SSSD Configuration issue

[Nitesh Mehare]

Hello

I'm configuring SSSD for the first time.I'm trying to setup the machine to
authenticate using ldap server using sssd.The machine configuration is as
follows

bash-3.2# uname -a
Linux bagira.in.ibm.com 2.6.18-238.el5 #1 SMP Sun Dec 19 14:22:44 EST 2010
x86_64 x86_64 x86_64 GNU/Linux
bash-3.2# cat /etc/issue
Red Hat Enterprise Linux Server release 5.6 (Tikanga)
Kernel \r on an \m

bash-3.2#

bash-3.2# rpm -qa |grep sssd
sssd-1.2.1-39.el5
sssd-client-1.2.1-39.el5
bash-3.2#

*I have modified sssd.conf file *

bash-3.2# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2

# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3

# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam

# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
 domains = LDAP

[nss]
# The following prevents SSSD from searching for the root user/group in
# all domains (you can add here a comma-separated list of system accounts
that
# are always going to be /etc/passwd users, or that you want to filter out).
filter_groups = root
filter_users = root
reconnection_retries = 3

# The entry_cache_timeout indicates the number of seconds to retain an
# entry in cache before it is considered stale and must block to refresh.
# The entry_cache_nowait_timeout indicates the number of seconds to
# wait before updating the cache out-of-band. (NSS requests will still
# be returned from cache until the full entry_cache_timeout). Setting this
# value to 0 turns this feature off (default).
; entry_cache_timeout = 600
; entry_cache_nowait_timeout = 300

[pam]
reconnection_retries = 3

# Example domain configurations
# Note that enabling enumeration in the following configurations will have a
# moderate performance impact while enumerations are actually running, and
# may increase the time necessary to detect network disconnection.
# Consequently, the default value for enumeration is FALSE.
# Refer to the sssd.conf man page for full details.

# Example LOCAL domain that stores all users natively in the SSSD internal
# directory. These local users and groups are not visible in /etc/passwd; it
# now contains only root and system accounts.
; [domain/LOCAL]
; description = LOCAL Users domain
; id_provider = local
; enumerate = true
; min_id = 500
; max_id = 999

# Example native LDAP domain
# ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute
# for group membership, or to "rfc2307bis", which uses the "member"
attribute
# to denote group membership. Changes to this setting affect only how we
# determine the groups a user belongs to and will have no negative effect on
# data about the user itself. If you do not know this value, ask an
# administrator.
 [domain/LDAP]
 debug_level = 9
 id_provider = ldap
 auth_provider = ldap
 ldap_schema = rfc2307
 access_provider = ldap
 ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
 ldap_uri = ldap://lbullet.in.ibm.com
 ldap_search_base = ou=People,o=sample
 ldap_tls_reqcert = never
 cache_credentials = false
 enumerate = False

# Example LDAP domain where the LDAP server is an Active Directory server.

; [domain/AD]
; description = LDAP domain with AD server
; enumerate = false
; min_id = 1000
;
; id_provider = ldap
; auth_provider = ldap
; ldap_uri = ldap://your.ad.server.com
; ldap_schema = rfc2307bis
; ldap_user_search_base = cn=users,dc=example,dc=com
; ldap_group_search_base = cn=users,dc=example,dc=com
; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com
; ldap_default_authtok_type = password
; ldap_default_authtok = YOUR_PASSWORD
; ldap_user_object_class = person
; ldap_user_name = msSFU30Name
; ldap_user_uid_number = msSFU30UidNumber
; ldap_user_gid_number = msSFU30GidNumber
; ldap_user_home_directory = msSFU30HomeDirectory
; ldap_user_shell = msSFU30LoginShell
; ldap_user_principal = userPrincipalName
; ldap_group_object_class = group
; ldap_group_name = msSFU30Name
; ldap_group_gid_number = msSFU30GidNumber
; ldap_force_upper_case_realm = True
bash-3.2#

*The system-auth file looks like this*

bash-3.2# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    /lib64/security/pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore]
/lib64/security/pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    sufficient    /lib64/security/pam_sss.so use_authtok
password    required      pam_deny.so

session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
session     sufficient    /lib64/security/pam_sss.so
session     required      pam_unix.so
bash-3.2#

bash-3.2# cat /etc/nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far
#

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis

passwd:     files sss
shadow:     files
group:      files sss

#hosts:     db files nisplus nis dns
hosts:      files dns

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files

netgroup:   nisplus

publickey:  nisplus

automount:  files nisplus
aliases:    files nisplus

bash-3.2#

*The firewall and selinux is disabled*

I have tried to look into the traces which shows the following

*bash-3.2# tail -f /var/log/messages*
Nov 11 09:15:58 bagira sssd: Starting up
Nov 11 09:15:58 bagira sssd[be[LDAP]]: Starting up
Nov 11 09:15:58 bagira sssd[nss]: Starting up
Nov 11 09:15:58 bagira sssd[pam]: Starting up

(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got
request for [4097][1][name=nitinst]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
calling ldap_search_ext with
[(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [objectClass]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [uid]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [userPassword]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [uidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gecos]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [homeDirectory]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [loginShell]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbPrincipalName]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [cn]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [modifyTimestamp]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowLastChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowMin]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowMax]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowWarning]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowInactive]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowExpire]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowFlag]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbLastPwdChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbPasswordExpiration]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [pwdAttribute]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
ldap_search_ext called, msgid = 1126
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
OriginalDN: [uid=nitinst,ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
Search result: Success(0),
*(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_process] (6):
Search for users, returned 1 results.*
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
*(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!*
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Save
user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of
[nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
Original memberOf is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): User
principal is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
Adding [shadowLastChange]=[15288] to user attributes.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6):
Storing info for user nitinst
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_users_process] (9):
User 0 processed!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_done] (9):
Saving 1 Users - Done
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [acctinfo_callback] (4):
Request processed. Returned 0,0,Success
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus conn:
8589BA0
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9):
Dispatching.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_message_handler] (9):
Received SBUS method [getAccountInfo]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got
request for [4099][1][name=nitinst]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_send] (9):
Retrieving info for initgroups call
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
calling ldap_search_ext with
[(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [objectClass]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [uid]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [userPassword]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [uidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gecos]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [homeDirectory]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [loginShell]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbPrincipalName]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [cn]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [modifyTimestamp]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowLastChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowMin]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowMax]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowWarning]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowInactive]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowExpire]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowFlag]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbLastPwdChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbPasswordExpiration]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [pwdAttribute]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
ldap_search_ext called, msgid = 1127
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
OriginalDN: [uid=nitinst,ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
*(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!*
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
Search result: Success(0),
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9):
Receiving info for the user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_store] (9):
Storing the user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Save
user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of
[nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
Original memberOf is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): User
principal is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
Adding [shadowLastChange]=[15288] to user attributes.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6):
Storing info for user nitinst
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_commit] (9):
Commit change
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_process] (9):
Process user's groups
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
calling ldap_search_ext with
[(&(memberuid=nitinst)(objectclass=posixGroup))][ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [objectClass]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [cn]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [userPassword]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [memberuid]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [modifyTimestamp]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
ldap_search_ext called, msgid = 1128
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
OriginalDN: [cn=idsldap,ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
*(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!*
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
Search result: Success(0),
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_done] (9):
Initgroups done
> From the traces what i could figure out is once it returned the search

result but still it gave the error * ldap_result found nothing! *even
though the entry in present on the ldap server.
Could you tell me if i'm missing any configuration step ??

Thanks

[Greg Lehmann]

I have no experience with straight LDAP, but do with Active directory LDAP. Sorting out the problems does have some overlap. Have you used the ldapsearch command to make sure your LDAP server is returning what you would expect? E.g.

ldapsearch -H ldap://server.domain.com -b "dc=domain,dc=com" -D "[e-mail]" -W -L "(&(sAMAccountNAME=fred)(objectClass=user))"

From: [e-mail] [mailto:[e-mail]] On Behalf Of Nitesh Mehare
Sent: Friday, 11 November 2011 4:33 PM
To: [e-mail]
Subject: [SSSD] SSSD Configuration issue

Hello

I'm configuring SSSD for the first time.I'm trying to setup the machine to authenticate using ldap server using sssd.The machine configuration is as follows

bash-3.2# uname -a
Linux bagira.in.ibm.comhttp://bagira.in.ibm.com 2.6.18-238.el5 #1 SMP Sun Dec 19 14:22:44 EST 2010 x86_64 x86_64 x86_64 GNU/Linux
bash-3.2# cat /etc/issue
Red Hat Enterprise Linux Server release 5.6 (Tikanga)
Kernel \r on an \m

bash-3.2#

bash-3.2# rpm -qa |grep sssd
sssd-1.2.1-39.el5
sssd-client-1.2.1-39.el5
bash-3.2#

I have modified sssd.conf file

bash-3.2# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2

# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3

# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam

# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
 domains = LDAP

[nss]
# The following prevents SSSD from searching for the root user/group in
# all domains (you can add here a comma-separated list of system accounts that
# are always going to be /etc/passwd users, or that you want to filter out).
filter_groups = root
filter_users = root
reconnection_retries = 3

# The entry_cache_timeout indicates the number of seconds to retain an
# entry in cache before it is considered stale and must block to refresh.
# The entry_cache_nowait_timeout indicates the number of seconds to
# wait before updating the cache out-of-band. (NSS requests will still
# be returned from cache until the full entry_cache_timeout). Setting this
# value to 0 turns this feature off (default).
; entry_cache_timeout = 600
; entry_cache_nowait_timeout = 300

[pam]
reconnection_retries = 3

# Example domain configurations
# Note that enabling enumeration in the following configurations will have a
# moderate performance impact while enumerations are actually running, and
# may increase the time necessary to detect network disconnection.
# Consequently, the default value for enumeration is FALSE.
# Refer to the sssd.conf man page for full details.

# Example LOCAL domain that stores all users natively in the SSSD internal
# directory. These local users and groups are not visible in /etc/passwd; it
# now contains only root and system accounts.
; [domain/LOCAL]
; description = LOCAL Users domain
; id_provider = local
; enumerate = true
; min_id = 500
; max_id = 999

# Example native LDAP domain
# ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute
# for group membership, or to "rfc2307bis", which uses the "member" attribute
# to denote group membership. Changes to this setting affect only how we
# determine the groups a user belongs to and will have no negative effect on
# data about the user itself. If you do not know this value, ask an
# administrator.
 [domain/LDAP]
 debug_level = 9
 id_provider = ldap
 auth_provider = ldap
 ldap_schema = rfc2307
 access_provider = ldap
 ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
 ldap_uri = ldap://lbullet.in.ibm.comhttp://lbullet.in.ibm.com
 ldap_search_base = ou=People,o=sample
 ldap_tls_reqcert = never
 cache_credentials = false
 enumerate = False

# Example LDAP domain where the LDAP server is an Active Directory server.

; [domain/AD]
; description = LDAP domain with AD server
; enumerate = false
; min_id = 1000
;
; id_provider = ldap
; auth_provider = ldap
; ldap_uri = ldap://your.ad.server.comhttp://your.ad.server.com
; ldap_schema = rfc2307bis
; ldap_user_search_base = cn=users,dc=example,dc=com
; ldap_group_search_base = cn=users,dc=example,dc=com
; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com
; ldap_default_authtok_type = password
; ldap_default_authtok = YOUR_PASSWORD
; ldap_user_object_class = person
; ldap_user_name = msSFU30Name
; ldap_user_uid_number = msSFU30UidNumber
; ldap_user_gid_number = msSFU30GidNumber
; ldap_user_home_directory = msSFU30HomeDirectory
; ldap_user_shell = msSFU30LoginShell
; ldap_user_principal = userPrincipalName
; ldap_group_object_class = group
; ldap_group_name = msSFU30Name
; ldap_group_gid_number = msSFU30GidNumber
; ldap_force_upper_case_realm = True
bash-3.2#

The system-auth file looks like this

bash-3.2# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    /lib64/security/pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] /lib64/security/pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    /lib64/security/pam_sss.so use_authtok
password    required      pam_deny.so

session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     sufficient    /lib64/security/pam_sss.so
session     required      pam_unix.so
bash-3.2#

bash-3.2# cat /etc/nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far
#

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis

passwd:     files sss
shadow:     files
group:      files sss

#hosts:     db files nisplus nis dns
hosts:      files dns

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files

netgroup:   nisplus

publickey:  nisplus

automount:  files nisplus
aliases:    files nisplus

bash-3.2#

The firewall and selinux is disabled

I have tried to look into the traces which shows the following

bash-3.2# tail -f /var/log/messages
Nov 11 09:15:58 bagira sssd: Starting up
Nov 11 09:15:58 bagira sssd[be[LDAP]]: Starting up
Nov 11 09:15:58 bagira sssd[nss]: Starting up
Nov 11 09:15:58 bagira sssd[pam]: Starting up

