sssd-users July 2016

sssd-users@lists.fedorahosted.org

18 participants
19 discussions

pam_sss and pam_gnome_keyring does not work
by Joakim Tjernlund 23 Jul '16

23 Jul '16

Trying to get make automatic keyring unlock work with pam_sss and it fails :) I have in my pam conf: auth required pam_env.so auth sufficient pam_unix.so try_first_pass likeauth nullok auth sufficient pam_sss.so forward_pass use_first_pass auth optional pam_gnome_keyring.so auth optional pam_group.so auth required pam_deny.so But this fails to unlock the keyring, but if I move pam_gnome_keyring.so before pam_sss.so it works. It looks to as the forward_pass option fails to preserve the password. Any pointers? Jocke

3 5

Adding service to sssd + AD
by Maciej Piechotka 22 Jul '16

22 Jul '16

I have following configuaration: [sssd] config_file_version = 2 domains = domain.com services = nss, pam [nss] [pam] [domain/domain.com] cache_credentials = true id_provider = ad auth_provider = ad access_provider = simple default_shell = /bin/zsh fallback_homedir = /home/%d/%u use_fully_qualified_names = true ldap_id_mapping = true ldap_schema = ad ldap_idmap_range_min = 100000 ldap_idmap_range_max = 2000100000 ldap_idmap_range_size = 200000000 ldap_idmap_default_domain = DOMAIN.COM ignore_group_members = true Ticket cache: FILE:/tmp/krb5cc_400389252_3sT5UifBXn Default principal: username(a)DOMAIN.COM Valid starting Expires Service principal 07/20/2016 12:18:01 07/20/2016 21:14:13 krbtgt/DOMAIN.COM(a)DOMAIN.COM renew until 07/27/2016 11:14:13 I got kerberos working and login through gssapi to ssh: Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 host/hostname.domain.com(a)DOMAIN.COM 2 host/hostname.domain.com(a)DOMAIN.COM 2 host/hostname.domain.com(a)DOMAIN.COM 2 host/hostname.domain.com(a)DOMAIN.COM 2 host/hostname.domain.com(a)DOMAIN.COM 2 host/hostname(a)DOMAIN.COM 2 host/hostname(a)DOMAIN.COM 2 host/hostname(a)DOMAIN.COM 2 host/hostname(a)DOMAIN.COM 2 host/hostname(a)DOMAIN.COM 2 HOSTNAME$(a)DOMAIN.COM 2 HOSTNAME$(a)DOMAIN.COM 2 HOSTNAME$(a)DOMAIN.COM 2 HOSTNAME$(a)DOMAIN.COM 2 HOSTNAME$(a)DOMAIN.COM However I cannot get OpenAFS to work. I suspect it is that I don't have afs/hostname(a)DOMAIN.COM principal. How should I add service to keytab (I don't have admin rights on KDC) with SSD + AD? Maciej

3 4

pam_sss and pam_gnome_keyring does not work
by Joakim Tjernlund 22 Jul '16

22 Jul '16

1 0

usind sssd on aix machine.
by cem.yetil＠teb.com.tr 20 Jul '16

20 Jul '16

Hi, I am trying to implement Redhat Identity Management on my test environment. I have a question about sssd on Unix platform. Is there any way to implement sssd on Aix or Solaris machines? I heard about the opensource project but I couldn’t find anything about that on Google. Is there any community to discuss that? Thanks for your helps. Best regards, Cem [http://image.teb.com.tr/TEBMailSignature/Banka/e-imza-logo.jpg] Cem Yetil Unix ve Veri Depolama Sistemleri Proje Uzmanı Unix ve Veri Depolama Sistemleri Birimi Genel Müdürlük T: +90 (216) 645 10 00 - F: +90 (216) 636 36 36 M: cem.yetil(a)teb.com.tr<mailto:cem.yetil@teb.com.tr> teb.com.tr<http://www.teb.com.tr> [http://image.teb.com.tr/TEBMailSignature/agac.jpg]Lütfen gerekli olmadıkça bu dokümanın kağıt çıktısını almayın, doğayı koruyun. ________________________________ Bu elektronik posta mesajı ve ekleri sadece gönderildiği kişi veya kuruma özeldir ve gizli bilgiler içerebilir. Eğer bu mesajı hataen aldıysanız lütfen bu durumu gönderen kişiye derhal bildiriniz ve mesajı sisteminizden siliniz. Eğer doğru kişiye ulaşmadığını düşünüyorsanız, bu mesajın gizlenmesi, yönlendirilmesi, kopyalanması veya herhangi bir şekilde kullanılması yasaktır. Internet iletişiminde güvenlik ve hatasız gönderim garanti edilemeyeceğinden, mesajın yerine ulaşmaması, geç ulaşması, içeriğinin bozulması ya da mesajın virüs taşıması gibi problemler oluşabilir. Gönderen taraf bu tip sorunlardan sorumlu tutulmaz. Türk Ekonomi Bankası A.Ş. Ticaret Sicil No: 189356 Mersis No: 0876004342000105 TEB Kampüs C ve D Blok Saray Mah. Sokullu Cad. No:7A - 7B Ümraniye 34768 / İSTANBUL www.teb.com.tr <http://www.teb.com.tr> This e-mail message and any attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this message in error, please notify the sender immediately and delete it from your system. If you are not the intended recipient you are hereby notified that any dissemination, forwarding, copying or use of any of the information is prohibited. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. The sender therefore does not accept liability for any errors or omissions in the context of this message which arise as a result of Internet transmission Türk Ekonomi Bankası A.Ş. Trade Registry Number: 189356, Central Registration System Number: 0876004342000105 TEB Kampüs C ve D Blok Saray Mah. Sokullu Cad. No:7A - 7B Ümraniye/ İSTANBUL/Turkey www.teb.com.tr <http://www.teb.com.tr>

