lukas Slebodnik <lslebodn(a)redhat.com> wrote: > On (12/12/16 15:38), Douglas Duckworth wrote: > >Hello > > > >I am nearly finished building new LDAP cluster using SSSD for clients. > > > >I have a password policy set which will lock out accounts upon bind > failure: > > > >dn: ou=Policies,dc=blah > >ou: Policies > >objectClass: organizationalUnit > > > >dn: cn=passwordDefault,ou=Policies,dc=blah > >objectClass: pwdPolicy > >objectClass: person > >objectClass: top > >cn: passwordDefault > >sn: passwordDefault > >pwdAttribute: userPassword > >pwdCheckQuality: 0 > >pwdMinAge: 0 > >pwdMaxAge: 365 > >pwdMinLength: 15 > >pwdInHistory: 5 > >pwdMaxFailure: 3 > >pwdFailureCountInterval: 0 > >pwdLockout: TRUE > >pwdLockoutDuration: 0 > >pwdAllowUserChange: TRUE > >pwdExpireWarning: 320 > >pwdGraceAuthNLimit: 0 > >pwdMustChange: TRUE > >pwdSafeModify: FALSE > > > >I am using an account for binding with LDAP since my OpenLDAP ACLs > disallow > >anon binds. My concern about this is that if a malicious user was to > start > >attempting binds with the bind account, then they could lock out this > >important user thus bring down SSSD binding for all of my clients. I do > >not want. > > > >sssd.conf: > > > >ldap_uri = ldaps://provider > >ldap_backup_uri = ldaps://consumer > >ldap_default_bind_dn = uid=user,ou=sysadmin,dc=blah > >ldap_default_authtok_type = password > >ldap_default_authtok = longpass > >ldap_search_base = dc=blah > >ldap_tls_reqcert = demand > >ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer > > > >This should probably be sent to another list though anyone know if its > >possible to exempt a single user from the above password policy so > >that pwdLockout would not apply? > > > I assume that other users are in different tree and not in > ou=sysadmin,dc=blah. > They would need to guess default bind DN because only root can raed > sssd.conf > otherwisee sssd would not start. > > And if you are really worry about password policy for bind account then > you can use custom policy for this account. > > dn: uid=user,ou=sysadmin,dc=blah > objectClass: account > objectClass: posixAccount > cn: user > uidNumber: 12345 > gidNumber: 12345 > userPassword: {SSHA}aaaaaaaaaaaaaaaaaaaaaaaaaa > objectClass: pwdPolicy > pwdAttribute: userPassword > pwdPolicySubentry: cn=customBindAccoundPolicy,ou=policies,$DS_BASE_DN > > I didn't test that. > > BTW you needn't use ldaps in ldap_uri because sssd would use start_tls > anyway > for bind and there are known issues with ldaps and failover. > > LS > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org >

1 0

Unable to login with SSH
by E. Clapton 13 Dec '16

13 Dec '16

I'm trying to connect my server to a LDAP server. I get a correct answer after using *id* and *ldapsearch* commands. However, i still not able to login with SSH. I can see on sssd_LDAP.log file that the server has received the request to login with the user (myuser), but the request was rejected. tail -f /var/log/sssd/sssd_LDAP.log (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1001][FAST BE_REQ_USER][1][name=omri_w] (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [get_server_status] (0x0100): Hostname resolution expired, resetting the server status of 'ldap21v.walla.co.il' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'ldap21v.walla.co.il' as 'name not resolved' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'ldap21v.walla.co.il' in files (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'ldap21v.walla.co.il' as 'resolving name' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'ldap21v.walla.co.il' in files (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'ldap21v.walla.co.il' in DNS (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'ldap21v.walla.co.il' as 'name resolved' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_resolve_server_process] (0x0200): Found address for server ldap21v.walla.co.il: [192.168.50.21] TTL 600 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_get_server_opts_from_rootdse] (0x0020): ldap_rootdse_last_usn configured but not found in rootdse! (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'ldap21v.walla.co.il' as 'working' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'ldap21v.walla.co.il' as 'working' (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success) (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x1003][FAST BE_REQ_INITGROUPS][1][name=myuser] (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_initgr_nested_send] (0x0100): User entry lacks original memberof ? (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success) (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][1][name=myuser] (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_initgr_nested_send] (0x0100): User entry lacks original memberof ? (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Success) (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: myuser (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser: (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: 192.118.68.5 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 2208 (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 7, <NULL>) [Success (Authentication failure)] (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [7][LDAP] (Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent result [7][LDAP] Does anyone know what is the issue?