(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got request for [4097][1][name=nitinst]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uid]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gecos]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [homeDirectory]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [loginShell]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPrincipalName]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowLastChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMin]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMax]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowWarning]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowInactive]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowExpire]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowFlag]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbLastPwdChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPasswordExpiration]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [pwdAttribute]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 1126
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [uid=nitinst,ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0),
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_process] (6): Search for users, returned 1 results.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Save user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Original memberOf is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): User principal is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Adding [shadowLastChange]=[15288] to user attributes.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6): Storing info for user nitinst
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_users_process] (9): User 0 processed!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_done] (9): Saving 1 Users - Done
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus conn: 8589BA0
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): Dispatching.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [getAccountInfo]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got request for [4099][1][name=nitinst]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_send] (9): Retrieving info for initgroups call
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uid]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gecos]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [homeDirectory]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [loginShell]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPrincipalName]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowLastChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMin]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMax]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowWarning]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowInactive]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowExpire]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowFlag]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbLastPwdChange]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPasswordExpiration]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [pwdAttribute]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 1127
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [uid=nitinst,ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0),
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9): Receiving info for the user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_store] (9): Storing the user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Save user
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Original memberOf is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): User principal is not available for [nitinst].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Adding [shadowLastChange]=[15288] to user attributes.
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6): Storing info for user nitinst
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_commit] (9): Commit change
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_process] (9): Process user's groups
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(memberuid=nitinst)(objectclass=posixGroup))][ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [memberuid]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 1128
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [cn=idsldap,ou=People,o=sample].
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0),
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb transaction (nesting: 0)
(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_done] (9): Initgroups done

From the traces what i could figure out is once it returned the search result but still it gave the error ldap_result found nothing! even though the entry in present on the ldap server.
Could you tell me if i'm missing any configuration step ??

Thanks

[Nitesh Mehare]

Hi Greg

Thanks for the quick response

I have checked the output of ldapsearch

The output of the ldapsearch command for the user

-bash-3.2# /usr/bin/ldapsearch  -h server.com -p 389 -x -b
ou=People,o=sample "(&(uid=nitinst)(objectclass=posixAccount))" objectclass
# extended LDIF
#
# LDAPv3
# base <ou=People,o=sample> with scope subtree
# filter: (&(uid=nitinst)(objectclass=posixAccount))
# requesting: objectclass
#

# nitinst, People, sample
dn: uid=nitinst,ou=People,o=sample
objectclass: posixaccount
objectclass: shadowaccount
objectclass: account
objectclass: top

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
-bash-3.2#

Thanks And Regards
Nitesh

On Fri, Nov 11, 2011 at 12:57 PM,  wrote:
> I have no experience with straight LDAP, but do with Active directory
> LDAP. Sorting out the problems does have some overlap. Have you used the
> ldapsearch command to make sure your LDAP server is returning what you
> would expect? E.g.****
>
> ldapsearch -H ldap://server.domain.com -b "dc=domain,dc=com" -D "
> [e-mail]" -W -L "(&(sAMAccountNAME=fred)(objectClass=user))"***
>
> *From:* [e-mail] [mailto:
> [e-mail]] *On Behalf Of *Nitesh Mehare
> *Sent:* Friday, 11 November 2011 4:33 PM
> *To:* [e-mail]
> *Subject:* [SSSD] SSSD Configuration issue****
>
> Hello
>
> I'm configuring SSSD for the first time.I'm trying to setup the machine to
> authenticate using ldap server using sssd.The machine configuration is as
> follows
>
> bash-3.2# uname -a
> Linux bagira.in.ibm.com 2.6.18-238.el5 #1 SMP Sun Dec 19 14:22:44 EST
> 2010 x86_64 x86_64 x86_64 GNU/Linux
> bash-3.2# cat /etc/issue
> Red Hat Enterprise Linux Server release 5.6 (Tikanga)
> Kernel \r on an \m
>
> bash-3.2#
>
> bash-3.2# rpm -qa |grep sssd
> sssd-1.2.1-39.el5
> sssd-client-1.2.1-39.el5
> bash-3.2#
>
> *I have modified sssd.conf file *
>
> bash-3.2# cat /etc/sssd/sssd.conf
> [sssd]
> config_file_version = 2
>
> # Number of times services should attempt to reconnect in the
> # event of a crash or restart before they give up
> reconnection_retries = 3
>
> # If a back end is particularly slow you can raise this timeout here
> sbus_timeout = 30
> services = nss, pam
>
> # SSSD will not start if you do not configure any domains.
> # Add new domain configurations as [domain/<NAME>] sections, and
> # then add the list of domains (in the order you want them to be
> # queried) to the "domains" attribute below and uncomment it.
>  domains = LDAP
>
> [nss]
> # The following prevents SSSD from searching for the root user/group in
> # all domains (you can add here a comma-separated list of system accounts
> that
> # are always going to be /etc/passwd users, or that you want to filter
> out).
> filter_groups = root
> filter_users = root
> reconnection_retries = 3
>
> # The entry_cache_timeout indicates the number of seconds to retain an
> # entry in cache before it is considered stale and must block to refresh.
> # The entry_cache_nowait_timeout indicates the number of seconds to
> # wait before updating the cache out-of-band. (NSS requests will still
> # be returned from cache until the full entry_cache_timeout). Setting this
> # value to 0 turns this feature off (default).
> ; entry_cache_timeout = 600
> ; entry_cache_nowait_timeout = 300
>
> [pam]
> reconnection_retries = 3
>
> # Example domain configurations
> # Note that enabling enumeration in the following configurations will have
> a
> # moderate performance impact while enumerations are actually running, and
> # may increase the time necessary to detect network disconnection.
> # Consequently, the default value for enumeration is FALSE.
> # Refer to the sssd.conf man page for full details.
>
> # Example LOCAL domain that stores all users natively in the SSSD internal
> # directory. These local users and groups are not visible in /etc/passwd;
> it
> # now contains only root and system accounts.
> ; [domain/LOCAL]
> ; description = LOCAL Users domain
> ; id_provider = local
> ; enumerate = true
> ; min_id = 500
> ; max_id = 999
>
> # Example native LDAP domain
> # ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute
> # for group membership, or to "rfc2307bis", which uses the "member"
> attribute
> # to denote group membership. Changes to this setting affect only how we
> # determine the groups a user belongs to and will have no negative effect
> on
> # data about the user itself. If you do not know this value, ask an
> # administrator.
>  [domain/LDAP]
>  debug_level = 9
>  id_provider = ldap
>  auth_provider = ldap
>  ldap_schema = rfc2307
>  access_provider = ldap
>  ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
>  ldap_uri = ldap://lbullet.in.ibm.com
>  ldap_search_base = ou=People,o=sample
>  ldap_tls_reqcert = never
>  cache_credentials = false
>  enumerate = False
>
> # Example LDAP domain where the LDAP server is an Active Directory server.
>
> ; [domain/AD]
> ; description = LDAP domain with AD server
> ; enumerate = false
> ; min_id = 1000
> ;
> ; id_provider = ldap
> ; auth_provider = ldap
> ; ldap_uri = ldap://your.ad.server.com
> ; ldap_schema = rfc2307bis
> ; ldap_user_search_base = cn=users,dc=example,dc=com
> ; ldap_group_search_base = cn=users,dc=example,dc=com
> ; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com
> ; ldap_default_authtok_type = password
> ; ldap_default_authtok = YOUR_PASSWORD
> ; ldap_user_object_class = person
> ; ldap_user_name = msSFU30Name
> ; ldap_user_uid_number = msSFU30UidNumber
> ; ldap_user_gid_number = msSFU30GidNumber
> ; ldap_user_home_directory = msSFU30HomeDirectory
> ; ldap_user_shell = msSFU30LoginShell
> ; ldap_user_principal = userPrincipalName
> ; ldap_group_object_class = group
> ; ldap_group_name = msSFU30Name
> ; ldap_group_gid_number = msSFU30GidNumber
> ; ldap_force_upper_case_realm = True
> bash-3.2#
>
> *The system-auth file looks like this*
>
> bash-3.2# cat /etc/pam.d/system-auth
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    /lib64/security/pam_sss.so use_first_pass
> auth        required      pam_deny.so
>
> account     required      pam_unix.so
> account     sufficient    pam_localuser.so
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account [default=bad success=ok user_unknown=ignore]
> /lib64/security/pam_sss.so
> account     required      pam_permit.so
>
> password    requisite     pam_cracklib.so try_first_pass retry=3 type=
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    sufficient    /lib64/security/pam_sss.so use_authtok
> password    required      pam_deny.so
>
> session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
> session     optional      pam_keyinit.so revoke
> session     required      pam_limits.so
> session     [success=1 default=ignore] pam_succeed_if.so service in crond
> quiet use_uid
> session     sufficient    /lib64/security/pam_sss.so
> session     required      pam_unix.so
> bash-3.2#
>
> bash-3.2# cat /etc/nsswitch.conf
> #
> # /etc/nsswitch.conf
> #
> # An example Name Service Switch config file. This file should be
> # sorted with the most-used services at the beginning.
> #
> # The entry '[NOTFOUND=return]' means that the search for an
> # entry should stop if the search in the previous entry turned
> # up nothing. Note that if the search failed due to some other reason
> # (like no NIS server responding) then the search continues with the
> # next entry.
> #
> # Valid entries include:
> #
> #       nisplus                 Use NIS+ (NIS version 3)
> #       nis                     Use NIS (NIS version 2), also called YP
> #       dns                     Use DNS (Domain Name Service)
> #       files                   Use the local files
> #       db                      Use the local database (.db) files
> #       compat                  Use NIS on compat mode
> #       hesiod                  Use Hesiod for user lookups
> #       [NOTFOUND=return]       Stop searching if not found so far
> #
>
> # To use db, put the "db" in front of "files" for entries you want to be
> # looked up first in the databases
> #
> # Example:
> #passwd:    db files nisplus nis
> #shadow:    db files nisplus nis
> #group:     db files nisplus nis
>
> passwd:     files sss
> shadow:     files
> group:      files sss
>
> #hosts:     db files nisplus nis dns
> hosts:      files dns
>
> # Example - obey only what nisplus tells us...
> #services:   nisplus [NOTFOUND=return] files
> #networks:   nisplus [NOTFOUND=return] files
> #protocols:  nisplus [NOTFOUND=return] files
> #rpc:        nisplus [NOTFOUND=return] files
> #ethers:     nisplus [NOTFOUND=return] files
> #netmasks:   nisplus [NOTFOUND=return] files
>
> bootparams: nisplus [NOTFOUND=return] files
>
> ethers:     files
> netmasks:   files
> networks:   files
> protocols:  files
> rpc:        files
> services:   files
>
> netgroup:   nisplus
>
> publickey:  nisplus
>
> automount:  files nisplus
> aliases:    files nisplus
>
> bash-3.2#
>
> *The firewall and selinux is disabled*
>
> I have tried to look into the traces which shows the following
>
> *bash-3.2# tail -f /var/log/messages*
> Nov 11 09:15:58 bagira sssd: Starting up
> Nov 11 09:15:58 bagira sssd[be[LDAP]]: Starting up
> Nov 11 09:15:58 bagira sssd[nss]: Starting up
> Nov 11 09:15:58 bagira sssd[pam]: Starting up
>
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got
> request for [4097][1][name=nitinst]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
> calling ldap_search_ext with
> [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [objectClass]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [uid]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [userPassword]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [uidNumber]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [gidNumber]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [gecos]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [homeDirectory]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [loginShell]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [krbPrincipalName]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [cn]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [modifyTimestamp]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowLastChange]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowMin]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowMax]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowWarning]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowInactive]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowExpire]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowFlag]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [krbLastPwdChange]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [krbPasswordExpiration]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [pwdAttribute]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
> ldap_search_ext called, msgid = 1126
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
> OriginalDN: [uid=nitinst,ou=People,o=sample].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: ldap_result found nothing!
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
> Search result: Success(0),
> *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_process]
> (6): Search for users, returned 1 results.*
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
> *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: ldap_result found nothing!*
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
> transaction (nesting: 0)
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> Save user
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of
> [nitinst].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> Original memberOf is not available for [nitinst].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> User principal is not available for [nitinst].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> Adding [shadowLastChange]=[15288] to user attributes.
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6):
> Storing info for user nitinst
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_users_process] (9):
> User 0 processed!
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
> transaction (nesting: 0)
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_done] (9):
> Saving 1 Users - Done
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [acctinfo_callback] (4):
> Request processed. Returned 0,0,Success
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus
> conn: 8589BA0
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9):
> Dispatching.
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_message_handler] (9):
> Received SBUS method [getAccountInfo]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got
> request for [4099][1][name=nitinst]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_send] (9):
> Retrieving info for initgroups call
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
> calling ldap_search_ext with
> [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [objectClass]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [uid]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [userPassword]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [uidNumber]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [gidNumber]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [gecos]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [homeDirectory]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [loginShell]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [krbPrincipalName]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [cn]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [modifyTimestamp]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowLastChange]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowMin]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowMax]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowWarning]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowInactive]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowExpire]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [shadowFlag]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [krbLastPwdChange]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [krbPasswordExpiration]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [pwdAttribute]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
> ldap_search_ext called, msgid = 1127
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
> OriginalDN: [uid=nitinst,ou=People,o=sample].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
> *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: ldap_result found nothing!*
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
> Search result: Success(0),
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9):
> Receiving info for the user
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: ldap_result found nothing!
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
> transaction (nesting: 0)
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_store] (9):
> Storing the user
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> Save user
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of
> [nitinst].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> Original memberOf is not available for [nitinst].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> User principal is not available for [nitinst].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> Adding [shadowLastChange]=[15288] to user attributes.
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6):
> Storing info for user nitinst
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_commit] (9):
> Commit change
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
> transaction (nesting: 0)
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_process] (9):
> Process user's groups
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
> calling ldap_search_ext with
> [(&(memberuid=nitinst)(objectclass=posixGroup))][ou=People,o=sample].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [objectClass]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [cn]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [userPassword]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [gidNumber]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [memberuid]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> Requesting attrs: [modifyTimestamp]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
> ldap_search_ext called, msgid = 1128
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
> OriginalDN: [cn=idsldap,ou=People,o=sample].
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
> *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: ldap_result found nothing!*
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
> Search result: Success(0),
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> Trace: ldap_result found nothing!
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
> transaction (nesting: 0)
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
> transaction (nesting: 0)
> (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_done] (9):
> Initgroups done
>
> From the traces what i could figure out is once it returned the search
> result but still it gave the error *ldap_result found nothing! *even
> though the entry in present on the ldap server.
> Could you tell me if i'm missing any configuration step ??
>
> Thanks****
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Nitesh Mehare]

