August 2014 - sssd-users - Fedora mailing-lists

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

sssd and sudo ldap problems with IPA.
by Lance Reed 29 Aug '14

29 Aug '14

Hello, Thanks in advance for any assistance. This is a long post - apologizes. I have a bit of an odd setup with IPA ipa-server-3.0.0-37.el6.x86_64 and sssd-1.9.2-129.el6_5.4.x86_64 CentOS 6.5. My goal is to get sudo work using IPA as a source. I setup the IPA server as normal. Since we are using this in a cloud environment (ec2) with hosts that may come and go quickly, we decided not to connect clients using the ipa-client code. Instead we have user auth working with SSSD as an LDAP provider. ( I know this complicates all things IPA). e.g: sssd.conf /etc/sssd/sssd.conf [domain/LDAP] enumerate = true cache_credentials = True debug_level = 8 id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_schema = IPA ldap_uri = ldaps://ipa-1b.ec2.example.net, ldaps://ipa-1.example.net ldap_user_search_base = dc=example,dc=net ldap_id_use_start_tls = true tls_reqcert = demand ldap_tls_cacert = /etc/ipa/ca.crt # Setting to correctly query public SSH keys from IPA server ldap_user_ssh_public_key = ipaSshPubKey [sssd] services = nss, pam, ssh config_file_version = 2 domains = LDAP So far this is working fine, with a minor issue around password expiration (a known issue). NOTE: The IPA server does not keep a list of hosts since we are not using the ipa-client / kerberos setup. At this point I am trying to get IPA working as a sudo provider. After reading through: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/ht… and https://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf I attempted to get sssd to use IPA as a sudo provider, I added the following to sssd.conf: [domain/LDAP] sudo_provider = ldap ldap_sudo_search_base = ou=sudoers,dc=example,dc=net [sssd] services = nss, pam, ssh, sudo and /etc/nsswitch.conf sudoers: files sss The setup did not resolve any rules, and I saw this in the logs: (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_init] (0x2000): Initializing sudo LDAP back end (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [ldap_get_sudo_options] (0x0400): Search base not set, trying to discover it later connecting to the LDAP server. (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [common_parse_search_base] (0x0100): Search base added: [SUDO][ou=sudoers,dc=example,dc=net][SUBTREE][] (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_object_class has value sudoRole (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_name has value cn (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_command has value sudoCommand (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_host has value sudoHost (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_user has value sudoUser (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_option has value sudoOption (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_runasuser has value sudoRunAsUser (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_runasgroup has value sudoRunAsGroup (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_notbefore has value sudoNotBefore (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_notafter has value sudoNotAfter (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_order has value sudoOrder (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_get_map] (0x0400): Option ldap_sudorule_entry_usn has no value (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_ip_addresses] (0x2000): Found IP address: 10.0.1.105 in network 10.0.1.0/24 (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_ip_addresses] (0x2000): Found IP address: fe80::5054:ff:fe7b:abae in network fe80::/64 (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_hostnames_send] (0x2000): Found fqdn: lreed-sssd02.example.net (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_get_hostnames_send] (0x2000): Found hostname: lreed-sssd02 (Thu Aug 28 10:46:32 2014) [sssd[be[LDAP]]] [sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at: 1409237202 (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_full_refresh_send] (0x0400): Issuing a full refresh of sudo rules (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_refresh_connect_done] (0x0400): SUDO LDAP connection successful (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_next_base] (0x0400): Searching for sudo rules with base [ou=sudoers,dc=example,dc=net] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=lreed-sssd02.example.net)(sudoHost=lreed-sssd02)(sudoHost=10.0.1.105)(sudoHost=10.0.1.0/24)(sudoHost=fe80::5054:ff:fe7b:abae)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))][ou=sudoers,dc=example,dc=net]. (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoCommand] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoHost] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoUser] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOption] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsUser] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsGroup] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotBefore] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotAfter] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOrder] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_process] (0x0400): Receiving sudo rules with base [ou=sudoers,dc=example,dc=net] (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_done] (0x0400): Received 0 rules (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sysdb_sudo_purge_byfilter] (0x0400): No rules matched (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_load_sudoers_done] (0x0400): Sudoers is successfuly stored in cache (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_full_refresh_done] (0x0400): Successful full refresh of sudo rules (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_schedule_refresh] (0x0400): Full refresh scheduled at: 1409258802 (Thu Aug 28 10:46:42 2014) [sssd[be[LDAP]]] [sdap_sudo_schedule_refresh] (0x0400): Smart refresh scheduled at: 1409238102 It seems “ Received 0 rules” means that IPA is note sending the full LDAP entries with sudo rules. I confirmed this by doing an ldap search using an authenticated user and could see them. I have since setup sudo-ldap.conf with an authenticated user. This seems to be working, however it seems a bit kludgy (I admit my entire setup is kludgy). Question #1 is that since this is going through sudo-ldap, sssd is not caching any of these rules. Is there a way to make sssd call sudo-ldap instead of setting it in nsswitch.conf: sudoers: files ldap vs sudoers: files sss ? It does not look like it but I may have something wrong. Question #2 is around hostname and sudo rules. Since we don’t have the hostnames in IPA by default, I can’t easily (AFAIK) add them to sudo rules. I can do rules for “ANY HOST” or I can add “external hosts” With file based sudo rules it is possible to use “wildcard” characters” for example with hostname to do “*-dev” and control rules thusly. The IPA web GUI does not seem to allow such rules. If I have to add each hostname this will become a possible show stopper. Thanks very much for any ideas on these problems.