5 19

SSSD, Password Policy, Service Accounts
by Douglas Duckworth 12 Dec '16

12 Dec '16

Hello I am nearly finished building new LDAP cluster using SSSD for clients. I have a password policy set which will lock out accounts upon bind failure: dn: ou=Policies,dc=blah ou: Policies objectClass: organizationalUnit dn: cn=passwordDefault,ou=Policies,dc=blah objectClass: pwdPolicy objectClass: person objectClass: top cn: passwordDefault sn: passwordDefault pwdAttribute: userPassword pwdCheckQuality: 0 pwdMinAge: 0 pwdMaxAge: 365 pwdMinLength: 15 pwdInHistory: 5 pwdMaxFailure: 3 pwdFailureCountInterval: 0 pwdLockout: TRUE pwdLockoutDuration: 0 pwdAllowUserChange: TRUE pwdExpireWarning: 320 pwdGraceAuthNLimit: 0 pwdMustChange: TRUE pwdSafeModify: FALSE I am using an account for binding with LDAP since my OpenLDAP ACLs disallow anon binds. My concern about this is that if a malicious user was to start attempting binds with the bind account, then they could lock out this important user thus bring down SSSD binding for all of my clients. I do not want. sssd.conf: ldap_uri = ldaps://provider ldap_backup_uri = ldaps://consumer ldap_default_bind_dn = uid=user,ou=sysadmin,dc=blah ldap_default_authtok_type = password ldap_default_authtok = longpass ldap_search_base = dc=blah ldap_tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer This should probably be sent to another list though anyone know if its possible to exempt a single user from the above password policy so that pwdLockout would not apply? Thanks Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

2 1

Sending sssd.log to syslog
by Ali, Saqib 09 Dec '16

09 Dec '16

Hello, How do I configure SSSD to send sssd.log logs to syslog? I would like to include the DEBUB SSSD logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send syslog to Splunk Security Module. So we would like to use that setup, instead of the Splunk Forwarder. Thanks, Saqib

4 3

Multiple mount autofs/sssd
by john lehardos 07 Dec '16

07 Dec '16

Hello, I am looking for a solution to mount two different NFS exports on a same mountpoint in order to have this kind of configuration server1:/path on /s/work server2:/path on /s/work /s/work : - fileA_server1 - fileB_server1 - fileA_server2 - fileB_server2 The /s/work mountpoint is provided by autofs/sssd and the map is on an LDAP autofs OU. I have tried many solutions, but I want to avoid the symlink to another mounted directory solution. Can anyone help ? thanks, J

