sssd-users January 2015

sssd-users@lists.fedorahosted.org

22 participants
23 discussions

sssd able to login the user but failed on sudo
by Karim 06 May '15

06 May '15

Hi Team, i have two forests both working fine in terms of authentication. I added a user to sudoers from one of the domains and he is getting access denied. the user is able to login with no problem, sudo is not working. in the secure log it shows "account is expired" in the SSSD logs it shows error "attempting to kinit for realm xxxxxx" then "clients credentials has been revoked" i checked the account and it is not expired nor locked. additionally: I have another account on the same forest which i used to join to the domain and it is working fine on both authentication and sudoers. I also tried ldap_user_principal = no suchattribute and krb5_use_enterprise_principal = false but the problem remains. what could be the reason behind being able to access and later getting clients credential revoked for sudoes? Thanks

4 11

RHEL/CentOS 6 problems with missing supplemental groups for AD users
by John Beranek 17 Apr '15

17 Apr '15

Hi, I've been investigating problems with the SSSD 1.11 versions supplied in RHEL/CentOS 6.6 for a while now. I've followed: https://access.redhat.com/solutions/1264443 https://fedorahosted.org/sssd/ticket/2472 and also created a case with Red Hat support. However, I'm still no closer to solving the issue. After updating servers to the SSSD in 6.6, intermittently (for particular users but not on all servers, and not necessarily all the time) users don't get their supplementary groups. e.g: [root@rhel6-template sssd]# id matthewbe uid=46721(matthewbe) gid=20513(domain users) groups=20513(domain users) This is with the latest SSSD on a RHEL6.6 server, i.e.: sssd-1.11.6-30.el6_6.3.x86_64 Our environment is Windows 2003 AD controllers, and users *without* POSIX attributes in their AD records. So, snippets of sanitised sssd.conf: [domain/AD] debug_level = 9 id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad ad_server = dc01.local,dc02.local ad_backup_server = ad.local ad_domain = ad.local # ID mapping min_id = 20000 ldap_idmap_range_min = 20000 #ldap_idmap_range_max = 220000 ldap_idmap_range_size = 200000 ldap_idmap_default_domain_sid = S-1-5-21-2365159532-2245169678-2931239768 ldap_schema = ad ldap_id_mapping = true override_homedir = /home/AD/%u override_shell = /bin/bash # access controls ldap_access_order = expire ldap_account_expire_policy = ad ldap_force_upper_case_realm = true # performance ldap_referrals = false I've tried a few config changes to fix the issue, but none has fixed it, including: ldap_use_tokengroups = False ldap_group_objectsid = objectSID ldap_user_objectsid = objectSID ldap_deref_threshold = 0 ldap_schema = rfc2307bis Given Red Hat support hasn't been able to fix our issue, what else can I do? Cheers, John -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake

2 7

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

11 Feb '15

Hi, Is it possible to configure SSSD to make possible to login with short names across trusty domains? The sAMAccount name attribute in AD are unique, and all users have Posix attributes assigned so there is no risk for name mismatch between different domains. I use ad provider and all default setting for AD backend(gc_search_enable) ; If use_fully_qualified_names = False only users from client machines native domain can login with shortnames; Users from other domains are "unknown". I can successfully make ldapsearch to Global Catalog in top domain for login names=shortname for users from different domains: ldapsearch -H ldap://ldap.c.example.com:3268 -Y GSSAPI -N -b "dc=c,dc=example,dc=org" "(&(objectClass=user)(sAMAccountName=user))" user = user-a from a.c.example.org user = user-b from b.c.example.org best, Longina

6 18

AutoFS and variables
by Brendan Kearney 10 Feb '15

10 Feb '15

i want to have an automount configured so that nas.bpk2.com:/export/music is mounted on /home/<username>/Music. i want to use the HOME variable, but several attempts have not gotten the job done. i have tried $HOME/Music, ${HOME}/Music, and {$HOME}/Music, and none have worked. what is the correct way to use a variable with AutoFS and SSSD? i have used the hard values to get things working for my id, but want to have this work for all users. dn: automountKey=/home/brendan/Music,automountMapName=auto.shares,cn=autofs,ou=Daemons,dc=bpk2,dc=com automountinformation: nas.bpk2.com:/export/music automountkey: /home/brendan/Music description: music objectclass: automount objectclass: top thanks, brendan