5 10

problem with sssd using AD on Windows server 202R2
by Kristjan Elias 28 Aug '14

28 Aug '14

Hi all, I have been having some trouble lately with our setup of sssd what i will try to describe for you now. For the past year we have been using sssd to authenticate our RHEL6 local users from Corporate MS AD. This has been working without any problems so far. Last week the last of our DC AD servers were upgraded to Windows server 2012R2 and now the problems started. Firstly AD performance enhancements were lost. Snippet from logs: (Wed Aug 20 12:21:17 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 14:34:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 15:22:52 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 16:03:46 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 16:24:53 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 16:49:04 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 17:45:55 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Wed Aug 20 18:05:01 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [5] (Thu Aug 21 02:20:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 04:43:38 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 10:27:18 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 10:32:27 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 10:52:46 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 16:38:27 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 17:08:06 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements (Thu Aug 21 17:41:15 2014) [sssd[be[MS_AD]]] [sdap_get_server_opts_from_rootdse] (0x0080): Received invalid value for AD compatibility level. Continuing without AD performance enhancements For this i filed a bug: https://fedorahosted.org/sssd/ticket/2418 Secondly when running without AD performance enhancements all logins fail when going through the users parent groups. This error disables the AD login for my RHEL servers. Here are the failure points in sssd log for 3 different users: >From my login attempt: (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #34 [SKYPEDWETL4] is not cached, need to add a fake entry (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [FTE_europe_2] objectSID to unix ID (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success] (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory] (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dfc50], connected[1], ops[(nil)], ldap[0x23dead0] (Thu Aug 28 13:59:04 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! My colleague login attempt: (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #32 [SKYPEDWETL4] is not cached, need to add a fake entry (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success] (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory] (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070] (Thu Aug 28 15:22:11 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! Another collegue: (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sysdb_search_group_by_name] (0x0400): No such entry (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Group #34 [SKYPEDW_FILESHARE_TEST_TPUM_RO] is not cached, need to add a fake entry (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): start ldb transaction (nesting: 2) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_add_incomplete_groups] (0x1000): Mapping group [SKYPE_ES_BI_FTE] objectSID to unix ID (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_attrs_get_sid_str] (0x0080): No [objectSID] attribute while id-mapping. [0][Success] (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 2) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_nested_groups_store] (0x0400): Could not add incomplete groups [2]: No such file or directory (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 1) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [save_rfc2307bis_groups] (0x0080): Could not save groups [2]: No such file or directory (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_initgr_rfc2307bis_done] (0x0080): Could not save groups memberships [2](Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Initgroups done (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_get_initgr_done] (0x4000): Error in initgroups: [2][No such file or directory] (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: sh[0x23dff60], connected[1], ops[(nil)], ldap[0x23de070] (Thu Aug 28 15:31:57 2014) [sssd[be[MS_AD]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! My sssd.conf looks like this: ########################################################## [sssd] domains = MS_AD services = nss,pam config_file_version = 2 [nss] filter_users = root,etl,gpadmin,nws filter_groups = root,etl,gpadmin,nws default_shell = /bin/bash [pam] reconnection_retries = 3 offline_credentials_expiration = 1 offline_failed_login_attempts = 1 [domain/MS_AD] description = LDAP domain with MS AD server debug_level = 9 # caching credentials enumerate = false cache_credentials = false min_id = 1000 id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_tls_reqcert = never ldap_id_mapping = True ldap_schema = ad ldap_idmap_range_min = 10000 ldap_idmap_range_max = 2000100000 ldap_idmap_range_size = 20000000 ldap_uri = ldap://adserveraddress/ ldap_search_base = OU=UserAccounts,DC=something,DC=something ,DC=something,DC=com ldap_default_bind_dn = CN=Bind User Name,OU=UserAccounts,DC=something,DC= something,DC=something,DC=com ldap_default_authtok_type = password ldap_default_authtok = passwordgoeshere ldap_user_object_class = user ldap_group_object_class = group ldap_user_name = sAMAccountName ldap_user_objectsid = objectSid ldap_group_objectsid = objectGUID ldap_user_search_filter = memberOf=CN=SKYPEDWETL4,OU=UserAccounts,DC= something,DC=something,DC=something,DC=com override_homedir = /home/%u # performance ldap_disable_referrals = true ########################################################## Have any of you had experiences with errors like this? Many thanks for your attention! Thanks, Kristjan Elias