3 6

ubuntu sssd initial setup pam(?) problem
by Johan Kragsterman 06 Dec '16

06 Dec '16

Hi! As an LDAP newbie(but not a UNIX newbie) I try to setup a test environment. I use OpenDJ from Forgerock, and sssd on Ubuntu 16.10. System info further down. I think I got a working server setup, I got a test user "sven" that I can find with various methods like: sudo ldapsearch -xv -h ldap -LLL -b "dc=hemma,dc=home" uid=sven ldap_initialize( ldap://ldap ) filter: uid=sven requesting: All userApplication attributes dn: uid=sven,ou=People,dc=hemma,dc=home objectClass: person objectClass: inetOrgPerson objectClass: posixAccount objectClass: organizationalPerson objectClass: top gidNumber: 1003 uid: sven sn: Persson cn: SvenP initials: SPE description: This is the description for Sven Persson, test user givenName: Sven homeDirectory: /mnt/nfs/home/sven uidNumber: 1003 or: id sven uid=1003(sven) gid=1003(sven) groups=1003(sven) or: getent passwd sven sven:*:1003:1003:SvenP:/mnt/nfs/home/sven: or: getent group sven sven:*:1003:sven BUT! NOT with getent shadow. and: I can't login, not on the workstation, nor with ssh or su user. I got a strong feeling it is PAM... Here are some lines from /var/log/auth.log when I tried su user: Dec 6 11:29:34 GX620 su[2069]: pam_unix(su:auth): authentication failure; logname=bo uid=1000 euid=0 tty=/dev/pts/1 ruser=bo rhost= user=sven Dec 6 11:29:34 GX620 su[2069]: pam_sss(su:auth): authentication failure; logname=bo uid=1000 euid=0 tty=/dev/pts/1 ruser=bo rhost= user=sven Dec 6 11:29:34 GX620 su[2069]: pam_sss(su:auth): received for user sven: 6 (Permission denied) Dec 6 11:29:34 GX620 su[2069]: pam_ldap: ldap_simple_bind Can't contact LDAP server Dec 6 11:29:34 GX620 su[2069]: pam_ldap: reconnecting to LDAP server... Dec 6 11:29:34 GX620 su[2069]: pam_ldap: ldap_simple_bind Can't contact LDAP server Dec 6 11:29:36 GX620 su[2069]: pam_authenticate: Authentication failure Dec 6 11:29:36 GX620 su[2069]: FAILED su for sven by bo System information: System: Ubuntu 16.10 sssd version: 1.13.4 LDAP server OpenDJ 3.0 sssd.conf: ~$ sudo cat /etc/sssd/sssd.conf [sssd] config_file_version = 2 services = nss,pam domain = HEMMA.HOME [nss] filter_users = root filter_groups = root [pam] [domain/HEMMA.HOME] autofs_provider = ldap ldap_schema = rfc2307bis ldap_search_base = dc=hemma,dc=home id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_tls_reqcert = never ldap_uri = ldap://ldap:389 ldap_id_use_start_tls = False cache_credentials = True enumerate = True PAM: ~$ cat /etc/pam.d/common-session # # /etc/pam.d/common-session - session-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define tasks to be performed # at the start and end of sessions of *any* kind (both interactive and # non-interactive). # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # The pam_umask module will set the umask according to the system default in # /etc/login.defs and user settings, solving the problem of different # umask settings with different shells, display managers, remote sessions etc. # See "man pam_umask". session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session optional pam_sss.so session optional pam_ldap.so session optional pam_systemd.so session optional pam_cgfs.so -c freezer,memory,name=systemd # end of pam-auth-update config When I google around, there are not much good information about sssd in ubuntu. I see a suggestion of using /etc/auth-client-config/profile.d/sss, it seems to be instead of nsswitch and pam. Someone know something about that? Haven't tried it yet, await some feedback from this list first. Best regards from/Med vänliga hälsningar från Johan Kragsterman Capvert