4 15

pam_sss logging and fail2ban
by Orion Poplawski 30 Jan '15

30 Jan '15

I'm looking for some help with this problem. I'd like to have fail2ban block systems trying to authenticate via smtp or imap. However, for known users I get: Jan 28 13:33:36 mail auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=frank rhost=189.22.108.130 user=known_user Jan 28 13:33:37 mail auth: pam_sss(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=frank rhost=189.22.108.130 user=known_user and for unknown users I get: Jan 28 13:27:16 mail auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=unknown_user rhost=189.22.108.130 so I can't key off of the pam_unix messages because that will lock out known users, and keying off of pam_sss will only block attacks that guess a correct username. Is there some way I can get pam_sss to log the unknown user attempts? -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

4 4

sssd-ad GPO not working
by Koen de Boeve 30 Jan '15

30 Jan '15

Hi all, I am having issues getting remote and local GPO restrictions to work I am using: - 2 Samba 4.1.16 PDC's on CentOS 6.5 64bit - 1 CentOS 7 installation with sssd 1.12.3. as testclient. other GPO's are working fine for windows machines. Authentication against the Samba4 Domain on the testclient with sssd is working fine too. I am now trying to use a Group Policy to deny access for 'testuser' for both local login as well as remote login ( ssh and xrdp ) This is not working at all. I created a GPO which I linked to OU=Linux,OU=Servers,DC=mydomain,DC=com in there, I have one machine, called ITCOPY. the GPO sets Deny Logon and Deny Remote Desktop access for MYDOMAIN\testuser The GPO is set to be Enforced and the Security target is Authenticated Users. as you can see, I set access_control back to permissive, so I should see some indication that the GPO is working in the log file. Any help would be much appreciated! Regards, Koen My sssd conf: # ========================================= [sssd] domains = mydomain.com config_file_version = 2 services = nss, pam [domain/mydomain.com] ad_domain = mydomain.com ad_server = pdc.mydomain.com krb5_realm = mydomain.com realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = False fallback_homedir = /home/%u debug_level = 9 enumerate = True access_provider = ad #ad_access_filter = (&(memberOf=CN=linuxadmin,CN=Users,DC=mydomain,DC=com)(unixHomeDirectory=*)) id_provider = ad auth_provider = ad chpass_provider = ad ad_gpo_access_control = permissive ldap_schema = ad dyndns_update = true dyndns_refresh_interval = 43200 dyndns_update_ptr = true dyndns_ttl = 3600 ad_gpo_map_remote_interactive = +xrdp-sesman # ===================================== This is part of the sssd log file: (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_access_send] (0x0400): service sshd maps to Remote Interactive (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_access_send] (0x4000): server_hostname from uri: pdc.mydomain.com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_connect_done] (0x0400): sam_account_name is ITCOPY$ (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[0]->som_dn is OU=Linux,OU=Servers,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[1]->som_dn is OU=Servers,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[2]->som_dn is DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[3]->som_dn is cn=Default-First-Site-Name,cn=Sites,CN=Configuration,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_som_attrs_done] (0x4000): gpoptions attr not found or has no value; defaults to 0 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: OU=Linux,OU=Servers,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x4000): gplink_list[0]: [cn={D49E3752-2ECB-42F6-A418-2AE1F3092929},cn=policies,cn=system,DC=mydomain,DC=com; 2] (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_som_attrs_done] (0x4000): gpoptions attr not found or has no value; defaults to 0 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: OU=Servers,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x4000): gplink_list[0]: [cn={691A69C9-FEF3-4A42-8129-64E8741F9D2C},cn=policies,cn=system,DC=mydomain,DC=com; 1] (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x4000): ignored gpo skipped (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_som_attrs_done] (0x4000): gpoptions attr not found or has no value; defaults to 0 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_gplink_list] (0x4000): gplink_list[0]: [CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mydomain,DC=com; 0] (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[0]->gpo_dn: CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[1]->gpo_dn: cn={D49E3752-2ECB-42F6-A418-2AE1F3092929},cn=policies,cn=system,DC=mydomain,DC=com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): populating attrs for gpo_guid: {31B2F340-016D-11D2-945F-00C04FB984F9} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_extract_smb_components] (0x4000): input_path: \\mydomain.com\sysvol\mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): smb_server: smb://pdc.mydomain.com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): smb_share: /sysvol (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): smb_path: /mydomain.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): gpo_func_version: 2 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): gpo_flags: 0 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_parse_machine_ext_names] (0x4000): num_gpo_cse_guids: 3 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[0] is {35378EAC-683F-11D2-A89A-00C04FBBCFA2} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[1] is {827D319E-6EAC-11D2-A4EA-00C04F79F83A} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[2] is {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): populating attrs for gpo_guid: {D49E3752-2ECB-42F6-A418-2AE1F3092929} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_extract_smb_components] (0x4000): input_path: \\mydomain.com\SysVol\mydomain.com\Policies\{D49E3752-2ECB-42F6-A418-2AE1F3092929} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): smb_server: smb://pdc.mydomain.com (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): smb_share: /SysVol (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): smb_path: /mydomain.com/Policies/{D49E3752-2ECB-42F6-A418-2AE1F3092929} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): gpo_func_version: 2 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_get_gpo_attrs_done] (0x4000): gpo_flags: 0 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_parse_machine_ext_names] (0x4000): num_gpo_cse_guids: 1 (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[0] is {827D319E-6EAC-11D2-A4EA-00C04F79F83A} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl candidate_gpo_guid:{31B2F340-016D-11D2-945F-00C04FB984F9} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000): GPO not applicable to target per security filtering (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl candidate_gpo_guid:{D49E3752-2ECB-42F6-A418-2AE1F3092929} (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_filter_gpos_by_dacl] (0x4000): GPO not applicable to target per security filtering (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_process_gpo_done] (0x0400): no applicable gpos found after dacl filtering (Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_access_done] (0x0400): GPO-based access control successful.