Hi Pavel

There is one link that i had found it is basically a forum in which it is
mentioned that sssd can also work with TLS.

http://www.linuxquestions.org/questions/linux-enterprise-47/rhel-6-ldap-now-...

Thanks And Regards
Nitesh

On Fri, Nov 11, 2011 at 1:32 PM, Nitesh Mehare  wrote:
> Hi Greg
>
> Thanks for the quick response
>
> I have checked the output of ldapsearch
>
> The output of the ldapsearch command for the user
>
> -bash-3.2# /usr/bin/ldapsearch  -h server.com -p 389 -x -b
> ou=People,o=sample "(&(uid=nitinst)(objectclass=posixAccount))" objectclass
> # extended LDIF
> #
> # LDAPv3
> # base <ou=People,o=sample> with scope subtree
> # filter: (&(uid=nitinst)(objectclass=posixAccount))
> # requesting: objectclass
> #
>
> # nitinst, People, sample
> dn: uid=nitinst,ou=People,o=sample
> objectclass: posixaccount
> objectclass: shadowaccount
> objectclass: account
> objectclass: top
>
> # search result
> search: 2
> result: 0 Success
>
> # numResponses: 2
> # numEntries: 1
> -bash-3.2#
>
> Thanks And Regards
> Nitesh
>
> On Fri, Nov 11, 2011 at 12:57 PM,  wrote:
> > I have no experience with straight LDAP, but do with Active directory
> > LDAP. Sorting out the problems does have some overlap. Have you used the
> > ldapsearch command to make sure your LDAP server is returning what you
> > would expect? E.g.****
> >
> > ldapsearch -H ldap://server.domain.com -b "dc=domain,dc=com" -D "
> > [e-mail]" -W -L "(&(sAMAccountNAME=fred)(objectClass=user))"**
> > **
> >
> > *From:* [e-mail] [mailto:
> > [e-mail]] *On Behalf Of *Nitesh Mehare
> > *Sent:* Friday, 11 November 2011 4:33 PM
> > *To:* [e-mail]
> > *Subject:* [SSSD] SSSD Configuration issue****
> >
> > Hello
> >
> > I'm configuring SSSD for the first time.I'm trying to setup the machine
> > to authenticate using ldap server using sssd.The machine configuration is
> > as follows
> >
> > bash-3.2# uname -a
> > Linux bagira.in.ibm.com 2.6.18-238.el5 #1 SMP Sun Dec 19 14:22:44 EST
> > 2010 x86_64 x86_64 x86_64 GNU/Linux
> > bash-3.2# cat /etc/issue
> > Red Hat Enterprise Linux Server release 5.6 (Tikanga)
> > Kernel \r on an \m
> >
> > bash-3.2#
> >
> > bash-3.2# rpm -qa |grep sssd
> > sssd-1.2.1-39.el5
> > sssd-client-1.2.1-39.el5
> > bash-3.2#
> >
> > *I have modified sssd.conf file *
> >
> > bash-3.2# cat /etc/sssd/sssd.conf
> > [sssd]
> > config_file_version = 2
> >
> > # Number of times services should attempt to reconnect in the
> > # event of a crash or restart before they give up
> > reconnection_retries = 3
> >
> > # If a back end is particularly slow you can raise this timeout here
> > sbus_timeout = 30
> > services = nss, pam
> >
> > # SSSD will not start if you do not configure any domains.
> > # Add new domain configurations as [domain/<NAME>] sections, and
> > # then add the list of domains (in the order you want them to be
> > # queried) to the "domains" attribute below and uncomment it.
> >  domains = LDAP
> >
> > [nss]
> > # The following prevents SSSD from searching for the root user/group in
> > # all domains (you can add here a comma-separated list of system accounts
> > that
> > # are always going to be /etc/passwd users, or that you want to filter
> > out).
> > filter_groups = root
> > filter_users = root
> > reconnection_retries = 3
> >
> > # The entry_cache_timeout indicates the number of seconds to retain an
> > # entry in cache before it is considered stale and must block to refresh.
> > # The entry_cache_nowait_timeout indicates the number of seconds to
> > # wait before updating the cache out-of-band. (NSS requests will still
> > # be returned from cache until the full entry_cache_timeout). Setting this
> > # value to 0 turns this feature off (default).
> > ; entry_cache_timeout = 600
> > ; entry_cache_nowait_timeout = 300
> >
> > [pam]
> > reconnection_retries = 3
> >
> > # Example domain configurations
> > # Note that enabling enumeration in the following configurations will
> > have a
> > # moderate performance impact while enumerations are actually running, and
> > # may increase the time necessary to detect network disconnection.
> > # Consequently, the default value for enumeration is FALSE.
> > # Refer to the sssd.conf man page for full details.
> >
> > # Example LOCAL domain that stores all users natively in the SSSD internal
> > # directory. These local users and groups are not visible in /etc/passwd;
> > it
> > # now contains only root and system accounts.
> > ; [domain/LOCAL]
> > ; description = LOCAL Users domain
> > ; id_provider = local
> > ; enumerate = true
> > ; min_id = 500
> > ; max_id = 999
> >
> > # Example native LDAP domain
> > # ldap_schema can be set to "rfc2307", which uses the "memberuid"
> > attribute
> > # for group membership, or to "rfc2307bis", which uses the "member"
> > attribute
> > # to denote group membership. Changes to this setting affect only how we
> > # determine the groups a user belongs to and will have no negative effect
> > on
> > # data about the user itself. If you do not know this value, ask an
> > # administrator.
> >  [domain/LDAP]
> >  debug_level = 9
> >  id_provider = ldap
> >  auth_provider = ldap
> >  ldap_schema = rfc2307
> >  access_provider = ldap
> >  ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
> >  ldap_uri = ldap://lbullet.in.ibm.com
> >  ldap_search_base = ou=People,o=sample
> >  ldap_tls_reqcert = never
> >  cache_credentials = false
> >  enumerate = False
> >
> > # Example LDAP domain where the LDAP server is an Active Directory server.
> >
> > ; [domain/AD]
> > ; description = LDAP domain with AD server
> > ; enumerate = false
> > ; min_id = 1000
> > ;
> > ; id_provider = ldap
> > ; auth_provider = ldap
> > ; ldap_uri = ldap://your.ad.server.com
> > ; ldap_schema = rfc2307bis
> > ; ldap_user_search_base = cn=users,dc=example,dc=com
> > ; ldap_group_search_base = cn=users,dc=example,dc=com
> > ; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com
> > ; ldap_default_authtok_type = password
> > ; ldap_default_authtok = YOUR_PASSWORD
> > ; ldap_user_object_class = person
> > ; ldap_user_name = msSFU30Name
> > ; ldap_user_uid_number = msSFU30UidNumber
> > ; ldap_user_gid_number = msSFU30GidNumber
> > ; ldap_user_home_directory = msSFU30HomeDirectory
> > ; ldap_user_shell = msSFU30LoginShell
> > ; ldap_user_principal = userPrincipalName
> > ; ldap_group_object_class = group
> > ; ldap_group_name = msSFU30Name
> > ; ldap_group_gid_number = msSFU30GidNumber
> > ; ldap_force_upper_case_realm = True
> > bash-3.2#
> >
> > *The system-auth file looks like this*
> >
> > bash-3.2# cat /etc/pam.d/system-auth
> > #%PAM-1.0
> > # This file is auto-generated.
> > # User changes will be destroyed the next time authconfig is run.
> > auth        required      pam_env.so
> > auth        sufficient    pam_unix.so nullok try_first_pass
> > auth        requisite     pam_succeed_if.so uid >= 500 quiet
> > auth        sufficient    /lib64/security/pam_sss.so use_first_pass
> > auth        required      pam_deny.so
> >
> > account     required      pam_unix.so
> > account     sufficient    pam_localuser.so
> > account     sufficient    pam_succeed_if.so uid < 500 quiet
> > account [default=bad success=ok user_unknown=ignore]
> > /lib64/security/pam_sss.so
> > account     required      pam_permit.so
> >
> > password    requisite     pam_cracklib.so try_first_pass retry=3 type=
> > password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> > use_authtok
> > password    sufficient    /lib64/security/pam_sss.so use_authtok
> > password    required      pam_deny.so
> >
> > session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
> > session     optional      pam_keyinit.so revoke
> > session     required      pam_limits.so
> > session     [success=1 default=ignore] pam_succeed_if.so service in crond
> > quiet use_uid
> > session     sufficient    /lib64/security/pam_sss.so
> > session     required      pam_unix.so
> > bash-3.2#
> >
> > bash-3.2# cat /etc/nsswitch.conf
> > #
> > # /etc/nsswitch.conf
> > #
> > # An example Name Service Switch config file. This file should be
> > # sorted with the most-used services at the beginning.
> > #
> > # The entry '[NOTFOUND=return]' means that the search for an
> > # entry should stop if the search in the previous entry turned
> > # up nothing. Note that if the search failed due to some other reason
> > # (like no NIS server responding) then the search continues with the
> > # next entry.
> > #
> > # Valid entries include:
> > #
> > #       nisplus                 Use NIS+ (NIS version 3)
> > #       nis                     Use NIS (NIS version 2), also called YP
> > #       dns                     Use DNS (Domain Name Service)
> > #       files                   Use the local files
> > #       db                      Use the local database (.db) files
> > #       compat                  Use NIS on compat mode
> > #       hesiod                  Use Hesiod for user lookups
> > #       [NOTFOUND=return]       Stop searching if not found so far
> > #
> >
> > # To use db, put the "db" in front of "files" for entries you want to be
> > # looked up first in the databases
> > #
> > # Example:
> > #passwd:    db files nisplus nis
> > #shadow:    db files nisplus nis
> > #group:     db files nisplus nis
> >
> > passwd:     files sss
> > shadow:     files
> > group:      files sss
> >
> > #hosts:     db files nisplus nis dns
> > hosts:      files dns
> >
> > # Example - obey only what nisplus tells us...
> > #services:   nisplus [NOTFOUND=return] files
> > #networks:   nisplus [NOTFOUND=return] files
> > #protocols:  nisplus [NOTFOUND=return] files
> > #rpc:        nisplus [NOTFOUND=return] files
> > #ethers:     nisplus [NOTFOUND=return] files
> > #netmasks:   nisplus [NOTFOUND=return] files
> >
> > bootparams: nisplus [NOTFOUND=return] files
> >
> > ethers:     files
> > netmasks:   files
> > networks:   files
> > protocols:  files
> > rpc:        files
> > services:   files
> >
> > netgroup:   nisplus
> >
> > publickey:  nisplus
> >
> > automount:  files nisplus
> > aliases:    files nisplus
> >
> > bash-3.2#
> >
> > *The firewall and selinux is disabled*
> >
> > I have tried to look into the traces which shows the following
> >
> > *bash-3.2# tail -f /var/log/messages*
> > Nov 11 09:15:58 bagira sssd: Starting up
> > Nov 11 09:15:58 bagira sssd[be[LDAP]]: Starting up
> > Nov 11 09:15:58 bagira sssd[nss]: Starting up
> > Nov 11 09:15:58 bagira sssd[pam]: Starting up
> >
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4):
> > Got request for [4097][1][name=nitinst]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
> > calling ldap_search_ext with
> > [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [objectClass]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [uid]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [userPassword]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [uidNumber]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [gidNumber]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [gecos]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [homeDirectory]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [loginShell]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [krbPrincipalName]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [cn]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [modifyTimestamp]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowLastChange]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowMin]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowMax]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowWarning]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowInactive]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowExpire]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowFlag]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [krbLastPwdChange]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [krbPasswordExpiration]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [pwdAttribute]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
> > ldap_search_ext called, msgid = 1126
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
> > OriginalDN: [uid=nitinst,ou=People,o=sample].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: ldap_result found nothing!
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
> > Search result: Success(0),
> > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_process]
> > (6): Search for users, returned 1 results.*
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
> > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: ldap_result found nothing!*
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
> > transaction (nesting: 0)
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> > Save user
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> > Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of
> > [nitinst].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> > Original memberOf is not available for [nitinst].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> > User principal is not available for [nitinst].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> > Adding [shadowLastChange]=[15288] to user attributes.
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6):
> > Storing info for user nitinst
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_users_process]
> > (9): User 0 processed!
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
> > transaction (nesting: 0)
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_done] (9):
> > Saving 1 Users - Done
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [acctinfo_callback] (4):
> > Request processed. Returned 0,0,Success
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus
> > conn: 8589BA0
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9):
> > Dispatching.
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_message_handler] (9):
> > Received SBUS method [getAccountInfo]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4):
> > Got request for [4099][1][name=nitinst]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_send] (9):
> > Retrieving info for initgroups call
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
> > calling ldap_search_ext with
> > [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [objectClass]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [uid]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [userPassword]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [uidNumber]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [gidNumber]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [gecos]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [homeDirectory]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [loginShell]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [krbPrincipalName]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [cn]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [modifyTimestamp]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowLastChange]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowMin]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowMax]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowWarning]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowInactive]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowExpire]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [shadowFlag]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [krbLastPwdChange]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [krbPasswordExpiration]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [pwdAttribute]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
> > ldap_search_ext called, msgid = 1127
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
> > OriginalDN: [uid=nitinst,ou=People,o=sample].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
> > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: ldap_result found nothing!*
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
> > Search result: Success(0),
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9):
> > Receiving info for the user
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: ldap_result found nothing!
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
> > transaction (nesting: 0)
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_store] (9):
> > Storing the user
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> > Save user
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> > Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of
> > [nitinst].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> > Original memberOf is not available for [nitinst].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7):
> > User principal is not available for [nitinst].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9):
> > Adding [shadowLastChange]=[15288] to user attributes.
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6):
> > Storing info for user nitinst
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_commit] (9):
> > Commit change
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
> > transaction (nesting: 0)
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_process]
> > (9): Process user's groups
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
> > calling ldap_search_ext with
> > [(&(memberuid=nitinst)(objectclass=posixGroup))][ou=People,o=sample].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [objectClass]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [cn]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [userPassword]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [gidNumber]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [memberuid]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
> > Requesting attrs: [modifyTimestamp]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
> > ldap_search_ext called, msgid = 1128
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
> > OriginalDN: [cn=idsldap,ou=People,o=sample].
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
> > *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: ldap_result found nothing!*
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
> > Search result: Success(0),
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0]
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8):
> > Trace: ldap_result found nothing!
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb
> > transaction (nesting: 0)
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb
> > transaction (nesting: 0)
> > (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_done] (9):
> > Initgroups done
> >
> > From the traces what i could figure out is once it returned the search
> > result but still it gave the error *ldap_result found nothing! *even
> > though the entry in present on the ldap server.
> > Could you tell me if i'm missing any configuration step ??
> >
> > Thanks****
> >
> > sssd-devel mailing list
> > [e-mail]
> > https://fedorahosted.org/mailman/listinfo/sssd-devel