2 3

Re: n-way multi master and mirror mode
by Brendan Kearney 06 Dec '16

06 Dec '16

On 12/05/2016 11:36 AM, brendan kearney wrote: > will do so later today. seems pretty consistent, so I should have > logs for the sssd mailing list > > On Dec 5, 2016 11:12 AM, "Jakub Hrozek" <jakub.hrozek(a)posteo.se > <mailto:jakub.hrozek@posteo.se>> wrote: > > On Sun, Dec 04, 2016 at 11:03:25PM +0000, Howard Chu wrote: > > Brendan Kearney wrote: > > > On 12/04/2016 04:49 PM, Quanah Gibson-Mount wrote: > > > > Again, Mirror Mode is a concept, not a setting. The setting > you refer to, > > > > is, as I previously noted, misnamed. Either your servers > are configured to > > > > do multimaster replication, or they aren't. > > > > Mirrormode - the concept - is irrelevant here. All of the > official docs show > > the mirrormode setting being used in N-Way multimaster. > > > > > yes, i seem to be in the trap about the mirror mode misnomer. > though > > > ambiguous, your statements indicate that mirror mode the > setting is required > > > for n-way multi master replication. > > > > That is what the Admin Guide already says. > > > > > > i agree most of my traffic is reads. i have 7 examples of > connections with > > > deferred operations. they are all SRCH's (i.e. reads). I > seem to misrember > > > the source of the deferred connections. bind-dyndb-ldap does > not show in my > > > logs. sssd access is what 6 of 7 examples show. below is one > sample. > > > > This is just due to sssd being very poorly written. It spews out > a bunch of > > LDAP requests without waiting for replies. It then abandons N-1 > of the > > requests as soon as it reads the first reply. And then it > reissues the > > remaining requests, over and over. Instead it should just wait a > little > > longer for all the replies, instead of abandoning and > resubmitting the same > > requests and wasting redundant work. > > This is not how sssd is supposed to work, judging by the searches and > the searches being for all the same modifyTimestamp values, it looks > like a bug in sssd. > > If you can reproduce this on-demand, could you please correlate logs > from the [domain] section and the [sudo] section of sssd.conf (the > higher the debug_level, the better, but at least 8, please) with the > server-side logs? > > btw the sssd-users mailing list might be a better place to debug sssd. > > In general I agree with Howard that sssd is at fault here, but at the > same time I don't think this is expected activity. We've seen a report > like this in the past, but could never reproduce it or get better > debug > logs, so maybe you could help us trace this bug down? > > > > > > ReceivedAt FromHost SysLogTag Message > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 fd=29 > ACCEPT from > > > IP=192.168.88.4:59233 <http://192.168.88.4:59233> > (IP=192.168.88.1:389 <http://192.168.88.1:389>) > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 > SRCH base="" > > > scope=0 deref=0 filter="(objectClass=*)" > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 > SRCH attr=* > > > altServer namingContexts supportedControl supportedExtension > supportedFeatures > > > supportedLDAPVersion supportedSASLMechanisms > domainControllerFunctionality > > > defaultNamingContext lastUSN highestCommittedUSN > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 > SEARCH RESULT > > > tag=101 err=0 nentries=1 text= > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1 > BIND dn="" > > > method=163 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1 > RESULT tag=97 > > > err=14 text=SASL(0): successful result: > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2 > BIND dn="" > > > method=163 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2 > RESULT tag=97 > > > err=14 text=SASL(0): successful result: > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 > BIND dn="" > > > method=163 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND > > > authcid="host/hypervisor.bpk2.com(a)BPK2.COM > <mailto:hypervisor.bpk2.com@BPK2.COM>" > > > authzid="host/hypervisor.bpk2.com(a)BPK2.COM > <mailto:hypervisor.bpk2.com@BPK2.COM>" > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND > > > dn="cn=hypervisor,ou=computers,dc=bpk2,dc=com" mech=GSSAPI > sasl_ssf=56 ssf=56 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 > RESULT tag=97 > > > err=0 text= > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:00 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:00 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:00 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:00 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:00 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:00 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=11 > ABANDON msg=5 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=12 > ABANDON msg=6 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=13 > ABANDON msg=7 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=14 > ABANDON msg=8 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=15 > ABANDON msg=9 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=16 > ABANDON msg=10 > > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=17 > ABANDON msg=11 > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=21 > ABANDON msg=19 > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=22 > ABANDON msg=20 > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=23 > ABANDON msg=21 > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:03 PM server1 slapd[5033]: > connection_input: conn=2434 > > > deferring operation: too many executing > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=30 > ABANDON msg=25 > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=31 > ABANDON msg=26 > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=32 > ABANDON msg=27 > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=33 > ABANDON msg=28 > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=34 > ABANDON msg=29 > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=35 > ABANDON msg=30 > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=37 > ABANDON msg=37 > > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=39 > ABANDON msg=39 > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH > > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > > > > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > > > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH > > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption > sudoRunAs > > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter > sudoOrder modifyTimestamp > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=43 > ABANDON msg=41 > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=44 > ABANDON msg=42 > > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=45 > ABANDON msg=43 > > > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 op=46 > UNBIND > > > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 fd=29 > closed > > > > > > > > > > > > > > > -- > > -- Howard Chu > > CTO, Symas Corp. http://www.symas.com > > Director, Highland Sun http://highlandsun.com/hyc/ > > Chief Architect, OpenLDAP http://www.openldap.org/project/ > <http://www.openldap.org/project/> > > > moving this to sssd-users... i am setting up the logging. what system should have log levels increased to 8 in sssd.conf? the servers, a client, all?

