September 2013 - sssd-users - Fedora mailing-lists

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

sssd.conf, authconfig and ldap_uri
by Olivier 11 Oct '13

11 Oct '13

Hello everyone, I launch "authconfig" within a script to setup my redhat6 boxes. I noticed that authconfig does not set up sssd.conf properly : https://bugzilla.redhat.com/show_bug.cgi?id=874527 but the bug is declared as "closed" ? First question : could anyone confirm that authconfig does *not* configure sssd.conf with "--enablesss" and "--enablesssdauth" and that I therefore need to configure that file myself (by hand or within my script) ? Second question: I noticed that sssd seemed to work properly even without declaring the "ldap_uri" parameter within sssd.conf. Could anyone confirm that this parameter is not necessary and where does sssd collect the list of ldap servers to query in that case, ldap.conf ? Thank you for any help, Best regards, --- Olivier

4 25

Re: [SSSD-users] authenticating against all sub-domains in AD forest
by a t 03 Oct '13

03 Oct '13

Hi, That user, test.user, is in the subdomain a.domain.org. Thr logs mark domain.org as a subdomain of b.domain.org. however, this is not correct - domain.org is the root domain of which b.domain.org is a subdomain. We do not have users in the root domain. All users are in other subdomains. I believe the user I tested in another subdomain, mhunt.test(a)a.domain.org did not show in the logs. When I tried to log in with mhunt.test(a)a.domain.org the logs show that sssd believes that domain "a" is a subdomain if b.domain.org rather than another subdomain of domain.org. I might have to ask if I can send un-obfuscated incase I am adding in confusion! Thanks, Matthew --- Original Message --- From: "Jakub Hrozek" <jhrozek(a)redhat.com> Sent: 29 September 2013 12:26 To: "End-user discussions about the System Security Services Daemon" <sssd-users(a)lists.fedorahosted.org> Subject: Re: [SSSD-users] authenticating against all sub-domains in AD forest On Tue, Sep 24, 2013 at 11:02:48AM +0000, a t wrote: > > Hi, > > please see logs attached. (couldn't upload logs as they were too large so i hope a tar.gz gets through). I stopped sssd, deleted logs and started sssd. Then ran the commands below; > > ssh B\\test.user@localhost - run at (Tue Sep 24 10:31:19 2013) - login succeds > ssh a\\mhunt.test@localhost - run at (Tue Sep 24 10:32:10 2013) - login fails. The error on ssh login is "Permission denied, please try again." > > (NOTE: I have just noticed I tested with uppercase domain "B" and lowercase domain "a". I have just retested with uppercase "A" and it still fails.) > > There are DNS server errors in the log. > > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve AAAA record of 'le-vm05-centos6' in DNS > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [request_watch_destructor] (0x0400): Deleting request watch > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [resolv_gethostbyname_done] (0x0040): querying hosts database failed [5]: Input/output error > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [nsupdate_get_addrs_done] (0x0040): Could not resolve address for this machine, error [5]: Input/output error, resolver returned: [11]: Could not contact DNS servers > > However, DNS from this install is working (when querying its hostname or others on LAN or internet) and from other boxes querying its hostname. resolv.conf has correct name servers and they are responding to 'nslookup' and 'host' > > Also the following line looks to be creating the parent domain (domain.org) as a subdomain or b.domain.org? > > (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [new_subdomain] (0x0400): Creating [domain.org] as subdomain of [B.DOMAIN.ORG] > > I have changed domain names in logs and changed bits of SIDs. Hope I have not confused anything with SID changes!! > > Thanks, > > Matthew Hi, I'm sorry for the late reply.. According to these logs I see three potential things to take a look at: 1) (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve AAAA record of 'le-vm05-centos6' in DNS (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [resolv_gethostbyname_done] (0x0040): querying hosts database failed [5]: Input/output error (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [nsupdate_get_addrs_done] (0x0040): Could not resolve address for this machine, error [5]: Input/output error, resolver returned: [11]: Could not contact DNS servers It looks like you were hitting https://fedorahosted.org/sssd/ticket/2063 which should be resolved by now. What exact version was this? The one from sssd-devel? 2) The other thing I see: (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [sss_write_domain_mappings] (0x0200): Mapping file for domain [B.DOMAIN.ORG] is [/var/lib/sss/pubconf/krb5.include.d/domain_realm_B_DOMAIN_ORG] (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [sss_krb5_touch_config] (0x0020): Unable to change mtime of "/etc/krb5.conf" [13]: Permission denied (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [sss_write_domain_mappings] (0x0020): Unable to change last modification time of krb5.conf. Created mappings may not be loaded. This sounds like SELinux denial to me. Could you try setting SELinux to permissive for the duration of the test (setenforce 0) 3) Then in the logs I see a lookup and authentication of [CN=test user,OU=No Management,OU=User Accounts,DC=b,DC=domain,DC=org] Is that a root domain or subdomain user? Because this particular request seems to have completed fine.. According to the logs, the subdomain should be just called domain.org: (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [new_subdomain] (0x0400): Creating [domain.org] as subdomain of [B.DOMAIN.ORG] (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [sdap_domain_subdom_add] (0x0400): subdomain domain.org is a new one, will create a new sdap domain object But I don't see a request for a subdomain user from domain.org..not sure if the real DN just got lost in the obfuscation.. _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 3