[Pavel Březina]

Hello,

Dne 11.11.2011 07:32, Nitesh Mehare napsal(a):
> [domain/LDAP]
>   debug_level = 9
>   id_provider = ldap
>   auth_provider = ldap
>   ldap_schema = rfc2307
>   access_provider = ldap
>   ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
>   ldap_uri = ldap://lbullet.in.ibm.com http://lbullet.in.ibm.com
>   ldap_search_base = ou=People,o=sample
>   ldap_tls_reqcert = never
>   cache_credentials = false
>   enumerate = False

man sssd-ldap:
"If you want to authenticate against an LDAP server either TLS/SSL or 
LDAPS is required.  sssd does not support authentication over an 
unencrypted channel."

Regards,
Pavel Březina.

[Jakub Hrozek]

On Fri, Nov 11, 2011 at 12:02:31PM +0530, Nitesh Mehare wrote:
> # data about the user itself. If you do not know this value, ask an
>    # administrator.
>    A [domain/LDAP]
>    A debug_level = 9
>    A id_provider = ldap
>    A auth_provider = ldap
>    A ldap_schema = rfc2307
>    A access_provider = ldap
>    A ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
>    A ldap_uri = ldap://lbullet.in.ibm.com
>    A ldap_search_base = ou=People,o=sample
>    A ldap_tls_reqcert = never
>    A cache_credentials = false
>    A enumerate = False

How are group membership links determined in your directory?

If you're using member/memberof pairs as your ldap_access_filter
suggests, you should probably use "ldap_schema = rfc2307bis".

The configuration specifies "schema=rfc2307" which implies
"memberuid" attributes with username values.

Also, the search base points to "ou=People" container, is it really
where the groups are stored as well?

[Nitesh Mehare]

Jakub,

The group entry looks like this

cn=idsldap,ou=People,o=sample
cn=idsldap
objectclass=posixgroup
objectclass=top
gidnumber=201
memberuid=nitpta2
memberuid=nitinst
memberuid=nitinst1
memberuid=nitback1

The group entry is under ou=people and any user is made member of a group
by adding the memberuid attribute so i have kept ldap_schema as rfc2307

Thanks

On Fri, Nov 11, 2011 at 1:57 PM, Jakub Hrozek  wrote:
> On Fri, Nov 11, 2011 at 12:02:31PM +0530, Nitesh Mehare wrote:
> > # data about the user itself. If you do not know this value, ask an
> >    # administrator.
> >    A [domain/LDAP]
> >    A debug_level = 9
> >    A id_provider = ldap
> >    A auth_provider = ldap
> >    A ldap_schema = rfc2307
> >    A access_provider = ldap
> >    A ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample
> >    A ldap_uri = ldap://lbullet.in.ibm.com
> >    A ldap_search_base = ou=People,o=sample
> >    A ldap_tls_reqcert = never
> >    A cache_credentials = false
> >    A enumerate = False
>
> How are group membership links determined in your directory?
>
> If you're using member/memberof pairs as your ldap_access_filter
> suggests, you should probably use "ldap_schema = rfc2307bis".
>
> The configuration specifies "schema=rfc2307" which implies
> "memberuid" attributes with username values.
>
> Also, the search base points to "ou=People" container, is it really
> where the groups are stored as well?
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Fri, Nov 11, 2011 at 02:06:45PM +0530, Nitesh Mehare wrote:
> Jakub,
>
> The group entry looks like this
>
> cn=idsldap,ou=People,o=sample
>    cn=idsldap
>    objectclass=posixgroup
>    objectclass=top
>    gidnumber=201
>    memberuid=nitpta2
>    memberuid=nitinst
>    memberuid=nitinst1
>    memberuid=nitback1
>
> The group entry is under ou=people and any user is made member of a group
>    by adding the memberuid attribute so i have kept ldap_schema as rfc2307
>
> Thanks

Then the schema is correct, but I don't think the access filter you are
using can work because with the rfc2307 schema the user lacks the memberof
attribute your filter uses to determine access.

Instead of using the "ldap" access control provider, I would suggest
using the "simple" provider. To allow only members of the "idsldap"
group:

access_provider = simple
simple_allow_groups = idsldap

See man "sssd-simple" for more information.

[Nitesh Mehare]

Jakub,
I tried the modifying sssd.conf  to use  *simple_allow_groups = idsldap
*Still it is not working.One thing I would like to ask .is my configuration
correct in system-auth and nsswitch.conf file?
Am i missing something.
Also one more thing I have noticed in /var/log/secure log file

Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to
nitesh.in.ibm.com, but this does not map back to the address - POSSIBLE
BREAK-IN ATTEMPT!
Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=9.118.25.17
user=nitback1
Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from
9.118.25.17 port 4300 ssh2

In above log i do not see entry for pam_sss I;m not sure why is this...

Thanks

On Fri, Nov 11, 2011 at 2:33 PM, Jakub Hrozek  wrote:
> On Fri, Nov 11, 2011 at 02:06:45PM +0530, Nitesh Mehare wrote:
> > Jakub,
> >
> > The group entry looks like this
> >
> > cn=idsldap,ou=People,o=sample
> >    cn=idsldap
> >    objectclass=posixgroup
> >    objectclass=top
> >    gidnumber=201
> >    memberuid=nitpta2
> >    memberuid=nitinst
> >    memberuid=nitinst1
> >    memberuid=nitback1
> >
> > The group entry is under ou=people and any user is made member of a
>
> group
> > by adding the memberuid attribute so i have kept ldap_schema as
>
> rfc2307
> > Thanks
>
> Then the schema is correct, but I don't think the access filter you are
> using can work because with the rfc2307 schema the user lacks the memberof
> attribute your filter uses to determine access.
>
> Instead of using the "ldap" access control provider, I would suggest
> using the "simple" provider. To allow only members of the "idsldap"
> group:
>
> access_provider = simple
> simple_allow_groups = idsldap
>
> See man "sssd-simple" for more information.
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Fri, Nov 11, 2011 at 02:48:40PM +0530, Nitesh Mehare wrote:
> Jakub,
>    I tried the modifying sssd.confA  to useA  simple_allow_groups = idsldap
>    Still it is not working.One thing I would like to ask .is my configuration
>    correct in system-auth and nsswitch.conf file?
>    Am i missing something.
>    Also one more thing I have noticed in /var/log/secure log file
>
> Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to
>    nitesh.in.ibm.com, but this does not map back to the address - POSSIBLE
>    BREAK-IN ATTEMPT!
>    Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth): authentication
>    failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=9.118.25.17A 
>    user=nitback1
>    Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from
>    9.118.25.17 port 4300 ssh2

Does your /etc/pam.d/sshd include password-auth or system-auth? Can you
paste the file that it includes?

[Nitesh Mehare]

Contents of /etc/pam.d/sshd and /etc/pam.d/system-auth is as follows

*bash-3.2# cat /etc/pam.d/system-auth*
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    /lib64/security/pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore]
/lib64/security/pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    sufficient    /lib64/security/pam_sss.so use_authtok
password    required      pam_deny.so

session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
session     sufficient    /lib64/security/pam_sss.so
session     required      pam_unix.so
bash-3.2#

*bash-3.2# cat /etc/pam.d/sshd*
#%PAM-1.0
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    required     pam_loginuid.so
bash-3.2#

And there is no file on the system with name /etc/pam.d/password-auth I
guess this is present in RHEL 6 and not in RHEL 5.5

Thanks

On Fri, Nov 11, 2011 at 3:09 PM, Jakub Hrozek  wrote:
> On Fri, Nov 11, 2011 at 02:48:40PM +0530, Nitesh Mehare wrote:
> > Jakub,
> >    I tried the modifying sssd.confA  to useA  simple_allow_groups =
>
> idsldap
> > Still it is not working.One thing I would like to ask .is my
>
> configuration
> > correct in system-auth and nsswitch.conf file?
> >    Am i missing something.
> >    Also one more thing I have noticed in /var/log/secure log file
> >
> > Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to
> >    nitesh.in.ibm.com, but this does not map back to the address -
>
> POSSIBLE
> > BREAK-IN ATTEMPT!
> >    Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth):
>
> authentication
> > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=9.118.25.17A
> >    user=nitback1
> >    Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from
> >    9.118.25.17 port 4300 ssh2
>
> Does your /etc/pam.d/sshd include password-auth or system-auth? Can you
> paste the file that it includes?
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On Fri, 2011-11-11 at 14:48 +0530, Nitesh Mehare wrote:
> Jakub, 
> I tried the modifying sssd.conf  to use  simple_allow_groups = idsldap
> Still it is not working.One thing I would like to ask .is my
> configuration correct in system-auth and nsswitch.conf file?
> Am i missing something.
> Also one more thing I have noticed in /var/log/secure log file
>
> Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to
> nitesh.in.ibm.com, but this does not map back to the address -
> POSSIBLE BREAK-IN ATTEMPT!
> Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth):
> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> rhost=9.118.25.17  user=nitback1
> Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from
> 9.118.25.17 port 4300 ssh2
>
> In above log i do not see entry for pam_sss I;m not sure why is
> this...