2 4

sssd with ad backend, pam problems
by Stefan Schäfer 28 Aug '14

28 Aug '14

Hello list, this is my first try here. I've a problem with a sssd_ad setup with a samba 4 ad domain. Samba domain is created with rfc2307 scheme. sssd works, getent passwd shows users and groups with UNIX-attributes from the ad, but login is impossible. The setup is based on openSUSE 13.1 with sssd updated to version 1.12 and the sernet samba packages version 4.1.11. My sssd configuration: -------------------------------------------------- [sssd] services = nss,pam config_file_version = 2 domains = invis-ad.loc debug_level = 5 [nss] [pam] [domain/invis-ad.loc] # Using id_provider=ad sets the best defaults on its own id_provider = ad # In sssd, the default access provider is always 'permit'. The AD access # provider by default checks for account expiration access_provider = ad # Authentication auth_provider = ad # Uncomment to use POSIX attributes on the server ldap_id_mapping = false # Uncomment if the client machine hostname doesn't match the computer object on the DC. ad_hostname = invisad.invis-ad.loc # Uncomment if DNS SRV resolution is not working ad_server = invisad.invis-ad.loc # Uncomment if the domain section is named differently than your Samba domain ad_domain = invis-ad.loc # Enumeration is discouraged for performance reasons. enumerate = true --------------------------------------------------------------------------------------------------------------------------------- nsswitch.conf .... passwd compat sss group compat sss ..... ---------------------------------------------------------------------------------------------------------------------- getent passwd: .... hbecker:*:10000:10000:Heinz Becker:/home/hbecker:/bin/bash This is exactly what is stored in the ad. The pam configuration: common-auth ------------------------------------------------------------------------------------------------------------------ #%PAM-1.0 auth required pam_env.so auth sufficient pam_unix.so try_first_pass auth sufficient pam_sss.so use_first_pass common-account ------------------------------------------------------------------------------------------------------------------- #%PAM-1.0 account requisite pam_unix.so try_first_pass account sufficient pam_localuser.so account [default=bad success=ok user_unknown=ignore] pam_sss.so common-password ------------------------------------------------------------------------------------------------------------------- password requisite pam_cracklib.so password sufficient pam_unix.so use_authtok nullok try_first_pass password sufficient pam_sss.so use_authtok common-session -------------------------------------------------------------------------------------------------------------------- #%PAM-1.0 session required pam_limits.so session required pam_unix.so try_first_pass session optional pam_sss.so session optional pam_umask.so session optional pam_systemd.so session optional pam_env.so --------------------------------------------------------------------------------------------------------------------- Here the logs from different login tries: 1. non-existing user 2014-08-28T15:52:29.560167+02:00 invisad login: pam_unix(login:auth): check pass; user unknown 2014-08-28T15:52:29.560490+02:00 invisad login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= 2014-08-28T15:52:29.567475+02:00 invisad login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=oierwe 2014-08-28T15:52:29.569417+02:00 invisad login: pam_sss(login:auth): received for user oierwe: 10 (User not known to the underlying authentication module) 2014-08-28T15:52:29.572497+02:00 invisad login: pam_unix(login:account): could not identify user (from getpwnam(oierwe)) 2014-08-28T15:52:29.573783+02:00 invisad login: User not known to the underlying authentication module seems to be ok. 2. existing user, wrong password 2014-08-28T15:53:33.988971+02:00 invisad login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:53:34.090927+02:00 invisad [sssd[krb5_child[16213]]]: #020 2014-08-28T15:53:34.101970+02:00 invisad login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:53:34.103406+02:00 invisad login: pam_sss(login:auth): received for user hbecker: 17 (Failure setting user credentials) 2014-08-28T15:53:34.104581+02:00 invisad login: pam_sss(login:account): Access denied for user hbecker: 4 (System error) 2014-08-28T15:53:34.105607+02:00 invisad login: System error seems to be ok. 3. existing user, correct password: 2014-08-28T15:54:39.661506+02:00 invisad login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:54:39.780648+02:00 invisad [sssd[krb5_child[16218]]]: #020 2014-08-28T15:54:39.791159+02:00 invisad login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=hbecker 2014-08-28T15:54:39.793320+02:00 invisad login: pam_sss(login:auth): received for user hbecker: 4 (System error) 2014-08-28T15:54:39.795032+02:00 invisad login: pam_sss(login:account): Access denied for user hbecker: 4 (System error) 2014-08-28T15:54:39.796398+02:00 invisad login: System error 2 times "system error", definitely not the expected result. Any ideas? With hope for help, regards Stefan -- www.invis-server.org Stefan Schäfer Ludwigstr. 1-3 63679 Schotten

