sssd-users January 2020

sssd-users@lists.fedorahosted.org

28 participants
34 discussions

restrict sudo su -
by Jannis Mann 20 Jan '20

20 Jan '20

Hi, I've implemented sssd with id, auth and access provider as ldap. So I am using a binding account and didn't joined the domain with the server. In general everything works. Only members of mentioned SG within the sssd.conf can login to the server, just as I wish to. However, as sudo user I can run something as following sudo su - UserThatIsNotAllowed So I (a sudo user) can switch to any user that is within the search base I've specified in the sssd.conf But these users are not allowed to use the server. I understand that not the user himself is logging in but I actually don't want sudo users to be able to switch to users that aren't allowed on the server. I'd like that it is only allowed to switch to users that are allowed on the server on local accounts of course. Is this a normal behaviour? Can it be changed? Thank you! Jannis

4 5

Re: How to do cross-subdomain user authentication by short name (among trusted AD subdomains) since sssd-ad 1.15.3?
by allindiajobs AIJ 17 Jan '20

17 Jan '20

Hey Spike White, Are you able to resolve this issue? I am facing exactly similar issue. Please let me know if you have a solution.

1 0

sssd-ldap, ppolicy, ldap_account_expire_policy with SSHD
by Chris Paul 16 Jan '20

16 Jan '20

Is it possible to use sssd-ldap (1.16.4-21, CentOS 7.7) with FreeIPA server (4.6.5-11, CentOS 7.7) and have password policy (ldap_access_order=ppolicy) and also account expiration (ldap_account_expire_policy = ipa)? It’s implied that IPA works as why else would “ipa” be an option to ldap_account_expire_policy? I’m trying this in my lab; can’t get it to work. Also not perfectly clear from the manual is how to use pwd_expire_policy_reject, pwd_expire_policy_warn, pwd_expire_policy_renew. In the manual, it is written: "Also 'ldap_pwd_policy' must be set to an appropriate password policy.” What should ldap_pwd_policy be set to for an IPA server? The docs also say, “for ldap_account_expire_policy=rhds, ipa, 389ds: use the value of ldap_ns_account_lock to check if access is allowed or not.” On my FreeIPA server, I don’t see the ldap_ns_account_lock attribute set for expired accounts. Either my reading is deficient or the documentation is. I’d be happy to contribute if I understood. Does anyone have any tips? thanks, Chris Paul

3 2

No group information displaying and slow persformance while implementing sssd ldap authentication
by capricorn cap 15 Jan '20

15 Jan '20

Hi! I am trying to authentticate my ubuntu users via Active directory and also autofs mounting. May be I am doing something wrong or missing some key attributes but I checked it from last couple of days and decided to write. I have configured my sssd.conf and using ldaps for communication. After troubleshooting my issue now I am able to get the result for my output like getent passwd AD-username and id AD-username I am logged on to ubuntu machine with local account and running id AD-Username and getent passwd AD-username and it takes ages to get reply back. uid=1348(AD-username) gid=100(users) groups=100(users) when I trun getend group groupname then nothing happens. I have attached my sssd.conf file. I am using Ubuntu 18.04 Version: 1.16.1-1ubuntu1.4 Version: 1.16.1-1ubuntu1.4 [sssd] config_file_version = 2 services = nss, pam, sudo, autofs domains = mycompany.local default_domain_suffix = mycompany.local [nss] debug_level = 9 filter_groups = root filter_users = root reconnection_retries = 3 #If want override the shell for all users uncomment follow line #override_shell = /bin/bash [pam] debug_level = 9 [sudo] debug_level = 3 [autofs] [domain/mycompany.local] debug_level = 9 enumerate = false case_sensitive = false cache_credentials = true min_id = 100 #ldap_id_mapping = True #ldap_user_primary_group = primaryGroupID case_sensitive = false ### --- Providers --- ### id_provider = ldap auth_provider = ldap access_provider = simple chpass_provider = ldap ### --- LDAP GENERAL --- ### ldap_id_use_start_tls = false ldap_schema = rfc2307 ldap_tls_cacertdir = /etc/ldap/cacerts #ldap_tls_cacert = /etc/ssl/dc01.cer ### LDAP user search settings ### ldap_user_search_base = DC=mycompany,DC=local # LDAP group search settings ldap_group_search_base = DC=mycompany,DC=local # LDAP Class settings ### --- LDAP Class settings --- #### ldap_user_object_class = user ldap_user_name = sAMAccountName ldap_user_gecos = displayName #ldap_user_principal = userPrincipalName ldap_user_home_directory = unixHomeDirectory ldap_user_member_of = memberOf ldap_group_object_class = group ldap_group_name = sAMAccountName ldap_group_member = memberUid ldap_network_timeout = 3 #ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount)) ad_server = dc01.mycompany.local ### --- LDAP connection settings --- ### ldap_uri = ldaps://dc01.mycompany.local:636 ldap_default_bind_dn = CN=serviceaccount,OU=ServiceAccounts,DC=mycompany,DC=local ldap_default_authtok_type = password ldap_default_authtok = mypassword # Access settings via simple # simple_allow_groups = lusers simple_allow_groups = Users ## Temp TEst ldap_opt_timeout = 20 dns_resolver_timeout = 10 ### AutoFS autofs_provider = ldap ldap_autofs_entry_key = cn ldap_autofs_entry_object_class = nisObject ldap_autofs_entry_value = nisMapEntry ldap_autofs_map_name = nisMapName ldap_autofs_map_object_class = nisMap ldap_autofs_search_base = ou=automount,DC=mycompany,dc=local Thanks