Can you make sure that your /etc/ssh/sshd_config file has 'UsePAM yes'
in it? That may make the difference.

[Nitesh Mehare]

I have checked that file the setting is correct in that file below is the
log

*-bash-3.2# cat /etc/ssh/sshd_config |grep Use*
#IgnoreUserKnownHosts no
#UsePAM no
UsePAM yes
#X11UseLocalhost yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#UseDNS yes
-bash-3.2#

Is there any configuration i'm missing.??

Thanks And Regards
Nitesh Mehare

On Fri, Nov 11, 2011 at 6:51 PM, Stephen Gallagher wrote:
> On Fri, 2011-11-11 at 14:48 +0530, Nitesh Mehare wrote:
> > Jakub,
> > I tried the modifying sssd.conf  to use  simple_allow_groups = idsldap
> > Still it is not working.One thing I would like to ask .is my
> > configuration correct in system-auth and nsswitch.conf file?
> > Am i missing something.
> > Also one more thing I have noticed in /var/log/secure log file
> >
> > Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to
> > nitesh.in.ibm.com, but this does not map back to the address -
> > POSSIBLE BREAK-IN ATTEMPT!
> > Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth):
> > authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> > rhost=9.118.25.17  user=nitback1
> > Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from
> > 9.118.25.17 port 4300 ssh2
> >
> > In above log i do not see entry for pam_sss I;m not sure why is
> > this...
>
> Can you make sure that your /etc/ssh/sshd_config file has 'UsePAM yes'
> in it? That may make the difference.
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Nitesh Mehare]

So any setting i'm missing.I'm not able to figure out why this is not
working,,,:(

On Sat, Nov 12, 2011 at 12:33 PM, Nitesh Mehare  wrote:
> I have checked that file the setting is correct in that file below is the
> log
>
> *-bash-3.2# cat /etc/ssh/sshd_config |grep Use*
> #IgnoreUserKnownHosts no
> #UsePAM no
> UsePAM yes
> #X11UseLocalhost yes
> #UseLogin no
> #UsePrivilegeSeparation yes
> #PermitUserEnvironment no
> #UseDNS yes
> -bash-3.2#
>
> Is there any configuration i'm missing.??
>
> Thanks And Regards
> Nitesh Mehare
>
> On Fri, Nov 11, 2011 at 6:51 PM, Stephen Gallagher wrote:
> > On Fri, 2011-11-11 at 14:48 +0530, Nitesh Mehare wrote:
> > > Jakub,
> > > I tried the modifying sssd.conf  to use  simple_allow_groups = idsldap
> > > Still it is not working.One thing I would like to ask .is my
> > > configuration correct in system-auth and nsswitch.conf file?
> > > Am i missing something.
> > > Also one more thing I have noticed in /var/log/secure log file
> > >
> > > Nov 11 13:34:58 bagira sshd[30879]: Address 9.118.25.17 maps to
> > > nitesh.in.ibm.com, but this does not map back to the address -
> > > POSSIBLE BREAK-IN ATTEMPT!
> > > Nov 11 13:35:00 bagira sshd[30879]: pam_unix(sshd:auth):
> > > authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> > > rhost=9.118.25.17  user=nitback1
> > > Nov 11 13:35:02 bagira sshd[30879]: Failed password for nitback1 from
> > > 9.118.25.17 port 4300 ssh2
> > >
> > > In above log i do not see entry for pam_sss I;m not sure why is
> > > this...
> >
> > Can you make sure that your /etc/ssh/sshd_config file has 'UsePAM yes'
> > in it? That may make the difference.
> >
> > sssd-devel mailing list
> > [e-mail]
> > https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On Mon, 2011-11-14 at 10:34 +0530, Nitesh Mehare wrote:
> So any setting i'm missing.I'm not able to figure out why this is not
> working,,,:(

Would you mind showing us /etc/pam.d/sshd please? I wonder if it might
not be including system-auth (and therefore not trying to use SSSD).

The problem here is that SSHD is not actually *calling* pam_sss.so,
which is why authentication isn't working. It's not an SSSD issue.

[Nitesh Mehare]

Here is the snapshot of the file

-bash-3.2# cat /etc/pam.d/sshd
#%PAM-1.0
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    required     pam_loginuid.so
-bash-3.2#

Thanks

On Mon, Nov 14, 2011 at 7:05 PM, Stephen Gallagher wrote:
> On Mon, 2011-11-14 at 10:34 +0530, Nitesh Mehare wrote:
> > So any setting i'm missing.I'm not able to figure out why this is not
> > working,,,:(
>
> Would you mind showing us /etc/pam.d/sshd please? I wonder if it might
> not be including system-auth (and therefore not trying to use SSSD).
>
> The problem here is that SSHD is not actually *calling* pam_sss.so,
> which is why authentication isn't working. It's not an SSSD issue.
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Tue, Nov 15, 2011 at 09:24:57AM +0530, Nitesh Mehare wrote:
> Here is the snapshot of the file
>
> -bash-3.2# cat /etc/pam.d/sshd
>    #%PAM-1.0
>    authA A A A A A  includeA A A A A  system-auth
>    accountA A A  requiredA A A A  pam_nologin.so
>    accountA A A  includeA A A A A  system-auth
>    passwordA A  includeA A A A A  system-auth
>    sessionA A A  optionalA A A A  pam_keyinit.so force revoke
>    sessionA A A  includeA A A A A  system-auth
>    sessionA A A  requiredA A A A  pam_loginuid.so
>    -bash-3.2#

Provided that you still use the same system-auth file as you provided in
one of the first comments, everything looks fine.

Can you run:
strace -e open su - $username

That should tell us whether the pam stack is actually opening the module
or not.

[Nitesh Mehare]

This is the output of strace for the user which is in ldap server.

bash-3.2# strace -e open su - nitback1
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libpam.so.0", O_RDONLY)    = 3
open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
open("/lib64/libcrypt.so.1", O_RDONLY)  = 3
open("/lib64/libdl.so.2", O_RDONLY)     = 3
open("/lib64/libc.so.6", O_RDONLY)      = 3
open("/lib64/libaudit.so.0", O_RDONLY)  = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libnss_files.so.2", O_RDONLY) = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
open("/etc/pam.d/su-l", O_RDONLY)       = 4
open("/etc/pam.d/su", O_RDONLY)         = 5
open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
open("/etc/ld.so.cache", O_RDONLY)      = 6
open("/lib64/libselinux.so.1", O_RDONLY) = 6
open("/lib64/libsepol.so.1", O_RDONLY)  = 6
open("/etc/selinux/config", O_RDONLY)   = 6
open("/proc/mounts", O_RDONLY)          = 6
open("/etc/pam.d/system-auth", O_RDONLY) = 6
open("/lib64/security/pam_env.so", O_RDONLY) = 7
open("/lib64/security/pam_unix.so", O_RDONLY) = 7
open("/etc/ld.so.cache", O_RDONLY)      = 7
open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
open("/lib64/libnsl.so.1", O_RDONLY)    = 7
open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
open("/lib64/security/pam_sss.so", O_RDONLY) = 7
open("/lib64/security/pam_deny.so", O_RDONLY) = 7
open("/etc/pam.d/su", O_RDONLY)         = 5
open("/etc/pam.d/system-auth", O_RDONLY) = 6
open("/lib64/security/pam_localuser.so", O_RDONLY) = 7
open("/lib64/security/pam_permit.so", O_RDONLY) = 7
open("/etc/pam.d/su", O_RDONLY)         = 5
open("/etc/pam.d/system-auth", O_RDONLY) = 6
open("/lib64/security/pam_cracklib.so", O_RDONLY) = 7
open("/lib64/security/pam_keyinit.so", O_RDONLY) = 5
open("/etc/pam.d/su", O_RDONLY)         = 5
open("/etc/pam.d/system-auth", O_RDONLY) = 6
open("/lib64/security/pam_mkhomedir.so", O_RDONLY) = 7
open("/lib64/security/pam_limits.so", O_RDONLY) = 7
open("/lib64/security/pam_xauth.so", O_RDONLY) = 6
open("/etc/pam.d/other", O_RDONLY)      = 4
open("/etc/passwd", O_RDONLY)           = 4
open("/proc/filesystems", O_RDONLY)     = 4
open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 5
open("/etc/passwd", O_RDONLY)           = 4
open("/etc/passwd", O_RDONLY)           = 4
open("/etc/passwd", O_RDONLY)           = 4
Creating directory '/home/nitback1'.
open("/etc/skel/", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 4
open("/etc/skel//.bash_logout", O_RDONLY) = 5
open("/home/nitback1/.bash_logout", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
open("/etc/skel//.bash_profile", O_RDONLY) = 5
open("/home/nitback1/.bash_profile", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
open("/etc/skel//.emacs", O_RDONLY)     = 5
open("/home/nitback1/.emacs", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
open("/etc/skel//.bashrc", O_RDONLY)    = 5
open("/home/nitback1/.bashrc", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
Creating directory '/home/nitback1/.mozilla'.
open("/etc/skel//.mozilla", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 5
Creating directory '/home/nitback1/.mozilla/extensions'.
open("/etc/skel//.mozilla/extensions", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 6
Creating directory '/home/nitback1/.mozilla/plugins'.
open("/etc/skel//.mozilla/plugins", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 6
open("/etc/passwd", O_RDONLY)           = 4
open("/etc/security/limits.conf", O_RDONLY) = 4
open("/etc/security/limits.d", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 4
open("/etc/passwd", O_RDONLY)           = 4
open("/var/run/utmp", O_RDONLY)         = 4

On Tue, Nov 15, 2011 at 5:16 PM, Jakub Hrozek  wrote:
> On Tue, Nov 15, 2011 at 09:24:57AM +0530, Nitesh Mehare wrote:
> > Here is the snapshot of the file
> >
> > -bash-3.2# cat /etc/pam.d/sshd
> >    #%PAM-1.0
> >    authA A A A A A  includeA A A A A  system-auth
> >    accountA A A  requiredA A A A  pam_nologin.so
> >    accountA A A  includeA A A A A  system-auth
> >    passwordA A  includeA A A A A  system-auth
> >    sessionA A A  optionalA A A A  pam_keyinit.so force revoke
> >    sessionA A A  includeA A A A A  system-auth
> >    sessionA A A  requiredA A A A  pam_loginuid.so
> >    -bash-3.2#
>
> Provided that you still use the same system-auth file as you provided in
> one of the first comments, everything looks fine.
>
> Can you run:
> strace -e open su - $username
>
> That should tell us whether the pam stack is actually opening the module
> or not.
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Nitesh Mehare]

is that the output which is expected in the trace.
Something missing in the trace which suggest any config problem???