Announcing SSSD 1.11.1
by Jakub Hrozek 30 Sep '13

30 Sep '13

=== SSSD 1.11.1 === The SSSD team is proud to announce the release of version 1.11.1 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 19, 20 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This release contains mainly bug fixes in the Active Directory provider and setups where the SSSD is running on an IPA server instance. In particular: - Several cases where offline authentication did not work correctly for users from Active Directory domains were fixed - Fixed a resolver bug that caused the SSSD to only look up AAAA records for trusted Active Directory servers - SSSD is now able to resolve users from trusted AD domains using their POSIX attributes * The simple access provider now allows the administrator to specify users or groups from trusted domains in the access or deny lists * Handling of Kerberos credential caches was made simpler and more robust == Packaging Changes == * A new subpackage sssd-common-pac was added to work around a packaging bug. Previous SSSD versions would own the PAC responder by both the IPA and AD providers, which is not permitted by the Fedora packaging guidelines. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1945 Enable printf format string checking in function debug_fn https://fedorahosted.org/sssd/ticket/2001 Implement heuristics to use Global Catalog servers from local DNS domain first https://fedorahosted.org/sssd/ticket/2007 sss_debuglevel did not increase verbosity in sssd_pac.log https://fedorahosted.org/sssd/ticket/2034 [RFE] simple access provider: support subdomain users and groups https://fedorahosted.org/sssd/ticket/2060 Cached credentials aren't working with sssd-ad UPN logins https://fedorahosted.org/sssd/ticket/2063 sssd-ad unable to resolve names in other domains possibly UPN related https://fedorahosted.org/sssd/ticket/2066 ad: invalid handling of Domain Users group for subdomain user https://fedorahosted.org/sssd/ticket/2067 Carry on if detecting the flat name fails https://fedorahosted.org/sssd/ticket/2068 Initial enumeration in the AD provider does not work https://fedorahosted.org/sssd/ticket/2070 The present sssd-ad is unable to pull RFC2307 attributes from all domains in a forest https://fedorahosted.org/sssd/ticket/2075 sssd fails to retrieve netgroups with multiple CN attributes https://fedorahosted.org/sssd/ticket/2076 Fix expand_ccname_template libkrb5 style expansion and add tests https://fedorahosted.org/sssd/ticket/2079 SSSD subdomains provider does not resolve SRV records correctly when DNS name of the server is different from domain/realm name of IPA install in IPA server mode https://fedorahosted.org/sssd/ticket/2080 When in IPA server mode, SSSD should map trusted forest subdomains to root domain realm https://fedorahosted.org/sssd/ticket/2085 man sssd-sudo: improve description of necessary configuration https://fedorahosted.org/sssd/ticket/2087 The multicast check is wrong in the sudo source code getting the host info https://fedorahosted.org/sssd/ticket/2090 getpwuid and getgrgid do not use the negative cache https://fedorahosted.org/sssd/ticket/2091 Document that server side password policies always takes precedence https://fedorahosted.org/sssd/ticket/2093 sssd should write capaths for IPA trusted forests' subdomains == Detailed Changelog == Jakub Hrozek (24): * Updating the version for 1.11.1 release * PROXY: Handle empty GECOS * MAN: Document that sss_cache should be run after changing the cache timeout * AD: Rename parametrized #define * LDAP: Store cleanup timestamp after initial cleanup * Remove unused code * TESTS: Remove unused variable * KRB5: Call umask before mkstemp in the krb5 child code * AD: async request to retrieve master domain info * LDAP: sdap_id_setup_tasks accepts a custom enum request * AD: Download master domain info when enumerating * AD: Failure to get flat name is not fatal * Convert IN_MULTICAST parameter to host order * NSS: Set UID and GID to negative cache after searching all domains * NSS: Failure to store entry negative cache should not be fatal * KRB5: Fix bad comparison * IPA: Ignore dns_discovery_domain in server mode * KRB5: Return ERR_NETWORK_IO when trusted AD server can't be resolved * KRB5: Use the correct domain when authenticating with cached password * LDAP: Require ID numbers when ID mapping is off * LDAP: Allow searching subdomain during RFC2307bis initgroups * AD: talk to GC first even for local domain objects * MAN: Document that POSIX attributes must be replicated to GC * Updating the translations for the 1.11.1 release Lukas Slebodnik (38): * AUTOMAKE: Add missing escaped newline * Include sys/types.h for types id_t and uid_t * UTIL: Use standard maximum value of type size_t * KRB5: Fix warning declaration shadows global declaration * Fix warning missing arguments * mmap_cache: Do not remove record from chain twice * AUTOTOOLS: Add -LLIBDIR to PYTHON_LIBS * AUTOTOOLS: Add missing AC_MSG_RESULT * AUTOMAKE: Use portable way to link with dlopen * AUTOMAKE: Use portable way to link with gettext * AUTOTOOLS: Add directories for searching ldap headers and libs * AUTOTOOLS: Refactor unicode library detection * AUTOTOOLS: add check for type intptr_t * AUTOTOOLS: Use pkg-config to detect libraries. * AUTOTOOLS: More robust detection of inotify. * krb5: Fix warning sometimes uninitialized * Fix formating of variables with type: long * Fix formating of variables with type: unsigned long * Fix formating of variables with type: int * Fix pointer formatting * Use the same variable type like in struct ldb_message_element * Fix formating of variables with type: ssize_t * Fix formating of variables with type: size_t * Adding new header for printf formating macros * Fix formating of variables with type: key_serial_t * Fix formating of variables with type: rlim_t * Fix formating of variables with type defined in stdint.h * Fix formating of variables with type: time_t * Fix formating of variables with ber_ type * Fix warning: data argument not used by format string * Use right formating to print string * Fix formating of variables with type: id_t * Fix formating of variables with type: uid_t * Fix formating of variables with type: gid_t * Enable printf format string checking * KRB: Remove unused memory context * KRB: Remove unused function parameters * LDAP: Use primary cn to search netgroup Michal Zidek (4): * Rename SAFEALIGN macros * Rename _SSS_MC_SPECIAL * man sssd: Add note about SSS_NSS_USE_MEMCACHE * Check slot validity before MC_SLOT_TO_PTR. Nikolai Kondrashov (1): * Fix reference to sssd-krb5 man page Ondrej Kos (2): * DB: Add user/group lookup by SID * DB: Rise search functions debug levels Pavel Březina (22): * Fix czech specific character in my name * krb5_utils tests: fix some typos * resolv_sort_srv_reply: remove unnecessary mem_ctx * fo srv: add priority to fo_server_info * utils: add is_host_in_domain() * ad srv: prefer servers that are in the same domain as client * sysdb_search_group_by_gid: obtain gid instead of uid * is_dn(): free dn * util: add sss_idmap_talloc[_free] * simple access tests: fix typos * simple provider: support subdomain users * util: add find_subdomain_by_sid() * util: add find_subdomain_by_object_name() * simple provider: support subdomain groups * simple access test: initialize be_ctx for all tests * simple provider: obey case sensitivity for subdomain users and groups * man: improve sssd-sudo manual page * man: server side password policies always takes precedence * util: add get_domains_head() * sysdb: get_sysdb_grouplist() can return either names or dn * sysdb: sysdb_update_members can take either name or dn * ad: store group in correct tree on initgroups via tokenGroups Simo Sorce (18): * Makefile: Fix sssd_be targets * krb5: Ingnore unknown expansion sequences * tests: Add dlopen test to make sure modules works * krb5: Add calls to change and restore credentials * krb5: Add helper to destroy ccache as user * krb5: Use krb5_cc_destroy to remove old ccaches * krb5: Replace type-specific ccache/principal check * krb5: Move determination of user being active * krb5: move template check to initializzation * krb5: Make check_for_valid_tgt() static * krb5: Use new function to validate ccaches * krb5: Unify function to create ccache files * krb5: Remove unused ccache backend infrastructure * krb5: Remove unused function * krb5: Add file/dir path precheck * krb5_child: Simplify ccache creation * krb5: Remove unused helper functions * krb5: Be more lenient on failures for old ccache Stephen Gallagher (1): * RPM: Add new subpackage for PAC responder Sumit Bose (7): * dyndns: do not modify global family_order * sdap_domain_add: remove too strict consistency check * krb5: save canonical upn to sysdb * krb5: do not expand enterprise principals is offline * IPA: store forest name for forest member domains * ipa_server_mode: write capaths to krb5 include file * Do not return DP_ERR_FATAL in case of success

