sssd-users March 2016

sssd-users@lists.fedorahosted.org

24 participants
19 discussions

sssd not automatically switching to online mode when dns becomes available
by Robert Bayerl 23 Mar '16

23 Mar '16

When using dnsmasq as a local caching nameserver, sssd does not recover if it is started before DNS is available. Steps to reproduce: stop local caching nameserver stop/start sssd start local caching nameserver sssd never switches to online mode or retries the DNS lookup for the SRV record.

3 5

access_provider is completely ignored
by Josh England 17 Mar '16

17 Mar '16

I have sssd doing authentication through ldap and I actually have a working configuration that uses access_provider=ldap and ldap_access_filter and does the right thing on CentOS 6.4. On another system (CentOS 6.7) the exact same configuration does not work. Access is granted at all times no matter what. In fact, I can put in access_provider=deny, and access is still granted. Is there some dependency that I got right on the first system that is incorrect on this one? I can post logs if needed. Relevant info for non-working system: OS: CentOS 6.7 x86_64 sssd version: 1.12.4-47 (also tried 1.13.3 built from source) sssd.conf: [domain/ldap] ldap_schema = rfc2307 ldap_search_base = dc=DOMAIN id_provider = ldap auth_provider = ldap chpass_provider = ldap access_provider = deny ldap_uri = ldaps://LDAP_SERVER1,ldaps://LDAP_SERVER2 cache_credentials = True ldap_id_use_start_tls = True ldap_tls_cacertdir = /etc/openldap/cacerts [sssd] config_file_version = 2 services = nss, pam debug_level = 1 domains = ldap [nss] debug_level = 1 [pam] debug_level = 1 /etc/nsswitch.conf (relevant bits): passwd: sss files shadow: sss files group: sss files services: files sss netgroup: files sss ldap /etc/pam.d/system-auth: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so Thank you for any help, -JE

3 8

sssd+ldap and client certificates
by Graham Leggett 17 Mar '16

17 Mar '16

Hi all, I have a 389ds server that uses a certmap to map client certificates to a valid bind, and this works fine. I am struggling to get sssd on ubuntu trusty to use a client certificate to talk to this server, and I don't know what I'm doing wrong. My /etc/sssd/sssd.conf looks like below. [sssd] config_file_version = 2 domains = LDAP services = nss, pam [nss] filter_groups = root filter_users = root reconnection_retries = 3 entry_cache_timeout = 300 entry_cache_nowait_percentage = 75 [pam] reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 # A native LDAP domain [domain/LDAP] enumerate = true cache_credentials = TRUE debug_level = 9 id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://ldap.example.com:636 ldap_user_search_base = dc=example,dc=com tls_reqcert = demand ldap_tls_cacert = /etc/ssl/certs/root-ca.crt ldap_tls_cert = /etc/ssl/certs/my.crt ldap_tls_key = /etc/ssl/private/my.key ldap_sasl_mech = EXTERNAL When sssd attempts to connect to the LDAP server, first it connects and makes an anonymous bind, which the server refuses. sssd then tries to make a SASL EXTERNAL bind, which fails claiming external isn't a valid bind method. (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0400): Search result: Inappropriate authentication(48), Anonymous access is not allowed. (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Inappropriate authentication(48), Anonymous access is not allowed. (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_server_opts_from_rootdse] (0x0200): No known USN scheme is supported by this server! (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x1000): the connection will expire at 1458231814 (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: EXTERNAL, user: (null) (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-6)[Unknown authentication method] (Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-4): no mechanism available: ] From what I can see, there is no attempt to use the client certificate at all. Can anyone point out where I am going wrong? Regards, Graham --

2 1

access_provider is completely ignored
by Josh England 15 Mar '16

15 Mar '16

I'm using sssd along with ldap for user authentication and some access control. On an older CentOS 6.4 setup, I have used access_provider=ldap along with ldap_access_filter with success. However, on a newer system using CentOS 6.7 with the same configuration, I cannot get access control working. All users are granted access regardless of the access_provider setting. I've tried ldap, simple, and even deny and none of them work on the newer box. I've tried building the latest version from source to no avail and looking through logs with higher debug level doesn't provide any clues (to me). What are some things I can check to try to debug this? -JE

1 0

Re: Could not convert objectSID [...] to a UNIX ID
by Francis, Arthur 14 Mar '16

14 Mar '16

This combination also works well on our very large AD: ldap_idmap_range_min = 200000 ldap_idmap_range_max = 2000200000 ldap_idmap_range_size = 1000000 _____________ The information contained in this message is proprietary and/or confidential. If you are not the intended recipient, please: (i) delete the message and all copies; (ii) do not disclose, distribute or use the message in any manner; and (iii) notify the sender immediately. In addition, please be aware that any message addressed to our domain is subject to archiving and review by persons other than the intended recipient. Thank you.