On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare  wrote:
> This is the output of strace for the user which is in ldap server.
>
> bash-3.2# strace -e open su - nitback1
> open("/etc/ld.so.cache", O_RDONLY)      = 3
> open("/lib64/libpam.so.0", O_RDONLY)    = 3
> open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
> open("/lib64/libcrypt.so.1", O_RDONLY)  = 3
> open("/lib64/libdl.so.2", O_RDONLY)     = 3
> open("/lib64/libc.so.6", O_RDONLY)      = 3
> open("/lib64/libaudit.so.0", O_RDONLY)  = 3
> open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
> open("/etc/nsswitch.conf", O_RDONLY)    = 3
> open("/etc/ld.so.cache", O_RDONLY)      = 3
> open("/lib64/libnss_files.so.2", O_RDONLY) = 3
> open("/etc/passwd", O_RDONLY)           = 3
> open("/etc/ld.so.cache", O_RDONLY)      = 3
> open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
> open("/etc/pam.d/su-l", O_RDONLY)       = 4
> open("/etc/pam.d/su", O_RDONLY)         = 5
> open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
> open("/etc/ld.so.cache", O_RDONLY)      = 6
> open("/lib64/libselinux.so.1", O_RDONLY) = 6
> open("/lib64/libsepol.so.1", O_RDONLY)  = 6
> open("/etc/selinux/config", O_RDONLY)   = 6
> open("/proc/mounts", O_RDONLY)          = 6
> open("/etc/pam.d/system-auth", O_RDONLY) = 6
> open("/lib64/security/pam_env.so", O_RDONLY) = 7
> open("/lib64/security/pam_unix.so", O_RDONLY) = 7
> open("/etc/ld.so.cache", O_RDONLY)      = 7
> open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
> open("/lib64/libnsl.so.1", O_RDONLY)    = 7
> open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
> open("/lib64/security/pam_sss.so", O_RDONLY) = 7
> open("/lib64/security/pam_deny.so", O_RDONLY) = 7
> open("/etc/pam.d/su", O_RDONLY)         = 5
> open("/etc/pam.d/system-auth", O_RDONLY) = 6
> open("/lib64/security/pam_localuser.so", O_RDONLY) = 7
> open("/lib64/security/pam_permit.so", O_RDONLY) = 7
> open("/etc/pam.d/su", O_RDONLY)         = 5
> open("/etc/pam.d/system-auth", O_RDONLY) = 6
> open("/lib64/security/pam_cracklib.so", O_RDONLY) = 7
> open("/lib64/security/pam_keyinit.so", O_RDONLY) = 5
> open("/etc/pam.d/su", O_RDONLY)         = 5
> open("/etc/pam.d/system-auth", O_RDONLY) = 6
> open("/lib64/security/pam_mkhomedir.so", O_RDONLY) = 7
> open("/lib64/security/pam_limits.so", O_RDONLY) = 7
> open("/lib64/security/pam_xauth.so", O_RDONLY) = 6
> open("/etc/pam.d/other", O_RDONLY)      = 4
> open("/etc/passwd", O_RDONLY)           = 4
> open("/proc/filesystems", O_RDONLY)     = 4
> open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 5
> open("/etc/passwd", O_RDONLY)           = 4
> open("/etc/passwd", O_RDONLY)           = 4
> open("/etc/passwd", O_RDONLY)           = 4
> Creating directory '/home/nitback1'.
> open("/etc/skel/", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 4
> open("/etc/skel//.bash_logout", O_RDONLY) = 5
> open("/home/nitback1/.bash_logout", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
> open("/etc/skel//.bash_profile", O_RDONLY) = 5
> open("/home/nitback1/.bash_profile", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
> open("/etc/skel//.emacs", O_RDONLY)     = 5
> open("/home/nitback1/.emacs", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
> open("/etc/skel//.bashrc", O_RDONLY)    = 5
> open("/home/nitback1/.bashrc", O_WRONLY|O_CREAT|O_TRUNC, 0600) = 6
> Creating directory '/home/nitback1/.mozilla'.
> open("/etc/skel//.mozilla", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 5
> Creating directory '/home/nitback1/.mozilla/extensions'.
> open("/etc/skel//.mozilla/extensions", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 6
> Creating directory '/home/nitback1/.mozilla/plugins'.
> open("/etc/skel//.mozilla/plugins", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 6
> open("/etc/passwd", O_RDONLY)           = 4
> open("/etc/security/limits.conf", O_RDONLY) = 4
> open("/etc/security/limits.d", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 4
> open("/etc/passwd", O_RDONLY)           = 4
> open("/var/run/utmp", O_RDONLY)         = 4
>
> On Tue, Nov 15, 2011 at 5:16 PM, Jakub Hrozek  wrote:
> > On Tue, Nov 15, 2011 at 09:24:57AM +0530, Nitesh Mehare wrote:
> > > Here is the snapshot of the file
> > >
> > > -bash-3.2# cat /etc/pam.d/sshd
> > >    #%PAM-1.0
> > >    authA A A A A A  includeA A A A A  system-auth
> > >    accountA A A  requiredA A A A  pam_nologin.so
> > >    accountA A A  includeA A A A A  system-auth
> > >    passwordA A  includeA A A A A  system-auth
> > >    sessionA A A  optionalA A A A  pam_keyinit.so force revoke
> > >    sessionA A A  includeA A A A A  system-auth
> > >    sessionA A A  requiredA A A A  pam_loginuid.so
> > >    -bash-3.2#
> >
> > Provided that you still use the same system-auth file as you provided in
> > one of the first comments, everything looks fine.
> >
> > Can you run:
> > strace -e open su - $username
> >
> > That should tell us whether the pam stack is actually opening the module
> > or not.
> > _______________________________________________
> > sssd-devel mailing list
> > [e-mail]
> > https://fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote:
> is that the output which is expected in the trace.
>    Something missing in the trace which suggest any config problem???
>
> On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare  wrote:
>  This is the output of strace for the user which is in ldap server.
>
>  bash-3.2# strace -e open su - nitback1
>  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
>  open("/lib64/libpam.so.0", O_RDONLY)A A A  = 3
>  open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
>  open("/lib64/libcrypt.so.1", O_RDONLY)A  = 3
>  open("/lib64/libdl.so.2", O_RDONLY)A A A A  = 3
>  open("/lib64/libc.so.6", O_RDONLY)A A A A A  = 3
>  open("/lib64/libaudit.so.0", O_RDONLY)A  = 3
>  open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
>  open("/etc/nsswitch.conf", O_RDONLY)A A A  = 3
>  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
>  open("/lib64/libnss_files.so.2", O_RDONLY) = 3
>  open("/etc/passwd", O_RDONLY)A A A A A A A A A A  = 3
>  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
>  open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
>  open("/etc/pam.d/su-l", O_RDONLY)A A A A A A  = 4
>  open("/etc/pam.d/su", O_RDONLY)A A A A A A A A  = 5
>  open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
>  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 6
>  open("/lib64/libselinux.so.1", O_RDONLY) = 6
>  open("/lib64/libsepol.so.1", O_RDONLY)A  = 6
>  open("/etc/selinux/config", O_RDONLY)A A  = 6
>  open("/proc/mounts", O_RDONLY)A A A A A A A A A  = 6
>  open("/etc/pam.d/system-auth", O_RDONLY) = 6
>  open("/lib64/security/pam_env.so", O_RDONLY) = 7
>  open("/lib64/security/pam_unix.so", O_RDONLY) = 7
>  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 7
>  open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
>  open("/lib64/libnsl.so.1", O_RDONLY)A A A  = 7
>  open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
>  open("/lib64/security/pam_sss.so", O_RDONLY) = 7

So it seems pam_sss is found ^^^^

I have one suggestion as per the system-auth PAM config, I think the
session is not correct, authconfig configures the PAM stack like this:
---
session  optional   pam_keyinit.so revoke
session  required   pam_limits.so
session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
session  [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session  required   pam_unix.so
session  optional   pam_sss.so
---

Can you check two more things for me? Can you look if you get any AVC
denials provided SELinux is set to enforcing (or retry with setenforce 0
set for that test).

Also, can you send the whole strace output? IOW, run:
strace su - nitback1
ideally as non-root so you're prompted for password

[Nitesh Mehare]

Thanks Jakub for looking into the issue..
According to your suggesstion I have modified my system-auth file..Now my
current config looks like this...
*
bash-3.2# cat /etc/pam.d/system-auth*
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    /lib64/security/pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore]
/lib64/security/pam_sss.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    sufficient    /lib64/security/pam_sss.so use_authtok
password    required      pam_deny.so

#session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
#session     optional      pam_keyinit.so revoke
#session     required      pam_limits.so
#session     [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
#session     sufficient    /lib64/security/pam_sss.so
#session     required      pam_unix.so

session  optional   pam_keyinit.so revoke
session  required   pam_limits.so
session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
session  [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use _uid
session  required   pam_unix.so
session  optional   pam_sss.so
bash-3.2#

After this I have restarted the sssd processs using the cmd *service sssd
restart*

Then I tried the authentication with strace su - nitback1 which gave the
output.which is in the attached file .
But this did not prompt me for any password it stopped at the below like
*rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0
wait4(-1, $*

Tha above trace I have take with selinux is disabled.The setting of selinux
is as follows

*bash-3.2# cat /etc/selinux/config*
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.
SELINUXTYPE=targeted
bash-3.2#

I'm not sure how to check for AVC denials when selinux is set to
enforcing.Could you tell me how to do that.

Thanks...

On Wed, Nov 16, 2011 at 7:25 PM, Jakub Hrozek  wrote:
> On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote:
> > is that the output which is expected in the trace.
> >    Something missing in the trace which suggest any config problem???
> >
> > On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare
>
> wrote:
> >  This is the output of strace for the user which is in ldap server.
> >
> >  bash-3.2# strace -e open su - nitback1
> >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> >  open("/lib64/libpam.so.0", O_RDONLY)A A A  = 3
> >  open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
> >  open("/lib64/libcrypt.so.1", O_RDONLY)A  = 3
> >  open("/lib64/libdl.so.2", O_RDONLY)A A A A  = 3
> >  open("/lib64/libc.so.6", O_RDONLY)A A A A A  = 3
> >  open("/lib64/libaudit.so.0", O_RDONLY)A  = 3
> >  open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
> >  open("/etc/nsswitch.conf", O_RDONLY)A A A  = 3
> >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> >  open("/lib64/libnss_files.so.2", O_RDONLY) = 3
> >  open("/etc/passwd", O_RDONLY)A A A A A A A A A A  = 3
> >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> >  open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
> >  open("/etc/pam.d/su-l", O_RDONLY)A A A A A A  = 4
> >  open("/etc/pam.d/su", O_RDONLY)A A A A A A A A  = 5
> >  open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
> >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 6
> >  open("/lib64/libselinux.so.1", O_RDONLY) = 6
> >  open("/lib64/libsepol.so.1", O_RDONLY)A  = 6
> >  open("/etc/selinux/config", O_RDONLY)A A  = 6
> >  open("/proc/mounts", O_RDONLY)A A A A A A A A A  = 6
> >  open("/etc/pam.d/system-auth", O_RDONLY) = 6
> >  open("/lib64/security/pam_env.so", O_RDONLY) = 7
> >  open("/lib64/security/pam_unix.so", O_RDONLY) = 7
> >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 7
> >  open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
> >  open("/lib64/libnsl.so.1", O_RDONLY)A A A  = 7
> >  open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
> >  open("/lib64/security/pam_sss.so", O_RDONLY) = 7
>
> So it seems pam_sss is found ^^^^
>
> I have one suggestion as per the system-auth PAM config, I think the
> session is not correct, authconfig configures the PAM stack like this:
>
> session  optional   pam_keyinit.so revoke
> session  required   pam_limits.so
> session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
> session  [success=1 default=ignore] pam_succeed_if.so service in crond
> quiet use_uid
> session  required   pam_unix.so
> session  optional   pam_sss.so
>
> Can you check two more things for me? Can you look if you get any AVC
> denials provided SELinux is set to enforcing (or retry with setenforce 0
> set for that test).
>
> Also, can you send the whole strace output? IOW, run:
> strace su - nitback1
> ideally as non-root so you're prompted for password
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Nitesh Mehare]

The attached trace file in this mail has trace in which it is asking for
password.
Let me know if this is helpful