2 1

Can't change default ldap_idmap_range
by Melvin Williams 30 Sep '13

30 Sep '13

Hello everybody, I'm trying to change the default ldap_idmap_range_min, ldap_idmap_range_max and ldap_idmap_range_size. First of all I'm not sure where to place them. I tried placing them in [domain/DOMAINNAME]. If I do so sssd service fails to start. I can't find any hints in logs even though I put the debug_level on 0xFFF0. Then I placed them in the [sssd] section. The service starts now but it seems that the values are ignored. My sssd.conf looks as follows: [sssd] services = nss, pam config_file_version = 2 domains = domain.name debug_level = 0xFFF0 ldap_idmap_default_domain_sid = SID ldap_idmap_default_domain = domain.name [nss] default_shell = /bin/bash [pam] [domain/domain.name] ad_hostname = hostname.domain.name ad_server = dc1.domain.name ad_backup_server = dc2.domain.name ad_domain = domain.name #ldap_idmap_range_min = 100000 #ldap_idmap_range_max = 200000 #ldap_idmap_range_size = 10000 ldap_schema = ad ldap_id_mapping=true id_provider = ad ldap_sasl_mech = gssapi ldap_sasl_authid = dc1$(a)DONAIN.NAME access_provider = simple override_homedir = /home/%d/%u # on large directories, you may want to disable enumeration for performance reasons enumerate = true auth_provider = krb5 chpass_provider = krb5 krb5_realm = DOMAIN.NAME krb5_server = dc1.domain.name krb5_backup_server = dc2.domain.name krb5_kpasswd = dc1.domain.name krb5_backup_kpasswd = dc2.domain.name krb5_keytab = /etc/krb5.sssd.keytab ldap_krb5_init_creds = true ldap_referrals = false ldap_uri = ldap://dc1.domain.name,ldap://dc2.domain.name ldap_search_base = some_search_base dyndns_update=false I hope somebody can help me with this issue. Thanks

2 2

Re: [SSSD-users] authenticating against all sub-domains in AD forest
by a t 29 Sep '13

29 Sep '13

Hi, please see logs attached. (couldn't upload logs as they were too large so i hope a tar.gz gets through). I stopped sssd, deleted logs and started sssd. Then ran the commands below; ssh B\\test.user@localhost - run at (Tue Sep 24 10:31:19 2013) - login succeds ssh a\\mhunt.test@localhost - run at (Tue Sep 24 10:32:10 2013) - login fails. The error on ssh login is "Permission denied, please try again." (NOTE: I have just noticed I tested with uppercase domain "B" and lowercase domain "a". I have just retested with uppercase "A" and it still fails.) There are DNS server errors in the log. (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve AAAA record of 'le-vm05-centos6' in DNS (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [resolv_gethostbyname_done] (0x0040): querying hosts database failed [5]: Input/output error (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [nsupdate_get_addrs_done] (0x0040): Could not resolve address for this machine, error [5]: Input/output error, resolver returned: [11]: Could not contact DNS servers However, DNS from this install is working (when querying its hostname or others on LAN or internet) and from other boxes querying its hostname. resolv.conf has correct name servers and they are responding to 'nslookup' and 'host' Also the following line looks to be creating the parent domain (domain.org) as a subdomain or b.domain.org? (Tue Sep 24 10:30:45 2013) [sssd[be[B.DOMAIN.ORG]]] [new_subdomain] (0x0400): Creating [domain.org] as subdomain of [B.DOMAIN.ORG] I have changed domain names in logs and changed bits of SIDs. Hope I have not confused anything with SID changes!! Thanks, Matthew