1 0

Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied
by Michael Barkdoll 14 Jan '20

14 Jan '20

Hi, my sssd is service is crashing on CentOS 8 it looks like something is changing the file permissions on /var/lib/sss/db/config.ldb $ systemctl status sssd.service ● sssd.service - System Security Services Daemon Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Mon 2020-01-13 16:30:16 CST; 15h ago Process: 874 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=1/FAILURE) Main PID: 874 (code=exited, status=1/FAILURE) Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876393 2020) [sssd[nss]] [ldb] (0x0020): Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876628 2020) [sssd[nss]] [ldb] (0x0020): Failed to connect to '/var/lib/sss/db/config.ldb' with backend 'tdb': Unable to > Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876641 2020) [sssd[nss]] [confdb_init] (0x0010): Unable to open config database [/var/lib/sss/db/config.ldb] Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876654 2020) [sssd[nss]] [server_setup] (0x0010): The confdb initialization failed Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: Exiting the SSSD. Could not restart critical service [nss]. Jan 13 16:30:16 sp20client.ad.siu.edu sssd[be[ad.siu.edu]][943]: Shutting down Jan 13 16:30:16 sp20client.ad.siu.edu sssd[be[implicit_files]][942]: Shutting down Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: sssd.service: Main process exited, code=exited, status=1/FAILURE Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: Failed to start System Security Services Daemon. something is changing the file permissions of file /var/lib/sss/db/config.ldb to: $ ls -la /var/lib/sss/db/config.ldb -rw-------. 1 1767801122 1767800513 1286144 Jan 13 16:30 /var/lib/sss/db/config.ldb $ $ id 1767801122 id: ‘1767801122’: no such user $ getent passwd 1767801122 $ echo $? 2 $ $ systemctl restart sssd $ ls -lan /var/lib/sss/db/config.ldb -rw-------. 1 0 0 1286144 Jan 14 08:00 /var/lib/sss/db/config.ldb $ ls -la /var/lib/sss/db/config.ldb -rw-------. 1 root root 1286144 Jan 14 08:00 /var/lib/sss/db/config.ldb $ I've joined this machine to an Active Directory Domain using packages: realmd_prereq_packages: - realmd - sssd - adcli - oddjob - oddjob-mkhomedir - samba-common - samba-common-tools - krb5-workstation realm join -vvvv --computer-ou="ou=Computers,dc=sample,dc=college,dc=edu" --user-principal=nfs/sp20client.sample.college.edu(a)AD.SIU.EDU --os-name=CentOS --user=account SAMPLE.COLLEGE.EDU Things have been odd with the sssd authentication in other ways as well. One time when I tried to su root it wasn't working until I rebooted CentOS 8. Here is my sssd.conf: [sssd] domains = sample.college.edu config_file_version = 2 services = nss, pam #default_domain_suffix = SAMPLE.COLLEGE.EDU [domain/sample.college.edu] ad_domain = sample.college.edu krb5_realm = SAMPLE.COLLEGE.EDU realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True # The following pulls ldap uid,gid from AD #ldap_id_mapping = False # The following uses xxxxxxx(a)sample.college.edu for login name if default_domain_suffix is not set. #use_fully_qualified_names = True # The following allows xxxxxxx to login with default_domain_suffix is not set. use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = ad subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout ignore_group_members = True krb5_lifetime = 7h krb5_renewable_lifetime = 7d krb5_renew_interval = 60s dyndns_update = true dyndns_refresh_interval = 60 dyndns_update_ptr = true dyndns_ttl = 60 debug_level = 9 dyndns_iface = enp0s3 #dyndns_auth = none dyndns_server = 131.x.x.x ad_hostname = sp20client.sample.college.edu

2 4

Is there a way to disable Mozilla NSS?
by Sad Clouds 14 Jan '20

14 Jan '20

When I build sssd from source, I specify "--with-crypto=libcrypto" during configure stage, however during the build and install stage, sssd is linked with both libcrypto.so and libnss3.so+libnssutil3.so Is there a way to completely disable all Mozilla NSS libraries with sssd?