Thanks

On Wed, Nov 16, 2011 at 7:49 PM, Nitesh Mehare  wrote:
> Thanks Jakub for looking into the issue..
> According to your suggesstion I have modified my system-auth file..Now my
> current config looks like this...
>
> bash-3.2# cat /etc/pam.d/system-auth*
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    /lib64/security/pam_sss.so use_first_pass
> auth        required      pam_deny.so
>
> account     required      pam_unix.so
> account     sufficient    pam_localuser.so
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account [default=bad success=ok user_unknown=ignore]
> /lib64/security/pam_sss.so
> account     required      pam_permit.so
>
> password    requisite     pam_cracklib.so try_first_pass retry=3 type=
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    sufficient    /lib64/security/pam_sss.so use_authtok
> password    required      pam_deny.so
>
> #session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
> #session     optional      pam_keyinit.so revoke
> #session     required      pam_limits.so
> #session     [success=1 default=ignore] pam_succeed_if.so service in crond
> quiet use_uid
> #session     sufficient    /lib64/security/pam_sss.so
> #session     required      pam_unix.so
>
> session  optional   pam_keyinit.so revoke
> session  required   pam_limits.so
> session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
> session  [success=1 default=ignore] pam_succeed_if.so service in crond
> quiet use _uid
> session  required   pam_unix.so
> session  optional   pam_sss.so
> bash-3.2#
>
> After this I have restarted the sssd processs using the cmd *service sssd
> restart*
>
> Then I tried the authentication with strace su - nitback1 which gave the
> output.which is in the attached file .
> But this did not prompt me for any password it stopped at the below like
> *rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0
> wait4(-1, $*
>
> Tha above trace I have take with selinux is disabled.The setting of
> selinux is as follows
>
> *bash-3.2# cat /etc/selinux/config*
> # This file controls the state of SELinux on the system.
> # SELINUX= can take one of these three values:
> #       enforcing - SELinux security policy is enforced.
> #       permissive - SELinux prints warnings instead of enforcing.
> #       disabled - SELinux is fully disabled.
> SELINUX=disabled
> # SELINUXTYPE= type of policy in use. Possible values are:
> #       targeted - Only targeted network daemons are protected.
> #       strict - Full SELinux protection.
> SELINUXTYPE=targeted
> bash-3.2#
>
> I'm not sure how to check for AVC denials when selinux is set to
> enforcing.Could you tell me how to do that.
>
> Thanks...
>
> On Wed, Nov 16, 2011 at 7:25 PM, Jakub Hrozek  wrote:
> > On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote:
> > > is that the output which is expected in the trace.
> > >    Something missing in the trace which suggest any config problem???
> > >
> > > On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare
> >
> > wrote:
> > >  This is the output of strace for the user which is in ldap server.
> > >
> > >  bash-3.2# strace -e open su - nitback1
> > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> > >  open("/lib64/libpam.so.0", O_RDONLY)A A A  = 3
> > >  open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
> > >  open("/lib64/libcrypt.so.1", O_RDONLY)A  = 3
> > >  open("/lib64/libdl.so.2", O_RDONLY)A A A A  = 3
> > >  open("/lib64/libc.so.6", O_RDONLY)A A A A A  = 3
> > >  open("/lib64/libaudit.so.0", O_RDONLY)A  = 3
> > >  open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
> > >  open("/etc/nsswitch.conf", O_RDONLY)A A A  = 3
> > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> > >  open("/lib64/libnss_files.so.2", O_RDONLY) = 3
> > >  open("/etc/passwd", O_RDONLY)A A A A A A A A A A  = 3
> > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> > >  open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
> > >  open("/etc/pam.d/su-l", O_RDONLY)A A A A A A  = 4
> > >  open("/etc/pam.d/su", O_RDONLY)A A A A A A A A  = 5
> > >  open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
> > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 6
> > >  open("/lib64/libselinux.so.1", O_RDONLY) = 6
> > >  open("/lib64/libsepol.so.1", O_RDONLY)A  = 6
> > >  open("/etc/selinux/config", O_RDONLY)A A  = 6
> > >  open("/proc/mounts", O_RDONLY)A A A A A A A A A  = 6
> > >  open("/etc/pam.d/system-auth", O_RDONLY) = 6
> > >  open("/lib64/security/pam_env.so", O_RDONLY) = 7
> > >  open("/lib64/security/pam_unix.so", O_RDONLY) = 7
> > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 7
> > >  open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
> > >  open("/lib64/libnsl.so.1", O_RDONLY)A A A  = 7
> > >  open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
> > >  open("/lib64/security/pam_sss.so", O_RDONLY) = 7
> >
> > So it seems pam_sss is found ^^^^
> >
> > I have one suggestion as per the system-auth PAM config, I think the
> > session is not correct, authconfig configures the PAM stack like this:
> >
> > session  optional   pam_keyinit.so revoke
> > session  required   pam_limits.so
> > session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
> > session  [success=1 default=ignore] pam_succeed_if.so service in crond
> > quiet use_uid
> > session  required   pam_unix.so
> > session  optional   pam_sss.so
> >
> > Can you check two more things for me? Can you look if you get any AVC
> > denials provided SELinux is set to enforcing (or retry with setenforce 0
> > set for that test).
> >
> > Also, can you send the whole strace output? IOW, run:
> > strace su - nitback1
> > ideally as non-root so you're prompted for password
> > _______________________________________________
> > sssd-devel mailing list
> > [e-mail]
> > https://fedorahosted.org/mailman/listinfo/sssd-devel

[Nitesh Mehare]

Was anybody able to look at the trace...

Thanks ....

On Wed, Nov 16, 2011 at 8:53 PM, Nitesh Mehare  wrote:
> The attached trace file in this mail has trace in which it is asking for
> password.
> Let me know if this is helpful
>
> Thanks
>
> On Wed, Nov 16, 2011 at 7:49 PM, Nitesh Mehare  wrote:
> > Thanks Jakub for looking into the issue..
> > According to your suggesstion I have modified my system-auth file..Now my
> > current config looks like this...
> >
> > bash-3.2# cat /etc/pam.d/system-auth*
> > #%PAM-1.0
> > # This file is auto-generated.
> > # User changes will be destroyed the next time authconfig is run.
> > auth        required      pam_env.so
> > auth        sufficient    pam_unix.so nullok try_first_pass
> > auth        requisite     pam_succeed_if.so uid >= 500 quiet
> > auth        sufficient    /lib64/security/pam_sss.so use_first_pass
> > auth        required      pam_deny.so
> >
> > account     required      pam_unix.so
> > account     sufficient    pam_localuser.so
> > account     sufficient    pam_succeed_if.so uid < 500 quiet
> > account [default=bad success=ok user_unknown=ignore]
> > /lib64/security/pam_sss.so
> > account     required      pam_permit.so
> >
> > password    requisite     pam_cracklib.so try_first_pass retry=3 type=
> > password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> > use_authtok
> > password    sufficient    /lib64/security/pam_sss.so use_authtok
> > password    required      pam_deny.so
> >
> > #session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
> > #session     optional      pam_keyinit.so revoke
> > #session     required      pam_limits.so
> > #session     [success=1 default=ignore] pam_succeed_if.so service in
> > crond quiet use_uid
> > #session     sufficient    /lib64/security/pam_sss.so
> > #session     required      pam_unix.so
> >
> > session  optional   pam_keyinit.so revoke
> > session  required   pam_limits.so
> > session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
> > session  [success=1 default=ignore] pam_succeed_if.so service in crond
> > quiet use _uid
> > session  required   pam_unix.so
> > session  optional   pam_sss.so
> > bash-3.2#
> >
> > After this I have restarted the sssd processs using the cmd *service
> > sssd restart*
> >
> > Then I tried the authentication with strace su - nitback1 which gave the
> > output.which is in the attached file .
> > But this did not prompt me for any password it stopped at the below like
> > *rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0
> > wait4(-1, $*
> >
> > Tha above trace I have take with selinux is disabled.The setting of
> > selinux is as follows
> >
> > *bash-3.2# cat /etc/selinux/config*
> > # This file controls the state of SELinux on the system.
> > # SELINUX= can take one of these three values:
> > #       enforcing - SELinux security policy is enforced.
> > #       permissive - SELinux prints warnings instead of enforcing.
> > #       disabled - SELinux is fully disabled.
> > SELINUX=disabled
> > # SELINUXTYPE= type of policy in use. Possible values are:
> > #       targeted - Only targeted network daemons are protected.
> > #       strict - Full SELinux protection.
> > SELINUXTYPE=targeted
> > bash-3.2#
> >
> > I'm not sure how to check for AVC denials when selinux is set to
> > enforcing.Could you tell me how to do that.
> >
> > Thanks...
> >
> > On Wed, Nov 16, 2011 at 7:25 PM, Jakub Hrozek  wrote:
> > > On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote:
> > > > is that the output which is expected in the trace.
> > > >    Something missing in the trace which suggest any config problem???
> > > >
> > > > On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare
> > >
> > > wrote:
> > > >  This is the output of strace for the user which is in ldap server.
> > > >
> > > >  bash-3.2# strace -e open su - nitback1
> > > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> > > >  open("/lib64/libpam.so.0", O_RDONLY)A A A  = 3
> > > >  open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
> > > >  open("/lib64/libcrypt.so.1", O_RDONLY)A  = 3
> > > >  open("/lib64/libdl.so.2", O_RDONLY)A A A A  = 3
> > > >  open("/lib64/libc.so.6", O_RDONLY)A A A A A  = 3
> > > >  open("/lib64/libaudit.so.0", O_RDONLY)A  = 3
> > > >  open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
> > > >  open("/etc/nsswitch.conf", O_RDONLY)A A A  = 3
> > > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> > > >  open("/lib64/libnss_files.so.2", O_RDONLY) = 3
> > > >  open("/etc/passwd", O_RDONLY)A A A A A A A A A A  = 3
> > > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
> > > >  open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
> > > >  open("/etc/pam.d/su-l", O_RDONLY)A A A A A A  = 4
> > > >  open("/etc/pam.d/su", O_RDONLY)A A A A A A A A  = 5
> > > >  open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
> > > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 6
> > > >  open("/lib64/libselinux.so.1", O_RDONLY) = 6
> > > >  open("/lib64/libsepol.so.1", O_RDONLY)A  = 6
> > > >  open("/etc/selinux/config", O_RDONLY)A A  = 6
> > > >  open("/proc/mounts", O_RDONLY)A A A A A A A A A  = 6
> > > >  open("/etc/pam.d/system-auth", O_RDONLY) = 6
> > > >  open("/lib64/security/pam_env.so", O_RDONLY) = 7
> > > >  open("/lib64/security/pam_unix.so", O_RDONLY) = 7
> > > >  open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 7
> > > >  open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
> > > >  open("/lib64/libnsl.so.1", O_RDONLY)A A A  = 7
> > > >  open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
> > > >  open("/lib64/security/pam_sss.so", O_RDONLY) = 7
> > >
> > > So it seems pam_sss is found ^^^^
> > >
> > > I have one suggestion as per the system-auth PAM config, I think the
> > > session is not correct, authconfig configures the PAM stack like this:
> > >
> > > session  optional   pam_keyinit.so revoke
> > > session  required   pam_limits.so
> > > session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
> > > session  [success=1 default=ignore] pam_succeed_if.so service in crond
> > > quiet use_uid
> > > session  required   pam_unix.so
> > > session  optional   pam_sss.so
> > >
> > > Can you check two more things for me? Can you look if you get any AVC
> > > denials provided SELinux is set to enforcing (or retry with setenforce 0
> > > set for that test).
> > >
> > > Also, can you send the whole strace output? IOW, run:
> > > strace su - nitback1
> > > ideally as non-root so you're prompted for password
> > > _______________________________________________
> > > sssd-devel mailing list
> > > [e-mail]
> > > https://fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Mon, Nov 21, 2011 at 05:50:40PM +0530, Nitesh Mehare wrote:
> Was anybody able to look at the trace...
>
> Thanks ....

Sorry Nitesh, I forgot to reply.

The trace clearly shows that pam_sss sends data to and receives data
from the private sssd PAM socket:

-----
stat("/var/lib/sss/pipes/private/pam", {st_mode=S_IFSOCK|0600,
st_size=0, ...}) = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 5
fcntl(5, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
fcntl(5, F_GETFD)                       = 0
fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
connect(5, {sa_family=AF_FILE,
path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\3\0\0\0", 4)                 = 4
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\3\0\0\0", 4)                  = 4
getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
77
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21
----

I'm not sure why pam_sss wouldn't show in the secure logs...

Does SSSD print anything /var/log/sssd/sssd_pam.log when you put
'debug_level = 9' into the [pam] section of the SSSD config?
>    Tha above trace I have take with selinux is disabled.The setting of
>    selinux is as follows
>
>    bash-3.2# cat /etc/selinux/config
>    # This file controls the state of SELinux on the system.
>    # SELINUX= can take one of these three values:
>    #A A A A A A  enforcing - SELinux security policy is enforced.
>    #A A A A A A  permissive - SELinux prints warnings instead of
>    enforcing.
>    #A A A A A A  disabled - SELinux is fully disabled.
>    SELINUX=disabled
>    # SELINUXTYPE= type of policy in use. Possible values are:
>    #A A A A A A  targeted - Only targeted network daemons are protected.
>    #A A A A A A  strict - Full SELinux protection.
>    SELINUXTYPE=targeted
>    bash-3.2#
>
>    I'm not sure how to check for AVC denials when selinux is set to
>    enforcing.Could you tell me how to do that.
>
>    Thanks...