2 1

login problem sssd-1.11.0 Ubuntu saucy
by Longina Przybyszewska 27 Sep '13

27 Sep '13

I am testing sssd-1.11.0 in Ubuntu Saucy - and have problems with ssh and login from GUI-login (lightdm and gdm) to the machine. when using local account I get answers from commands: sudo id aduser getent passwd aduser I get "Permission denied:" trying to login : ssh x.x.x.x -l aduser ssh x.x.x. -l aduser(a)my.domain.com and login as aduser, aduser(a)my.domain.com from login screen. >From sssd_pam.log ----------------------- [sssd[pam]] [pam_check_user_search] (0x0400): Returning info for user [aduser(a)my.domain.com] (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_initgr_cache_set] (0x2000): [aduser] added to PAM initgroup cache (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_dp_send_req] (0x0100):Sending request with the following data: (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): domain: my.domain.com (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): user: aduser (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set - Ignored: (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): rhost: ariadne.i.my.domain.com (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 2007 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x111a980 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x417d20:3:aduser@my.domain.com] (Thu Sep 26 16:25:44 2013) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x111a980 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 111B7C0 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching. (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [4][my.domain.com] (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]. (Thu Sep 26 16:25:44 2013) [sssd[pam]] [pam_reply] (0x0100): blen: 29 (Thu Sep 26 16:25:44 2013) [sssd[pam]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x1118300][18] (Thu Sep 26 16:25:49 2013) [sssd[pam]] [pam_initgr_cache_remove] (0x2000): [aduser] removed from PAM initgroup cache (Thu Sep 26 16:25:51 2013) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 111A1A0 (Thu Sep 26 16:25:51 2013) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching. Longina

3 4

renewal of krb5 tickets created outside SSSD
by Michael Gliwinski 26 Sep '13

26 Sep '13

Hi all, Currently SSSD (when configured with krb5_renew_interval, etc.) will only renew tickets it itself created. Is it possible to somehow tell it to also look after some other ccaches? The use case I have is for sessions started e.g. via sudo -u + manual kinit or SSH PKI or SSH GSS-API (i.e. passwordless logins). Those are sometimes long- running, but the tickets won't be renewed automatically currently. If not currently possible, I was thinking of creating some simple program that would call SSSD functions to "register" a specified ccache path (krb5_save_ccname + add_tgt_to_renew_table?). Do you see any problems with this approach? Would those functions be somehow accessible from Python API? Thanks, Michael ********************************************************************************************** The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to the email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing client engagement leter or contract. If you have received this email in error please notify support(a)henderson-group.com John Henderson (Holdings) Ltd Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT. Registered in Northern Ireland Registration Number NI010588 Vat No.: 814 6399 12 *********************************************************************************

4 7

authenticating against all sub-domains in AD forest
by a t 23 Sep '13

23 Sep '13

Hi, I am testing find a standard config for Linux authentication against Active Directory and I am testing with Centos 6. I have decided on a SSSD/Kerberos/LDAP configuration as described in RedHats "Integrating Red Hat Enterprise Linux 6 with Active Directory" section 6.3. http://www.redhat.com/rhecm/rest-rhecm/jcr/repository/collaboration/jcr:sys… It works very well but for the one domain in our forest i.e. b.domain.org. However, users of other domains in the forest can not be authenticated. This is understandable as I have pointed all the config files at the child domains DC's, i.e. dc1.b.domain.org rather than dc1.domain.org. I have been searching for example configurations which will authenticate any user in the forest even though the Linux installation is joined to a different child domain but not found any. Scenario I would like to implement; Linux installation hostname = lin1lin1 joined to domain b.domain.orgusers from b.domain.org can login to lin1.b.doamin.orgusers from all child domains of domain.org can log into lin1.b.domain.org. for example a.domain.org, c.domain.org or z.domain.org I have attached my current config files as a reference. They work for a single domain rather than the whole forest. I suppose I am stuck whether to add each AD child domain as separate domains in SSSD and REALMS in kerberos or if I can get it to see the whole forest. Thanks for any help / pointers, Matthew

2 9

sssd and sudo
by Rowland Penny 23 Sep '13

23 Sep '13

Ok, I am back again, trying to get sssd to control sudo, but failing. I added the sudo active directory schema ldif to samba4 AD then added this: dn: OU=SUDOers,DC=example,DC=com objectClass: top objectClass: organizationalUnit ou: SUDOers dn: CN=linuxusers,OU=SUDOers,DC=example,DC=com objectClass: top objectClass: sudoRole cn: linuxusers sudoUser: %linuxusers sudoHost: ALL sudoCommand: ALL On a Linux Mint client: sudo apt-get install sudo-ldap Edited /etc/sudo-ldap.conf # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ssl/certs/ca-certificates.crt BASE DC=example,DC=com URI ldap://server.example.com ssl=no LDAP_VERSION 3 SUDOERS_BASE ou=SUDOers,DC=example,DC=com SUDOERS_SEARCH_FILTER (&(objectClass=sudoRole)) BINDDN CN=Administrator,CN=Users,DC=example,DC=com BINDPW xxxxxxxxxx then edited /etc/nsswitch.conf and added sudoers: files ldap restarted sudo then as a normal user, tried to run a command with sudo, this worked. I then altered /etc/sssd/sssd.conf and added services = nss, pam, autofs, sudo [sudo] ldap_sudo_search_base = OU=SUDOers,DC=example,DC=com altered /etc/nsswitch.conf sudoers: files sss restarted sssd restarted sudo tried to run the command with sudo again, this time it failed having been bitten by the way autofs works, I went straight to the way that sudo & sssd do the ldapsearch: SUDO (&(&(objectClass=sudoRole))(|(sudoUser=rowland)(sudoUser=%Domain Users)(sudoUser=%#20513)(sudoUser=%vboxusers)(sudoUser=%linuxusers)(sudoUser=%#127)(sudoUser=%#21110)(sudoUser=ALL))) SSSD (&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=ThinkPad)(sudoHost=ThinkPad.home.lan)(sudoHost=192.168.0.204)(sudoHost=192.168.0.0/24)(sudoHost=fe80::86a6:c8ff:fe3b:da7b)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*)))) sudo searches with objectClass=sudoRole & sudoUser attribute sssd searches with objectClass=sudoRole & sudoHost attribute Now I understand that the sssd search for the sudoHost attribute is to ensure that only sudo rules for the host are downloaded, but it doesn't actually seem to download any rules. Is there anyway I can get the sssd search to include the sudoUser attribute in the same way that the sudo ldap search does? Or can anybody tell me where I am going wrong (again). Rowland