2 2

autofs bogus option
by john lehardos 05 Dec '16

05 Dec '16

Hello, I am getting crazy on a parse error on an automount map (syntax error). Can you please help me to highlight were is the error or what are the best practices on on mounting an NFS path tree ? My logs : Dec 05 13:06:49 inflin01.super.int automount[17148]: using kernel protocol version 5.02 Dec 05 13:06:49 inflin01.super.int automount[17148]: lookup(file): file map /etc/auto.master_animfr missing or not readable Dec 05 13:06:49 inflin01.super.int automount[17148]: syntax error in map near [ prods -fstype=nfs,rw,bg,hard,intr,tcp,vers=3 animnas: ] Dec 05 13:06:49 inflin01.super.int automount[17148]: syntax error in map near [ root ] Dec 05 13:06:49 inflin01.super.int automount[17148]: syntax error in map near [ Prods ] Dec 05 13:06:49 inflin01.super.int automount[17148]: mounted indirect on /misc with timeout 3600, freq 900 seconds Dec 05 13:06:49 inflin01.super.int automount[17148]: ghosting enabled Dec 05 13:06:49 inflin01.super.int automount[17148]: mounted indirect on /net with timeout 3600, freq 900 seconds Dec 05 13:06:49 inflin01.super.int automount[17148]: ghosting enabled Dec 05 13:06:49 inflin01.super.int systemd[1]: Started Automounts filesystems on demand. My maps : dn: ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr ou: auto.master_animfr objectClass: automountMap objectClass: top dn: cn=/homes,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr automountInformation: ldap:ou=auto.home,ou=autofs,dc=superimage,dc=fr --timeout=3600 cn: /homes objectClass: automount objectClass: top dn: ou=auto.s,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr ou: auto.s objectClass: automountMap objectClass: top dn: cn=apps,ou=auto.s,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr cn: apps description: auto.s objectClass: automount objectClass: top automountInformation: -fstype=nfs,noatime,hard,intr,nosuid appserv.super.int:/vol/apps dn: cn=prods,ou=auto.s,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr cn: prods objectClass: automount objectClass: top automountInformation: -fstype=nfs,rw,bg,hard,intr,tcp,vers=3 animnas:/root/Prods many thanks, J

2 2

Authenticating to either AD and KRB5/LDAP domains using separate domains and PAM stacks?
by Robert Sturrock 05 Dec '16

05 Dec '16

Hi All. I’m trying to craft a configuration (on RHEL7, sssd-1.13.0-40.el7_2.12.x86_64) that will offer the following: - authenticate a specific application (‘app’) via PAM/sssd to our AD directory (EXAMPLE.COM) - authenticate everything else (in particular, sshd) via PAM/sssd to our UNIX-based Kerberos/LDAP directory (UNIXAUTH.EXAMPLE.COM) Note that users have the same username in both directories, but have different passwords and different group membership. The config I’m using to achieve this is: ---------- [sssd] config_file_version = 2 services = nss, pam domains = example.com, unixauth.example.com [nss] filter_groups = root filter_users = root default_shell = /bin/bash override_homedir = /home/%u [pam] [domain/example.com] id_provider = ad auth_provider = ad chpass_provider = ad access_provider = permit cache_credentials = true ldap_idmap_range_size = 200000000 dyndns_update = false ignore_group_members = true debug_level = 7 [domain/unixauth.example.com] debug_level = 9 id_provider = ldap auth_provider = krb5 access_provider = ldap chpass_provider = none sudo_provider = none authfs_provider = none dns_discovery_domain = unixauth.example.com lookup_family_order = ipv4_only enumerate = true ldap_uri = _srv_ ldap_default_bind_dn = cn=UNIX Manager,ou=admin,o=example ldap_default_authtok = XXXXXXXXXXXXXXX ldap_id_use_start_tls = true ldap_access_filter = (isMemberOf=cn=systems,ou=roles,o=example) ldap_user_search_base = ou=people,o=example?subtree?(|(isMemberOf=cn=systems,ou=roles,o=example)) ldap_group_search_base = ou=unix,o=example ldap_schema = rfc2307 ldap_tls_reqcert = never ldap_tls_cacertfile = /etc/openldap/cacerts/unixauth-ca-bundle.crt # Get all the settings from /etc/krb5.conf krb5_realm = UNIXAUTH.EXAMPLE.COM ————— In addition, I’m specifying: - ‘pam_sss.so […] domains=example.com’ in /etc/pam.d/app - ‘pam_sss.so […] domains=unixauth.example.com’ in /etc/pam.d/system-auth This configuration works to a point. The ‘app’ auth works correctly using AD credentials. However, although I can ssh-in to the host with my ‘unixauth.example.com’ credentials successfully as I want, my *group* membership is coming from AD (example.com) *instead of* LDAP (unixauth.example.com)! Should it be possible to setup the configuration I describe? If so, are there some settings I’m missing to make this work? Regards, Robert.