3 8

Provider clarifications
by Lars Francke 10 Jan '20

10 Jan '20

Hi, I've got a question that seems pretty trivial to me so it feels like I'm missing something obvious. I know that there are different provider types: id, auth, chpass, access (and maybe others) But what I don't quite understand is what they actually do. The documentation says: id -> "The identification provider" auth -> "The authentication provider" access -> "The access control provider" chpass -> "The provider which should handle change password operations for the domain." (The first three are not very helpful ;-) ) I understand chpass and I can make a guess about the others but I'm not sure: id: Just returns information about some object auth: Validates credentials for an object access: Checks authorization? But I'm very vague on the details. Is there any more information I can refer to? What are the differences/can anyone point me at an API description or some other documentation? One very specific question for example: What does the krb5 auth mean? Does it retrieve a ticket and try to decrypt that? Thank you! Cheers, Lars

2 3

managing authorization without AD/LDAP
by francois-oss＠avalenn.eu 10 Jan '20

10 Jan '20

Hello, I have a use case of ssh authentication to some server which for various reasons (one of them being network isolation) cannot access to Directory. With ssh I can use ssh certificates to do the authentication part "offline" without the need for the server to access any centralized service. But I still need LDAP connexion to get directory information (numeric uid, groups, etc.) I would like a mechanic which allows to transmit this information along with the connexion initiation. For example the ssh certificate could have some extension options like uid(a)example.com=1234 and groups(a)example.com=wheel,admin,mygroup and this certificate would create the corresponding entries in SSSD in passwd and groups databases which would be valid for the duration of the certificate. Do anyone knows of such a setup or have any pointer to similar ideas ? Do you think it would be possible for SSSD to be extended to support this use case ? Would it be easy to implement ? (a bunch of AuthorizedKeyCommand shell scripts interacting with SSSD D-Bus interface would suit me) François

1 0

Realm permit with bogus AD domain disallows any subsequent legal login
by Spike White 10 Jan '20

10 Jan '20

All, Another engineer fat-fingered a ‘realm permit’ invocation and discovered this problem. Brought this to my attention. (This is on RHEL7). We are using the simple access provider in sssd.conf. So we have simple_allow_groups and simple_allow_users lines in sssd.conf: Example allow lines: simple_allow_groups = amerlinuxeng(a)amer.company.com, amerlinuxengtfssupt(a)amer.company.com, amerlinuxsup(a)amer.company.com, amerlnxsvcdelauttfs(a)amer.company.com, fnms_ops(a)amer.company.com, gbllinuxsuppw(a)amer.company.com, pptsupportpac(a)amer.company.com, scheduling_global(a)amer.company.com, unv_legato_admins(a)amer.company.com, zabbix-support(a)amer.company.com, apaclinuxeng(a)apac.company.com, apaclinuxsup(a)apac.company.com, emealinuxeng(a)emea.company.com, emealinuxsup(a)emea.company.com, vra_users(a)amer.company.com simple_allow_users = processdaceaccount(a)amer.company.com, processdisco05(a)amer.company.com, processdisco06a(a)amer.company.com, processehcprofiler(a)amer.company.com, processfoglight(a)amer.company.com, svc_prdprofoglight01(a)amer.company.com, john2_nolan(a)emea.company.com <john2_nolan(a)emea.dell.com> amer.company.com and emea.company.com are legal AD child domains. If we mistakenly do a ‘realm permit’ for any bogus AD domain, it breaks any subsequent legal logins. Examples: realm permit processdaceaccount(a)us.company.com <processdaceaccount(a)us.dell.com> realm permit -g vra_users(a)us.company.com <vra_users(a)us.dell.com> If I attempt to log in now, the authentication fails. (& my login is legal – I’m a member of a couple of these permitted AD groups.) Here’s the log lines from /var/log/secure: Jan 9 11:21:54 spikev2stest01 sshd[68160]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost= spikev2stest01.us.company.com user=admspike_white Jan 9 11:21:54 spikev2stest01 sshd[68160]: Accepted password for admspike_white from 10.179.253.197 port 47334 ssh2 Jan 9 11:21:54 spikev2stest01 sshd[68160]: pam_sss(sshd:account): Access denied for user admspike_white: 6 (Permission denied) Jan 9 11:21:54 spikev2stest01 sshd[68160]: fatal: Access denied for user admspike_white by PAM account configuration So the PAM auth phase still succeeds, but now the access phase fails. This is for a legal login. If I remove the bogus entries, access of legal logins again succeeds. realm permit -x processdaceaccount(a)us.company.com <processdaceaccount(a)us.dell.com> realm permit -g -x vra_users(a)us.company.com <vra_users(a)us.dell.com> Now my legal login again succeeds. Here’s the auth and access section of the /etc/pam.d/system-auth file: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so # OL7 version. Per Company I/T's stated policy for service & process accounts, lock-out time = 30 mins auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800 auth sufficient pam_sss.so forward_pass auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so account [default=ignore success=ok perm_denied=bad user_unknown=ignore] pam_sss.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account required pam_permit.so Spike

2 1

Exclude users who will become root from SSSD control
by Soham Chakraborty 10 Jan '20

10 Jan '20

Hi all, I have a requirement where my client is requesting to exclude all users who will become root (by sudo) out of SSSD control. The way I think it is possible is to not add those users into the sudo rule. Or create those users on the linux side and not keep them on AD at all. Has anyone encountered something like this? I am trying to gather information as to why they need this. In the meantime if anyone knows how to achieve this, it would be much appreciated. Thanks,

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users January 2020