6 20

Ubuntu Saucy sssd-1.11.0 not starting
by Longina Przybyszewska 23 Sep '13

23 Sep '13

Hi, I would test the new features (autofs !!!) in sssd-1.11.0 version in Ubuntu Saucy, and I am using native sssd package. I use working config file from sssd-1.9.4 Daemon doesn't start: root@saucy:/var/lib/sss# sssd -i (Mon Sep 9 18:30:36:657103 2013) [sssd] [confdb_init_db] (0x0010): Config file version could not be determined (Mon Sep 9 18:30:36:657280 2013) [sssd] [load_configuration] (0x0010): ConfDB initialization has failed [Input/output error] (Mon Sep 9 18:30:36:657466 2013) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. root@saucy:/var/lib/sss# sssd -d 9 -i (Mon Sep 9 18:30:54:183407 2013) [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed: [2][No such file or directory]. (Mon Sep 9 18:30:54:205801 2013) [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (Mon Sep 9 18:30:54:346409 2013) [sssd] [ldb] (0x4000): no modules required by the db (Mon Sep 9 18:30:54:346850 2013) [sssd] [ldb] (0x4000): No modules specified for this database (Mon Sep 9 18:30:54:347236 2013) [sssd] [ldb] (0x4000): start ldb transaction (nesting: 0) (Mon Sep 9 18:30:54:358172 2013) [sssd] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Mon Sep 9 18:30:54:368474 2013) [sssd] [ldb] (0x4000): start ldb transaction (nesting: 0) (Mon Sep 9 18:30:54:378564 2013) [sssd] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Mon Sep 9 18:30:54:388571 2013) [sssd] [ldb] (0x4000): start ldb transaction (nesting: 0) (Mon Sep 9 18:30:54:398769 2013) [sssd] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Mon Sep 9 18:30:54:410711 2013) [sssd] [confdb_init_db] (0x0010): Config file version could not be determined (Mon Sep 9 18:30:54:411510 2013) [sssd] [load_configuration] (0x0010): ConfDB initialization has failed [Input/output error] (Mon Sep 9 18:30:54:412372 2013) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. root@saucy:/var/lib/sss# ls -l db total 1256 -rw------- 1 root root 1286144 Sep 9 18:30 config.ldb Best Longina

2 15

ssh openldap and sssd
by Olivier 20 Sep '13

20 Sep '13

Hi everyone, I found this thread about openldap served ssh keys and sssd integration : https://lists.fedorahosted.org/pipermail/sssd-users/2013-March/000442.html then I subscribed to this list :-) I try to make that work but I stay stick : could you help ? Here is where I am: 1- I have loaded "openssh-lpk_openldap.schema" in openldap 2- I have configured my account in the directory to know about "sshPublicKey" attribute, and I have inserted my key : # ldapsearch -x -h localhost -b dc=guillard,dc=corp "(uid=olivier)" sshPublicKey dn: uid=olivier,dc=guillard,dc=corp sshPublicKey: ssh-dss AAAAB3NzaC1kc3MAAAEBAKXF ..... BaO51jw8RUAt1u5QDa3UQiQ6X8Vq0j2MUh3LeXfk= guillard@corp 3- I also have configured sssd to tell him to look up for ssh keys in ldap: # cat /etc/sssd/sssd.conf: [domain/default] ... (the conf is correct: everything works fine for login§/passwords for example) # I have added this in the default/section ldap_user_ssh_public_key = True [sssd] services = nss, pam, ssh domains = default [nss] [pam] [ssh] 4- I have restarted sssd (I get no error) And now I'm stuck # /usr/bin/sss_ssh_authorizedkeys olivier -> does not return anything Anyone could help : what have I forgotten ? Any indication about what I should add in ssh_config to tell sshd to look for keys in sssd cache would also help. Thanks ! --- Olivier