2 1

error: cannot find input file: `po/Makefile.in.in'
by Srinivasa Rao Ragolu 19 Jul '16

19 Jul '16

Hi All, I am trying to build sssd using yocto bitbake recipe http://git.yoctoproject.org/cgit/cgit.cgi/meta-security/tree/recipes-securi…. While configuring sssd , I am facing below error. configure: creating ./config.status config.status: creating Makefile config.status: creating contrib/sssd.spec config.status: creating src/examples/rwtab config.status: creating src/doxy.config config.status: creating contrib/sssd-pcsc.rules config.status: creating src/sysv/sssd config.status: creating src/sysv/gentoo/sssd config.status: creating src/sysv/SUSE/sssd config.status: error: cannot find input file: `po/Makefile.in.in' Configure failed. The contents of all config.log files follows to aid debugging Please suggest me any patch available to fix this issue. Or help me in resolving this issue. Thanks, Srinivas.

2 2

Setting alternative shell for members of group in AD child domain
by Renfro, Michael 18 Jul '16

18 Jul '16

I've previously only used sssd in a much simpler situation, on a single-domain AD forest with no additional complications. Now, I'm trying to make it work with the following: 1. Forest (vvu.edu) with two domains (vvu.edu, the root domain) and vae.vvu.edu (child domain), with the default two-way trust between the domains. For reasons of Windows system management and user experience, I can't easily break the domain trust or put all users in the root domain. 2. Linux system with sssd, preferably Debian or Ubuntu, tied to the child domain. CentOS and RHEL may be a possibility later. I assume any working version number of sssd will work identically on any platform. 3. As far as the Linux system is concerned, all user accounts in the root domain are normal, unprivileged end-user accounts. These should get a shell of /usr/bin/rssh. 4. The only user accounts in the child domain are for system administrators. Accounts in the AD group 'server-admins' should get a shell of /bin/bash. I got hints from both https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl and http://serverfault.com/a/577885 , but I'm stuck without a complete solution. For a test case on Debian 8, sssd 1.11.7-3, my sssd.conf has contents of: [sssd] #domains = admins_vae, vae.vvu.edu domains = vae.vvu.edu config_file_version = 2 services = nss, pam [domain/vae.vvu.edu] id_provider = ad ad_domain = vae.vvu.edu override_homedir = /home/vvu.edu/%u default_shell = /usr/bin/rssh [domain/admins_vae] id_provider = ad ad_domain = vae.vvu.edu override_homedir = /home/vae.vvu.edu/%u default_shell = /bin/bash #access_provider = simple #simple_allow_groups = server-admins access_provider = ad ad_access_filter = memberOf=cn=server-admins,ou=groups,dc=vae,dc=vvu,dc=edu and testing with this configuration returns: root@files:~# getent group server-admins server-admins:*:225001113:_renfro root@files:~# getent passwd renfro(a)vvu.edu renfro@vvu.edu:*:927801103:927801103:renfro:/home/vvu.edu/renfro:/usr/bin/r ssh root@files:~# getent passwd _renfro(a)vae.vvu.edu _renfro:*:225001109:225000513:_renfro:/home/vvu.edu/_renfro:/usr/bin/rssh root@files:~# getent passwd _renfro _renfro:*:225001109:225000513:_renfro:/home/vvu.edu/_renfro:/usr/bin/rssh where the group membership is correct and the single enabled sssd domain provides NSS information as instructed. After changing the list of domains in sssd.conf to use **both** the vae_admins domain and the vae.vvu.edu one, both users end up getting admin settings, instead of the admin user getting the admin setting, and the regular user getting his original setting: root@files:~# getent group server-admins server-admins:*:225001113:_renfro root@files:~# getent passwd _renfro _renfro:*:225001109:225000513:_renfro:/home/vae.vvu.edu/_renfro:/bin/bash root@files:~# getent passwd renfro(a)vvu.edu renfro@vvu.edu:*:927801103:927801103:renfro:/home/vae.vvu.edu/renfro:/bin/b ash I get identical results with the simple access provider, too (both users get admin settings). Where can I go from here? Thanks in advance for any help. -- Mike Renfro / R&D Engineer, Center for Manufacturing Research, 931 372-3601 / Tennessee Technological University