2 1

problems to get sssd started
by Johan Kragsterman 04 Dec '16

04 Dec '16

Hi! I'm a newbie on sssd, and not fancy at ldap either. So I'm starting with this in a small way to see where I can get it. I've been googling quite extensively the last 3 days, and haven't found any answers. System: Ubuntu 16.10 sssd version: 1.13.4 LDAP server OpenDJ sssd.conf: ~$ sudo cat /etc/sssd/sssd.conf [sssd] config_file_version = 2 services = nss,pam domain = HEMMA.HOME [nss] #Not authenticated usr from ldap filter_users = root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,deamon,games,gdm,gnats,haldeamon,hplip,irc,ivm,an,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,polkituser,proxy,pulse,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data filter_groups = root [pam] [domain/HEMMA.HOME] autofs_provider = ldap ldap_schema = rfc2307bis ldap_search_base = dc=hemma,dc=home id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap:389 ldap_id_use_start_tls = False cache_credentials = True enumerate = True PAM: ~$ cat /etc/pam.d/common-session # # /etc/pam.d/common-session - session-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define tasks to be performed # at the start and end of sessions of *any* kind (both interactive and # non-interactive). # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # The pam_umask module will set the umask according to the system default in # /etc/login.defs and user settings, solving the problem of different # umask settings with different shells, display managers, remote sessions etc. # See "man pam_umask". session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session optional pam_sss.so session optional pam_ldap.so session optional pam_systemd.so session optional pam_cgfs.so -c freezer,memory,name=systemd # end of pam-auth-update config ~$ sudo service sssd restart Job for sssd.service failed because the control process exited with error code. See "systemctl status sssd.service" and "journalctl -xe" for details. ~$ sudo systemctl status sssd.service ● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since lör 2016-12-03 17:37:15 CET; 25s ago Process: 2236 ExecStart=/usr/sbin/sssd -D -f (code=exited, status=4) dec 03 17:37:15 GX620 systemd[1]: Starting System Security Services Daemon... dec 03 17:37:15 GX620 sssd[2236]: SSSD couldn't load the configuration database [2]: No such file or directory. dec 03 17:37:15 GX620 systemd[1]: sssd.service: Control process exited, code=exited status=4 dec 03 17:37:15 GX620 systemd[1]: Failed to start System Security Services Daemon. dec 03 17:37:15 GX620 systemd[1]: sssd.service: Unit entered failed state. dec 03 17:37:15 GX620 systemd[1]: sssd.service: Failed with result 'exit-code'. The only real problem I can see, is the: "dec 03 17:37:15 GX620 sssd[2236]: SSSD couldn't load the configuration database [2]: No such file or directory" And I don't understand why sssd couldn't load it. I ran: ~$ sudo ldbsearch -H /var/lib/sss/db/config.ldb server_sort:Unable to register control with rootdse! # record 1 dn: cn=HEMMA.HOME,cn=domain,cn=config auth_provider: ldap autofs_provider: ldap cache_credentials: True chpass_provider: ldap cn: HEMMA.HOME enumerate: True id_provider: ldap ldap_id_use_start_tls: False ldap_schema: rfc2307bis ldap_search_base: dc=hemma,dc=home ldap_uri: ldap://ldap:389 distinguishedName: cn=HEMMA.HOME,cn=domain,cn=config # record 2 dn: cn=sssd,cn=config cn: sssd config_file_version: 2 domain: HEMMA.HOME services: nss,pam distinguishedName: cn=sssd,cn=config # record 3 dn: cn=config version: 2 lastUpdate: 1480690424 distinguishedName: cn=config # record 4 dn: cn=nss,cn=config cn: nss filter_groups: root filter_users: root distinguishedName: cn=nss,cn=config # record 5 dn: cn=pam,cn=config cn: pam distinguishedName: cn=pam,cn=config # returned 5 records # 5 entries # 0 referrals And I can't see any problems there, except the "server_sort:Unable to register control with rootdse!" which I read in posts was not supposed to be a real problem. Or...? Anyone can help me out a bit here...? Best regards from/Med vänliga hälsningar från Johan Kragsterman Capvert

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users December 2016