2 3

sssd, autofs and active directory
by Rowland Penny 18 Sep '13

18 Sep '13

Hello, I have inserted the automount schema into Samba 4 AD and got it to work (for those thinking that it will not work, try changing the two objectClasses to auxillary not structural) I can now add the following ldif to the AD database: dn: OU=automount,DC=example,DC=com objectClass: top objectClass: organizationalUnit ou: automount name: automount dn: OU=auto.master,OU=automount,DC=example,DC=com objectClass: top objectClass: automountMap objectClass: organizationalUnit ou: auto.master name: auto.master automountMapName: auto.master dn: CN=/shares,OU=auto.master,OU=automount,DC=example,DC=com objectClass: top objectClass: automount objectClass: container cn: /shares name: /shares automountKey: /shares automountInformation: auto.shares dn: OU=auto.shares,OU=automount,DC=example,DC=com objectClass: top objectClass: automountMap objectClass: organizationalUnit ou: auto.shares name: auto.shares automountMapName: auto.shares dn: CN=dropbox,OU=auto.shares,OU=automount,DC=example,DC=com objectClass: top objectClass: automount objectClass: container cn: dropbox name: dropbox automountKey: dropbox automountInformation: -fstype=cifs,rw,username=rowland,password=xxxxxxxxxx,uid=3001106,iocharset=utf8 ://192.168.0.2/dropbox And if I setup the client as follows: /etc/default/autofs MASTER_MAP_NAME="OU=auto.master,OU=automount,DC=example,DC=com" LOGGING="verbose" LDAP_URI="ldap://homeserver.example.com" # AD server name SEARCH_BASE="OU=automount,DC=example,DC=com" MAP_OBJECT_CLASS="automountMap" ENTRY_OBJECT_CLASS="automount" MAP_ATTRIBUTE="automountMapName" ENTRY_ATTRIBUTE="automountKey" VALUE_ATTRIBUTE="automountInformation" AUTH_CONF_FILE="/etc/autofs_ldap_auth.conf" /etc/autofs_ldap_auth.conf <?xml version="1.0" ?>  <autofs_ldap_sasl_conf usetls="no" tlsrequired="no" authrequired="yes" authtype="GSSAPI" clientprinc="THINKPAD$(a)EXAMPLE.COM" /> /etc/nsswitch.conf ........... automount: ldap It works! I can browse to the mount point and the share from the server is mounted. If I now modify sssd to control autofs. [sssd] config_file_version = 2 domains = example.com services = nss, pam,autofs [nss] [pam] [autofs] [domain/example.com] description = AD domain with Samba 4 server cache_credentials = true enumerate = false id_provider = ldap auth_provider = krb5 chpass_provider = krb5 access_provider = ldap krb5_server = server.example.com krb5_kpasswd = server.example.com krb5_realm = EXAMPLE.COM ldap_referrals = false ldap_schema = rfc2307bis ldap_access_order = expire ldap_account_expire_policy = ad ldap_force_upper_case_realm = true ldap_user_object_class = user ldap_user_name = sAMAccountName ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_group_name = sAMAccountName autofs_provider = ldap ldap_sasl_mech = GSSAPI ldap_autofs_search_base = OU=automount,DC=example,DC=com ldap_autofs_map_object_class = automountMap ldap_autofs_entry_object_class = automount ldap_autofs_map_name = automountMapName ldap_autofs_entry_key = automountKey ldap_autofs_entry_value = automountInformation /etc/nsswitch.conf ........... automount: sss sudo service sssd restart sudo service autofs restart autofs now no longer works. If we look in the logs we find: /var/log/syslog Sep 16 15:10:50 ThinkPad automount[4056]: Starting automounter version 5.0.7, master map OU=auto.master,OU=automount,DC=example,DC=com Sep 16 15:10:50 ThinkPad automount[4056]: using kernel protocol version 5.02 Sep 16 15:10:50 ThinkPad automount[4056]: setautomntent: lookup(sss): setautomntent: No such file or directory Sep 16 15:10:50 ThinkPad automount[4056]: no mounts in table /var/log/sssd/sssd_example.com.log (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(automountMapName=OU=auto.master,OU=automount,DC=example,DC=com)(objectclass=automountMap))][OU=automount,DC=example,DC=com]. (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [automountMapName] (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 8 (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x7166f0], connected[1], ops[0x725020], ldap[0x6e04b0] (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_get_automntmap_process] (0x0400): Search for autofs maps, returned 0 results. (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sdap_autofs_setautomntent_done] (0x0080): Could not find automount map (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [sysdb_delete_autofsmap] (0x0400): Deleting autofs map OU=auto.master,OU=automount,DC=example,DC=com (Mon Sep 16 15:10:50 2013) [sssd[be[example.com]]] [be_autofs_handler_callback] (0x1000): Request processed. Returned 0,0,Success sssd seems to be searching using this filter: (&(automountMapName=OU=auto.master,OU=automount,DC=example,DC=com)(objectclass=automountMap))][OU=automount,DC=example,DC=com]. which means to me, search in the base 'OU=automount,DC=example,DC=com' for the attribute 'automountMapName' which contains 'OU=auto.master,OU=automount,DC=example,DC=com' AND the DN that contains 'automountMapName' must also contain the objectClass 'automountMap' Is this correct? If I am correct, then I think that sssd is never going to work with autofs & AD as is, even though Steve assures me it does. This is because, even though the DN 'OU=auto.master,OU=automount,DC=example,DC=com' has the objectClass 'automountMap' and does contain the attribute 'automountMapName' this contains 'auto.shares' not 'OU=auto.master,OU=automount,DC=example,DC=com'. The problem, as I see it, is that in LDAP you can have a DN such as 'automountMapName=auto.master,cn=automount,dc=example,dc=com', but this would seem to be not allowed in AD, I cannot add an ldif using such a template I have tried both the NIS setup and the one above and they all fail in the same way for me, i.e they work perfectly if I use ldap in nsswitch.conf but will not work if I try to use sssd. Can anybody see where I am going wrong? By the way, I based this setup on a blog by some guy named Jakub Hrozek which I found here: http://jhrozek.livejournal.com/2012/05/01/ Rowland

3 9

how do I restrict access when access_provider = ad ?
by Doug Clow 16 Sep '13

16 Sep '13

Hello, I recently switched my sssd to 1.9 so I can try the native Active Directory support. Previously I was using: id_provider = ldap auth_provider = krb5 chpass_provider = krb5 access_provider = ldap And now with 1.9 I'm using: id_provider = ad auth_provider = ad chpass_provider = ad access_provider = ad This works great except for one thing. ldap_access_filter no longer does anything so everyone can log into all the machines. When I'm using access_provider = ad how do I restrict which users and groups have access to the machine? Thanks, Doug