When SELinux is disabled, it can't generate any AVC denial messages nor
it can block access to the pipes (which was my concern).

[Nitesh Mehare]

I tried putting debug level 9 pam section of sssd.conf
Below is the messages in sssd_pam.log

(Mon Nov 21 18:03:16 2011) [sssd[pam]] [server_setup] (3): CONFDB:
/var/lib/sss/db/config.ldb
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [confdb_get_domain_internal] (1): No
enumeration for [LDAP]!
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_init_connection] (5): Adding
connection 1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [monitor_common_send_id] (4):
Sending ID: (pam,1)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_timeout] (8): 0x1da9faf0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_init_connection] (5): Adding
connection 1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [dp_common_send_id] (4): Sending ID
to DP: (1,PAM)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_timeout] (8): 0x1daa1fb0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sysdb_domain_init_internal] (5): DB
File for LDAP: /var/lib/sss/db/cache_LDAP.ldb
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [ldb] (9): trying to load memberof
from /usr/lib64/ldb/memberof.so
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [ldb] (6): asq: Unable to register
control with rootdse!
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sss_process_init] (1): Responder
Initialization complete
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_remove_timeout] (8): 0x1daa1fb0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [dp_id_callback] (4): Got id ack and
version (1) from DP
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_remove_timeout] (8): 0x1da9faf0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [id_callback] (4): Got id ack and
version (1) from Monitor
(Mon Nov 21 18:03:25 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:26 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:26 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:03:36 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:36 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:36 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:03:46 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:46 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:46 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:03:56 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:56 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:56 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:04:05 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:04:06 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:04:06 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]

The initial messages are for when i restart the sssd service.I do not see
any specific messaages when i try to do authentication.
I'm not sure how to move fwd from here cause till now the settings i have
done seems to be correct.

Would like to thank for the help I'm getting in this forum hope it will
help resolving my issue.

Thanks

On Mon, Nov 21, 2011 at 6:43 PM, Jakub Hrozek  wrote:
> On Mon, Nov 21, 2011 at 05:50:40PM +0530, Nitesh Mehare wrote:
> > Was anybody able to look at the trace...
> >
> > Thanks ....
>
> Sorry Nitesh, I forgot to reply.
>
> The trace clearly shows that pam_sss sends data to and receives data
> from the private sssd PAM socket:
>
> stat("/var/lib/sss/pipes/private/pam", {st_mode=S_IFSOCK|0600,
> st_size=0, ...}) = 0
> socket(PF_FILE, SOCK_STREAM, 0)         = 5
> fcntl(5, F_GETFL)                       = 0x2 (flags O_RDWR)
> fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
> fcntl(5, F_GETFD)                       = 0
> fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
> connect(5, {sa_family=AF_FILE,
> path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "\3\0\0\0", 4)                 = 4
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\3\0\0\0", 4)                  = 4
> getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
> 0
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
> 77
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21
>
> I'm not sure why pam_sss wouldn't show in the secure logs...
>
> Does SSSD print anything /var/log/sssd/sssd_pam.log when you put
> 'debug_level = 9' into the [pam] section of the SSSD config?
> >    Tha above trace I have take with selinux is disabled.The setting
>
> of
> >    selinux is as follows
> >
> >    bash-3.2# cat /etc/selinux/config
> >    # This file controls the state of SELinux on the system.
> >    # SELINUX= can take one of these three values:
> >    #A A A A A A  enforcing - SELinux security policy is enforced.
> >    #A A A A A A  permissive - SELinux prints warnings instead of
> >    enforcing.
> >    #A A A A A A  disabled - SELinux is fully disabled.
> >    SELINUX=disabled
> >    # SELINUXTYPE= type of policy in use. Possible values are:
> >    #A A A A A A  targeted - Only targeted network daemons are
>
> protected.
> >    #A A A A A A  strict - Full SELinux protection.
> >    SELINUXTYPE=targeted
> >    bash-3.2#
> >
> >    I'm not sure how to check for AVC denials when selinux is set to
> >    enforcing.Could you tell me how to do that.
> >
> >    Thanks...
>
> When SELinux is disabled, it can't generate any AVC denial messages nor
> it can block access to the pipes (which was my concern).
> _______________________________________________
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On Mon, 2011-11-21 at 19:13 +0530, Nitesh Mehare wrote:
> I tried putting debug level 9 pam section of sssd.conf
> Below is the messages in sssd_pam.log

<snip>
> The initial messages are for when i restart the sssd service.I do not
> see any specific messaages when i try to do authentication.
> I'm not sure how to move fwd from here cause till now the settings i
> have done seems to be correct.
>
> Would like to thank for the help I'm getting in this forum hope it
> will help resolving my issue.

Ok, interesting. So we're seeing pam_sss.so writing to the PAM socket,
but apparently we're not seeing the sssd_pam process receiving and
handling the response. That's... really, really strange.

From the strace:

connect(5, {sa_family=AF_FILE,
path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])

Ok, we opened the socket fine

write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\3\0\0\0", 4)                 = 4
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\3\0\0\0", 4)                  = 4
getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
0

And we sent the peer credentials, which apparently succeeded. We should
be seeing, at minimum:
(Mon Nov 21 08:49:59 2011) [sssd[pam]] [get_client_cred] (0x4000):
Client creds: euid[0] egid[13041] pid[14259].

poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
77

We sent a request to authenticate through 'su - <user>'

poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21

And then we get a reply (I can't tell what it was from this).

I can't understand why we're not seeing any logs
in /var/log/sssd/sssd_pam.log. That doesn't make any sense.

[Nitesh Mehare]

Anyone help me out how can i move fwd from here...

Thanks..

On Mon, Nov 21, 2011 at 7:21 PM, Stephen Gallagher wrote:
> On Mon, 2011-11-21 at 19:13 +0530, Nitesh Mehare wrote:
> > I tried putting debug level 9 pam section of sssd.conf
> > Below is the messages in sssd_pam.log
>
> <snip>
> > The initial messages are for when i restart the sssd service.I do not
> > see any specific messaages when i try to do authentication.
> > I'm not sure how to move fwd from here cause till now the settings i
> > have done seems to be correct.
> >
> > Would like to thank for the help I'm getting in this forum hope it
> > will help resolving my issue.
>
> Ok, interesting. So we're seeing pam_sss.so writing to the PAM socket,
> but apparently we're not seeing the sssd_pam process receiving and
> handling the response. That's... really, really strange.
>
> From the strace:
>
> connect(5, {sa_family=AF_FILE,
> path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
>
> Ok, we opened the socket fine
>
> write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "\3\0\0\0", 4)                 = 4
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\3\0\0\0", 4)                  = 4
> getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
> 0
>
> And we sent the peer credentials, which apparently succeeded. We should
> be seeing, at minimum:
> (Mon Nov 21 08:49:59 2011) [sssd[pam]] [get_client_cred] (0x4000):
> Client creds: euid[0] egid[13041] pid[14259].
>
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
> 77
>
> We sent a request to authenticate through 'su - <user>'
>
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21
>
> And then we get a reply (I can't tell what it was from this).
>
> I can't understand why we're not seeing any logs
> in /var/log/sssd/sssd_pam.log. That doesn't make any sense.
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On Fri, 2011-11-25 at 18:55 +0530, Nitesh Mehare wrote:
> Anyone help me out how can i move fwd from here...

I'm not really sure how to proceed from here. The two logs you sent are
mutually-exclusive. There's no way at all that the sssd_pam.log should
be showing no activity while the strace is describing a send-and-receive
to the SSSD pam socket. So one of those is wrong.

Did you maybe take those logs from a different machine?

[Nitesh Mehare]

is this b'cpz of any setting i'm missing related pam..??

On Tue, Nov 29, 2011 at 12:47 AM, Stephen Gallagher wrote:
> On Fri, 2011-11-25 at 18:55 +0530, Nitesh Mehare wrote:
> > Anyone help me out how can i move fwd from here...
>
> I'm not really sure how to proceed from here. The two logs you sent are
> mutually-exclusive. There's no way at all that the sssd_pam.log should
> be showing no activity while the strace is describing a send-and-receive
> to the SSSD pam socket. So one of those is wrong.
>
> Did you maybe take those logs from a different machine?
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Jakub Hrozek]

On Tue, Nov 29, 2011 at 05:06:20PM +0530, Nitesh Mehare wrote:
> is this b'cpz of any setting i'm missing related pam..??

That's unlikely at this point because the strace output clearly shows us
that data is flowing from and to the sss_pam process.

What we don't understand is why we see data flowing in the strace output
yet the pam logs you pasted show no activity?

Is the snipped of sssd_pam.log file you posted complete? Can you check
again with debug_level=10 in the [pam] section if there are any more
messages in the pam log except for the startup messages and pings?
> On Tue, Nov 29, 2011 at 12:47 AM, Stephen Gallagher 
>    wrote:
>  On Fri, 2011-11-25 at 18:55 +0530, Nitesh Mehare wrote:
>  > Anyone help me out how can i move fwd from here...
>
>  I'm not really sure how to proceed from here. The two logs you sent are
>  mutually-exclusive. There's no way at all that the sssd_pam.log should
>  be showing no activity while the strace is describing a send-and-receive
>  to the SSSD pam socket. So one of those is wrong.
>
>  Did you maybe take those logs from a different machine?

[Nitesh Mehare]

I'm not sure this is helpful but this is what i have log in pam log file.

(Tue Nov 29 16:40:00 2011) [sssd[pam]] [accept_priv_fd_handler] (4): Client
connected to privileged pipe!
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [sss_cmd_get_version] (5): Received
client version [3].
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [sss_cmd_get_version] (5): Offered
version [3].
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_cmd_open_session] (4): entering
pam_cmd_open_session
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): command:
PAM_OPEN_SESSION
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): domain: (null)
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): user: dinst1
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): service: su-l
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): tty: pts/3
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): ruser: root
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): rhost: (null)
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): authtok type: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): authtok size: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): newauthtok
type: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): newauthtok
size: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): priv: 1
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): cli_pid: 4012
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_dp_send_req] (4): Sending
request with the following data:
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): command:
PAM_OPEN_SESSION
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): domain: LDAP
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): user: dinst1
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): service: su-l
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): tty: pts/3
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): ruser: root
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): rhost: (null)
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): authtok type: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): authtok size: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): newauthtok
type: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): newauthtok
size: 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): priv: 1
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_print_data] (4): cli_pid: 4012
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [sbus_add_timeout] (8): 0x9aaadf0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_dom_forwarder] (4):
pam_dp_send_req returned 0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [sbus_remove_timeout] (8): 0x9aaadf0
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
9AAF280
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_dp_process_reply] (4):
received: [0][LDAP]
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_reply] (4): pam_reply get
called.
(Tue Nov 29 16:40:00 2011) [sssd[pam]] [pam_reply] (4): blen: 21
(Tue Nov 29 16:40:07 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
9AAD8D0
(Tue Nov 29 16:40:07 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.

Thanks..

On Tue, Nov 29, 2011 at 5:20 PM, Jakub Hrozek  wrote:
> On Tue, Nov 29, 2011 at 05:06:20PM +0530, Nitesh Mehare wrote:
> > is this b'cpz of any setting i'm missing related pam..??
>
> That's unlikely at this point because the strace output clearly shows us
> that data is flowing from and to the sss_pam process.
>
> What we don't understand is why we see data flowing in the strace output
> yet the pam logs you pasted show no activity?
>
> Is the snipped of sssd_pam.log file you posted complete? Can you check
> again with debug_level=10 in the [pam] section if there are any more
> messages in the pam log except for the startup messages and pings?
> > On Tue, Nov 29, 2011 at 12:47 AM, Stephen Gallagher <
>
> [e-mail]>
> > wrote:
> >  On Fri, 2011-11-25 at 18:55 +0530, Nitesh Mehare wrote:
> >  > Anyone help me out how can i move fwd from here...
> >
> >  I'm not really sure how to proceed from here. The two logs you sent
>
> are
> >  mutually-exclusive. There's no way at all that the sssd_pam.log
>
> should
> >  be showing no activity while the strace is describing a
>
> send-and-receive
> >  to the SSSD pam socket. So one of those is wrong.
> >
> >  Did you maybe take those logs from a different machine?
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

On Tue, 2011-11-29 at 17:47 +0530, Nitesh Mehare wrote:
> I'm not sure this is helpful but this is what i have log in pam log
> file.

I'm guessing that's not the complete log file.

Can you try to show us the part related to PAM_AUTHENTICATE?

If there is no such part, then I'd say your /etc/pam.d/* files are not
correct (perhaps the login program you're using is looking at something
other than system-auth).