testing dyndns_update
by steve
Hi
We have 1.10.0beta1 on lubuntu 13.04
We have added
dyndns_update=true
dyndns_refresh_interval=1
to sssd.conf
We expect to see an update request after 1 minute, but nothing happens.
Are we correct to expect this behaviour?
Cheers,
Steve
10 years, 11 months
Re: [SSSD] SSSD with SSH and PAM Account Expired
by David Frost
Hi,
Thanks for the help, I increased the debug level and found that it was my ldap_access_filter that wasn't allowing the user to login. It just happened that the error in the log was saying the account had expired, when really it hadn't.
Initially I too thought it may have been missing attributes, but turned out not to be the case.
Thanks again,
Regards David.
From: David Frost
Sent: Wednesday, May 08, 2013 12:27 PM
To: 'sssd-devel(a)lists.fedorahosted.org'
Subject: SSSD with SSH and PAM Account Expired
Hi, having configured SSSD on RHEL 6.4 to connect to our OpenLDAP server successfully, I can get a list of users and groups using the getent command but cannot ssh into the host or login via the console.
The following error message is returned in /var/log/secure:
May 8 12:18:26 rh-test-mg01 sshd[6660]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.21.21.1 user=jimbob
May 8 12:18:26 rh-test-mg01 sshd[6660]: pam_sss(sshd:account): Access denied for user jimbob: 6 (Permission denied)
May 8 12:18:26 rh-test-mg01 sshd[6658]: error: PAM: User account has expired for jimbob from 10.21.21.1
These are my ldap details:
# extended LDIF
#
# LDAPv3
# base <uid=jimbob,ou=people,dc=XXX,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# jimbob, People, XXX.com
dn: uid=jimbob,ou=People,dc=XXX,dc=com
givenName: Jim
sn: Bob
uid: jimbob
uidNumber: 1081
homeDirectory: /home/jimbob
loginShell: /bin/bash
cn: Jim Bob
gidNumber: 1398
mail: jim.bob(a)XXX.com<mailto:jim.bob@XXX.com>
userPassword:: XXX
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: ldapPublicKey
objectClass: shadowAccount
If I comment out the following line in /etc/pam.d/password-auth then I can login via ssh but still not the console.
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
Any help would be greatly appreciated.
Thanks in advance, David.
Truphone Limited, registered in England and Wales (registered company number: 04187081). Registered office: 4 Royal Mint Court, London EC3N 4HJ. VAT No. GB 851 5278 19
This e-mail, and any attachment(s), may contain information which is confidential and/or privileged, and is intended for the addressee only. If you are not the intended recipient, you may not use, disclose, copy or distribute this information in any manner whatsoever. If you have received this e-mail in error, please contact the sender immediately and delete it.
10 years, 11 months
can't build 1.10.0beta1 missing Samba 4 development libraries
by steve
Hi
openSUSE 12.3
./configure fails with
configure: error: "Please install Samba 4 development libraries"
We have installed the libraries necessary to build Samba4:
libacl-devel python-selinux autoconf make \
python-devel gdb sqlite3-devel libgnutls-devel binutils \
policycoreutils-python setools-libs selinux-policy \
setools-libs popt-devel libpcap-devel keyutils-devel \
libidn-devel libxml2-devel libacl-devel libsepol-devel \
libattr-devel zlib-devel cyrus-sasl-devel gcc \
krb5-client openldap2-devel libopenssl-devel\
bind-utils bind-lib
We can build sssd 1.9.5 with this plus what we have installed.
What are we missing to build the beta?
Cheers,
Steve
10 years, 11 months
SSSD with SSH and PAM Account Expired
by David Frost
Hi, having configured SSSD on RHEL 6.4 to connect to our OpenLDAP server successfully, I can get a list of users and groups using the getent command but cannot ssh into the host or login via the console.
The following error message is returned in /var/log/secure:
May 8 12:18:26 rh-test-mg01 sshd[6660]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.21.21.1 user=jimbob
May 8 12:18:26 rh-test-mg01 sshd[6660]: pam_sss(sshd:account): Access denied for user jimbob: 6 (Permission denied)
May 8 12:18:26 rh-test-mg01 sshd[6658]: error: PAM: User account has expired for jimbob from 10.21.21.1
These are my ldap details:
# extended LDIF
#
# LDAPv3
# base <uid=jimbob,ou=people,dc=XXX,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# jimbob, People, XXX.com
dn: uid=jimbob,ou=People,dc=XXX,dc=com
givenName: Jim
sn: Bob
uid: jimbob
uidNumber: 1081
homeDirectory: /home/jimbob
loginShell: /bin/bash
cn: Jim Bob
gidNumber: 1398
mail: jim.bob(a)XXX.com
userPassword:: XXX
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: ldapPublicKey
objectClass: shadowAccount
If I comment out the following line in /etc/pam.d/password-auth then I can login via ssh but still not the console.
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
Any help would be greatly appreciated.
Thanks in advance, David.
Truphone Limited, registered in England and Wales (registered company number: 04187081). Registered office: 4 Royal Mint Court, London EC3N 4HJ. VAT No. GB 851 5278 19
This e-mail, and any attachment(s), may contain information which is confidential and/or privileged, and is intended for the addressee only. If you are not the intended recipient, you may not use, disclose, copy or distribute this information in any manner whatsoever. If you have received this e-mail in error, please contact the sender immediately and delete it.
10 years, 11 months
[PATCH] Use AD domain flat name to match domains
by Jakub Hrozek
Hi,
the attached patch implements the changes described in #1468. The logic
itself is implemented in confdb_get_domain_internal, which breaks the
layering a little because there is some knowledge about the providers
used in the responders, in particular loading the flat name is only
called if the id_provider equals "AD".
Also technically the NetBIOS name could be completely different from the
AD domain name and could have been read from the rootDSE. But honestly
I really don't think it's worth it, so I went with a config option, that
would be unset in the vast majority of deployments.
10 years, 11 months