3 7

Active Directory parent-child trust
by Alfredo Colangelo 16 Sep '13

16 Sep '13

Hello List, I've built sssd-1.11.90 from git source for a CentOS 6.4 server. I want to set up a connection with SSSD to 2 Active Directory domains (both Windows 2003 functional level), parent and child, so they have a parent-child transitive trust: ad.example.com \_child.ad.example.com I've joined the server to the parent domain using the ad provider, that (from 1.10 on) supports AD trusts. I'm expecting to be able to login (via ssh) to the server both using " testuser(a)ad.example.com" (which works), and using " testuser(a)child.ad.example.com" which doesen't work. This is what I want to fix. If I join the server to the child domain I am able to login with users from child domain (as expected), but not with users from parent domain. My guess is that trust isn't working. Running "getent passwd" enumerates users only from the parent domain, but nothing from the child domain. This is sssd.conf contents: [sssd] services = nss, pam config_file_version = 2 domains = ad.example.com [domain/ad.example.com] id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad ad_server = dc1.ad.example.com ad_backup_server = dc2.ad.example.com filter_users = root(a)ad.example.com filter_groups = root(a)ad.example.com ldap_id_mapping = false dyndns_update = true dyndns_update_ptr = false enumerate = true subdomain_enumerate = all cache_credentials = true I'm not using ID Mapping, I'm using posix attributes from AD, but even enabling ID mapping the result doesen't change. Am I doing something the wrong way ? Is it possible the problem is that the domains are not Windows 2008 R2 (as of documentation the only supported configuration for the AD provider) ? Thanks, Alfredo

2 1

Re: [SSSD-users] Need help configuring fine grained password policy
by Bright, Daniel 13 Sep '13

13 Sep '13

Jakub, Thanks for the response, I figured out why I was getting the constraint violation, in my case it was because I have the "passwordminage" set for my policy, when I changed the user attribute "passwordallowchangetime" to the current date then I was able to perform the passwd operation. So at this point I believe the password policy is being applied, however I am just not getting all of the responses I would like, I get things like "password is too short", "your password will expire in X days", but I would expect to get something like "You cannot change your password again for X days" from the above This leads me to another question, is there a way I can map certain responses to responses that I define? Thanks, Daniel B

3 4

Need help configuring fine grained password policy
by Bright, Daniel 12 Sep '13

12 Sep '13

Jakub, I took your advice and turned debugging to level 9, this is what I am seeing in the logs: ======================================================================================================= [root(a)some.server.com sssd]# tail -f sssd_LDAP.log | grep sdap_exop (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (0x0100): Executing extended operation (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (0x2000): ldap_extended_operation sent, msgid = 3 (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (0x0200): Server returned no controls. (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (0x0080): ldap_extended_operation result: Constraint violation(19), Failed to update password ======================================================================================================= Here is some more relevant log information: ======================================================================================================= [root(a)some.server.com sssd]# tail -f sssd_LDAP.log | grep sdap_exop (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (0x0100): Executing extended operation (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (0x2000): ldap_extended_operation sent, msgid = 3 (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (0x0200): Server returned no controls. (Thu Sep 12 09:44:57 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (0x0080): ldap_extended_operation result: Constraint violation(19), Failed to update password (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0100): Executing START TLS (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x90d340], connected[1], ops[0x9cb7d0], ldap[0x9e8030] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_EXTENDED] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_connect_done] (0x0080): START TLS result: Success(0), Start TLS request accepted.Server willing to negotiate SSL. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'atl01osd110.vsi.com' as 'working' (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'atl01osd110.vsi.com' as 'working' (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x98db10 (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x9e8cf0 (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [ldb] (0x4000): Destroying timer event 0x9e8cf0 "ltdb_timeout" (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [ldb] (0x4000): Ending timer event 0x98db10 "ltdb_callback" (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [find_password_expiration_attributes] (0x4000): No password policy requested. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_send] (0x0100): Executing simple bind as: uid=user1,ou=People,dc=some,dc=company,dc=com (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_send] (0x2000): ldap simple bind sent, msgid = 2 (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x90d340], connected[1], ops[0x900e80], ldap[0x9e8030] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x90d340], connected[1], ops[0x900e80], ldap[0x9e8030] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_BIND] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_done] (0x2000): Server returned control [1.3.6.1.4.1.42.2.27.8.5.1]. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_done] (0x1000): Password Policy Response: expire [346806] grace [-1] error [No error]. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_done] (0x1000): Password will expire in [346806] seconds. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_done] (0x2000): Server returned control [2.16.840.1.113730.3.4.5]. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_done] (0x1000): Password will expire in [346806] seconds. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [simple_bind_done] (0x0400): Bind result: Success(0), no errmsg set (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [auth_bind_user_done] (0x4000): Found ppolicy data, assuming LDAP password policies are active. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_auth4chpass_done] (0x1000): user [uid=user1,ou=People,dc=some,dc=company,dc=com] successfully authenticated. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_control_create] (0x0080): Server does not support the requested control [1.3.6.1.4.1.42.2.27.8.5.1]. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (0x0100): Executing extended operation (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_send] (0x2000): ldap_extended_operation sent, msgid = 3 (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x90d340], connected[1], ops[0x9bf740], ldap[0x9e8030] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_result] (0x2000): Trace: sh[0x90d340], connected[1], ops[0x9bf740], ldap[0x9e8030] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_EXTENDED] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (0x0200): Server returned no controls. (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_exop_modify_passwd_done] (0x0080): ldap_extended_operation result: Constraint violation(19), Failed to update password (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (3, 12, <NULL>) [Internal Error (Authentication token is no longer valid; new one required)] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [12][LDAP] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent result [12][LDAP] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0x90d340], connected[1], ops[(nil)], ldap[0x9e8030], destructor_lock[0], release_memory[0] (Thu Sep 12 09:54:50 2013) [sssd[be[LDAP]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. ======================================================================================================= I noticed it says "Server does not support the requested control [1.3.6.1.4.1.42.2.27.8.5.1]" looking at my 389-ds schema my password policy OID = 2.16.840.1.113730.3.2.13, could this be the issue? Thanks, Daniel B.