2 2

sssd authentication fails with "Cannot read password" after upgrading to 1.14
by David Wilhelm 15 Jul '16

15 Jul '16

After upgrading from 1.13.4 to 1.14.0, I am unable to sign in or use sudo for kerberos-authenticated accounts. However, kinit still succeeds and "getent passwd" still lists all network users. Downgrading to 1.13.4 (after clearing the credential cache folder) restores normal operation. My setup: I'm running Arch linux, and have PAM set to use sssd. sssd in turn authenticates against a kerberos instance running on my NAS, and pulls user information from an openldap instance. PAM, kerberos, and openldap were configured by hand as a learning experience, and have been running for about a year. DNS and NTP are working, ldap is returning users, and kinit is succeeding on both my local machine and the server. This appears to be the relevant section of the logs, from krb5_child.log (with debug_level 10): (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x0400): krb5_child started. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [unpack_buffer] (0x1000): total buffer size: [147] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [unpack_buffer] (0x0100): cmd [241] uid [1042] gid [1001] validate [false] enterprise principal [false] offline [false] UPN [dave(a)LA-LA.LAN] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1042_XXXXXX] old_ccname: [FILE:/tmp/krb5cc_1042_93EyUo] keytab: [/etc/krb5.keytab] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [check_use_fast] (0x0100): Not using FAST. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [switch_creds] (0x0200): Switch user to [1042][1001]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [switch_creds] (0x0200): Switch user to [0][0]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [FILE:/tmp/krb5cc_1042_93EyUo] and is active and TGT is valid. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [become_user] (0x0200): Trying to become user [1042][1001]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x2000): Running as [1042][1001]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [become_user] (0x0200): Trying to become user [1042][1001]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [become_user] (0x0200): Already user [1042]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_setup] (0x2000): Running as [1042][1001]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_child_set_krb5_tracing] (0x0100): krb5 tracing is not available (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [false] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x0400): Will perform online auth (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [LA-LA.LAN] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_krb5_prompter] (0x4000): sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_krb5_prompter] (0x0020): Cannot handle password prompts. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_krb5_prompter] (0x4000): Prompt [0][Password for dave(a)LA-LA.LAN]. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [get_and_save_tgt] (0x0020): 1296: [-1765328254][Cannot read password] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [map_krb5_error] (0x0020): 1365: [-1765328254][Cannot read password] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_send_data] (0x0200): Received error code 1432158218 (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [pack_response_packet] (0x2000): response packet size: [4] (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_send_data] (0x4000): Response sent. (Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x0400): krb5_child completed successfully Please let me know if any other logs or configurations are needed.

2 4

SSSD not responding to pings
by mohammed irfan 14 Jul '16

14 Jul '16

Hi Team, I have installed Rstuido-server in one our linux instance. After installing Rstudio on our machine we have been facing SSSD deamon issues. i.e. "sssd: Killing service [AD], not responding to pings!" [image: Inline image 2] Could any one help us on this issue. thanks in advance. Thanks, Irfan

3 2

sssd 1.13.3 - Failed to retreive users
by Ondrej Valousek 08 Jul '16

08 Jul '16

Hi List, After upgrade from 1.12 to 1.13.3. I see sporadically messages like these: (Fri Jul 8 09:47:20 2016) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Fri Jul 8 09:47:20 2016) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Fri Jul 8 09:49:59 2016) [sssd[be[default]]] [sdap_get_users_done] (0x0040): Failed to retrieve users I am running RHEL-6 with AD provider. Google pointed me at: https://fedorahosted.org/sssd/ticket/2906 so tried to add 'ldap_referrals = False', but I still see these messages. So far, it does not seem to affect the functionality, but in rare cases I see sssd being unable to recognize some users. Any ideas? Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users July 2016