1 0

SSSD ad mode issues version sssd-1.12.4-47.el6_7.7.x86_64
by Fabien CARRE 11 Mar '16

11 Mar '16

Hello, I am experiencing some issues with this version of sssd in ad mode. I am unable to connect to a computer. But when using the previous version on another computer (sssd-1.11.6-30.el6.x86_64) it's working fine. DC : Windows 2012R2 client 1 : centos 6.6 - sssd-1.11.6-30.el6.x86_64 client 2 centos 6.7- sssd-1.12.4-47.el6_7.7.x86_64 I am attaching the krb5_child.log file. Has anyone got the same issues ? Thanks Regards,

3 4

sssd and NIS?
by Hauke Fath 10 Mar '16

10 Mar '16

[re-sent after subscribing with my sender address] All, I am working on deploying sssd to a number of Debian Linux workstations, and it's slow-going... and I could use some help. The workstations mount users' homes and a few public shares over NFS, using automount. User information, automounter maps etc are shared through NIS. Besides caching, easy switching of backends (say, to Kerberos and LDAP) is why I want to move to sssd. But it looks like NIS support is a bit under-documented. The installed ssd version ("wheezy-backports") is # dpkg-query -l sssd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-==============-============-============-================================= ii sssd 1.11.7.3-3~b amd64 System Security Services Daemon - # Debian updates pam.d/common-* # fgrep sss /etc/pam.d/* /etc/pam.d/common-account:account [default=bad success=ok user_unknown=ignore] pam_sss.so /etc/pam.d/common-auth:auth [success=1 default=ignore] pam_sss.so use_first_pass /etc/pam.d/common-password:password sufficient pam_sss.so /etc/pam.d/common-session:session optional pam_sss.so # and nsswitch.conf, funny enough by appending the sss modules # fgrep sss /etc/nsswitch.conf passwd: files nis sss group: files nis sss shadow: files nis sss netgroup: nis sss sudoers: files sss # and does not install any /etc/sssd/sssd.conf, so the system is broken after installing sssd and friends. My sssd.conf is [sssd] config_file_version = 2 reconnection_retries = 3 debug_level = 0x0070 services = nss, pam domains = spgnts [nss] filter_groups = root filter_users = root reconnection_retries = 3 debug_level = 0x0070 [pam] reconnection_retries = 3 pam_verbosity = 3 debug_level = 0x0070 [domain/spgnts] debug_level = 0x0070 enumerate = true id_provider = proxy proxy_lib_name = nis min_id = 500 auth_provider = proxy proxy_pam_target = none -- if there is any further configuration detail you consider relevant to the issue, please let me know. When I start all this, things work until I take out the 'nis' entries from nsswitch.conf. To my understanding, as long as they are in, queries never go to the nss_sss module. Once I take out the 'nis' entries, I can log in as root on the console, I can log in as a regular user over ssh (public key auth), but all other login attempts time out. kdm mutters about pam_setcred() problems on the console. The /var/log/sssd/* logs are voluminous, but virtually free of any helpful information. Upon login, sssd appears to start a bunch of proxy_child processes, which hang there until timeout, at which point they get killed. I tried copying a commandline from ps, and strace a proxy_child invocation, but the trace didn't speak to me. I have searched the web far and wide, but there is little more than lip service to using the proxymodule, much less NIS. As of now, my hunch is the problem lies with PAM - how do you configure the domain's auth_provider for NIS? I came across "#proxy_auth_target = nis_pam_proxy", but it wasn't documented. Thanks for reading this far; any comments are most welcome! Cheerio, Hauke -- The ASCII Ribbon Campaign Hauke Fath () No HTML/RTF in email Institut für Nachrichtentechnik /\ No Word docs in email TU Darmstadt Respect for open standards Ruf +49-6151-16-21344

5 9

Information Flow Question
by Kenneth Schwartz 07 Mar '16

07 Mar '16

I hope somebody can answer this for me and clarify questions I have about this process. If this is not the right place to ask the question please tell me where I might be able to get answers to my questions. I want a Linux machine to become a user of the active directory Does SSD configure you to be part of the Windows domain or is it only using a small part such as list, positions of things, resource sharing, etc. Or is it a full-fledged Windows user? I want to know about the process of enrolling the CAC with the PKI/widows domain/active directory. When you log in with the smartcard/CAC, when and how does enrollment occur? I think enrollment could be one of two things: You could use the certificates/identifier number from the CAC to enroll and be in active directory/PKI. What is the enrollment PKI? I want to understand the associations between the CAC, Windows, and what information is stored. I don't think it's the cerificate but just the number. Once you've logged into the machine does in use certificates from the CAC and how does the information get there. How do you associate the CAC with the windows user from active directory? How do you connect using your key? Once you're on a machine and you need to log in to a Linux machine that's a member and you want to prove who you are from a machine that has become part of active directory how do you know? Does Linux associate the CAC the same way that Windows does? For SSH? kinit involvement? Does the SSS module or pam module handle session tickets or does it only give you your only initial ticket granting ticket?

3 2

SSSD: Cross Forest AD Trust with sssd-ad provider
by PARTH MONGA 01 Mar '16

01 Mar '16

Hi List, I am using sssd-1.13 to authenticate my linux clients against Active Directory. Got this working too. Now we have an incoming one way trust from another domain. So here is the scenario: AD1: dom1.com - One-way incoming trust from AD2. AD2: dom2.com - One-way outgoing trust to AD1. LinuxClient1: member of AD1/dom1.com Can lookup User1(Created in AD1/DOM1): Linux1>$id AD1\User1 - OK Can't lookup User2(Created in AD2/DOM2) Linux1>$id AD2\User2 - Not OK. SSSD is configured with AD1 domain. Is this kind of configuration possible with SSSD and sssd-ad provider because i am able to achieve the above using likewise but not sssd. Please show some light on this. Regards, Parth

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2016