7 20

sssd cache detection ?
by Ash Nand 30 Jan '15

30 Jan '15

Hi there. Does sssd export any library/function which would allow one to test if the dataset *was* coming from a cache and NOT the real source (assuming source outage)? I have a LDAP backend provider here with a generous cache timeout. I was wondering if it would be possible to tap somewhere , to achieve something equivalent to `getent -s sss passwd xxx` but only if/when user xxx was cached by sssd and in offline mode. In other words detect when sssd is in offline mode, the sssd cache is transparently servicing clients without resorting to parsing log files. thkx -ash

3 2

Cannot change LDAP password when ldap_pwd_policy=shadow
by Stephen Johnson 28 Jan '15

28 Jan '15

I'm running SSSD 1.8.6-0ubuntu0.3 on Ubuntu 12.04 and I've hit this bug https://bugs.launchpad.net/debian/+source/sssd/+bug/1415545, basically if you set ldap_pwd_policy=shadow and you don't have the ppolicy overlay on your ldap server it breaks changing passwords. I'm just wondering if this is fixed in a later version, in which chase I"ll have to backport it / patch 1.8.6 or if anyone knows are work around for the problem.

2 2

SSSD Kerberos (kinit)
by Günther J. Niederwimmer 23 Jan '15

23 Jan '15

Hello, I play now same days with sssd, bur on my Installation, it is not possible to config ssd for a "krb5_renew_interval =" I tested CentOs 7 and SUSE but this is not working ? Can any help me to find a correct sssd.conf or is this broken in sssd? -- mit freundlichen Grüßen / best Regards, Günther J. Niederwimmer

4 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users January 2015