3 2

Re: [SSSD-users] Need help configuring fine grained password policy enforcement on RHEL6 using sssd
by Bright, Daniel 12 Sep '13

12 Sep '13

Jakub, Thanks for the quick response, to answer your question I am using the built-in password policy features of 389-ds that allows us to use these features: Maximum Number of Failures Password Change After Reset User-Defined Passwords Password Expiration Expiration Warning Grace Login Limit Password Syntax Checking Password Length Password Minimum Age Password History Password Storage Schemes Password Last Change Time Here is a sanitized version of ldap.conf that is used in our current environment: =========================================================================== host ldap1 ldap2 URI ldap://ldap1:389 ldap://ldap2:389 base dc=some,dc=company,dc=com #bind_timelimit 5 #>> bind_timelimit 3 bind_policy soft timelimit 3 #^^ ldap_version 3 pam_lookup_policy yes pam_filter objectclass=posixAccount pam_password md5 nss_base_passwd ou=People,dc=some,dc=company,dc=com?one nss_base_passwd ou=Disabled Users,dc=some,dc=company,dc=com?one nss_base_shadow ou=People,dc=some,dc=company,dc=com?one nss_base_group ou=Groups,dc=some,dc=company,dc=com?one?|(host=\2A)(host=osd) #>> nss_initgroups_ignoreusers root,ldap #^^ ssl start_tls #ssl on tls_cacertdir /etc/openldap/cacerts =========================================================================== Thanks, Daniel Bright

3 2

Need help configuring fine grained password policy enforcement on RHEL6 using sssd
by Bright, Daniel 11 Sep '13

11 Sep '13

I was told by the good folks at the 389-users mailing list to instead redirect my question to the sssd-users list so here goes, thanks in advance! All, I am in the process of moving away from pam_ldap and on to pam_sss. The basic sssd setup is working just fine, user authentication works, getent passwd works, caching is great, everything looks like it's working fine except for password policy enforcement. I am wondering if there is some sort of password policy overlay I need to use, or a special setup of sssd.conf, I tried using "ldap_pwd_policy=shadow" however this doesn't allow me to change passwords, I instead get this error: [user1@someserver ~]$ passwd Changing password for user user1. Current Password: New password: Retype new password: Password change failed. Server message: Failed to update password (3 second delay here) passwd: Authentication token is no longer valid; new one required As soon as I comment out ldap_pwd_policy=shadow this error goes away, however so does my password policy enfocement. If anyone could help it would be greatly appreciated, I will post a working config on my blog after this is done so we can help others too. Thanks! Daniel B.

2 1

bad basedn with autofs in sssd
by Dale Harris 11 Sep '13

11 Sep '13

Hi folks, Trying to set up autofs in sssd. It doesn't appear that sssd likes my basedn, one that I use on Solaris just fine. In my sssd_default.log I see: sssd_default.log:(Tue Sep 10 23:59:59 2013) [sssd[be[default]]] [common_parse_search_base] (0x0020): Invalid base DN ["o=nycornell.org"] I'm running RHEL 6.4. sssd-1.9.2-82.7 libsss_autofs-1.9.2-82.7 User authentication in with sss/ldap works just fine. Any suggestions? Changing my basedn will be impossible. -- Dale Harris rodmur(a)maybe.org rodmur(a)gmail.com /.-)

3 9

Kerberos DNS SRV records preference
by Bolesław Tokarski 09 Sep '13

09 Sep '13

Hello, Can somebody confirm me the behaviour of SSSD (we're currently on version 1.8.6, but will migrate to whatever comes in Ubuntu 14.04) with regards to Kerberos DNS records? I mean, sssd series 1.8 did not have any special handling for AD, so LDAP queries went to provided ldap_uri and Kerberos queries thanks to the dns_discover_domains are handled by the DNS SRV records for _kerberos._udp.example.com. Correct me if I'm wrong. The DNS SRV records have a preference, or a priority option. Is this taken into account, so that lower priority server is never accessed if the higher one answers? I am asking because or AD team implemented some "Disaster Recovery" domain controller which they only turn on for 2 hours a week, after work of course and I believe the logon time is much longer now. I don't have exact details for it, though. They claim that they cannot remove the SRV record for the "special" server as it will not replicate the AD structure to the server in such a case, so they offered to lower the priority, but I'm not sure if that's going to help. I was also informed that the client should be actually using SRV records for the particular site, which don't contain the "special" server. Does the 1.9+ series AD backend solve this particular issue? Best regards, Bolesław Tokarski

3 4

FreeIPA on Debian
by Dmitri Pal 03 Sep '13

03 Sep '13

Hello, Sorry for cross posting to 4 different lists but it seems that this is the best way to include most of people who might be interested in this discussion. The question of "When FreeIPA will be available on Debian?" has been coming up periodically on the list(s) without any resolution. However it is clear that it would be beneficial for the community and the project. May be it is time to try again? Let us see why it yet has not happened? 1) Some components need to be ported to Debian especially Dogtag and a slew of its new RESTEasy dependencies. This requires time and quite an effort from someone familiar with the domain. 2) The code needs to be changed in installer and potentially in other places as it might have had some Fedorizms blended in 3) Someone needs to own packages in Debian and maintain them, someone with good knowledge of the distro and time to take ownership of about 50 packages. Can we pull it off together this time? Say we plan for some Dogtag and IPA domain experts to work on the port during Nov 13 - Feb 14 and address 1) and 2). Would there be any interest to join forces with them? Would there be anyone to take on item 3) from the list above? -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

6 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users September 2013