6 16

A prototype of merged domains ("views")
by Nordgren, Bryce L -FS 27 Aug '14

27 Aug '14

Over the past month, I rearranged my local systems for our collaboration environment. The essence of the work is to combine employee identities (defined in AD) with identities for external users (defined in FreeIPA), massage them so that they look the same, and export them to every posix desktop and web application I support. Defining cross-domain posix groups is included, and was successfully performed, but sssd doesn't have a vocabulary to describe a merged domain (one identity provider, multiple auth providers). Still trying to figure out if I can force this to work somehow. The activity may shine a light on some of the things "views" might be required to do. http://www.freeipa.org/page/V4/Use_Case_for_Views:_Collaboration Enjoy, Bryce This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

2 2

Re: [SSSD-users] Fwd: sssd auth issue on centos 5.10
by Lukas Slebodnik 27 Aug '14

27 Aug '14

On (26/08/14 10:14), Daniel Jung wrote: >trying again.. > >---------- Forwarded message ---------- >From: Daniel Jung <mimianddaniel(a)gmail.com> >Date: Tue, Aug 26, 2014 at 10:13 AM >Subject: Re: [SSSD-users] sssd auth issue on centos 5.10 >To: Jakub Hrozek <jhrozek(a)redhat.com>, islebodn(a)redhat.com > > >Hi Lukas, or Jakub, > >Don't mean to be pushy but do you guys have any idea why I would need to do >this to make TLS work on centos 5.6 and up ? I do appreciate that you guys ^^^^^^^^^^ you should use centos 5.10 >are helping out with this as centos doesnt fall under supported contract. > >Cheers I thought your problem has alredy been fixed [1]. I tried to test default version of sssd on centos 5.10 and it works with FreeIPA server (389-ds). sssd-1.9-6 from copr repo works as well. It seems that you have problem with certificate. Unfortunately, I am not able to help you with this part of configuration. Try to reply also to the sssd-users in future. LS [1] https://lists.fedorahosted.org/pipermail/sssd-users/2014-August/002117.html [2] https://copr.fedoraproject.org/coprs/sgallagh/sssd-1.9-rhel5/

3 2

Re: [SSSD-users] Fwd: sssd auth issue on centos 5.10
by Lukas Slebodnik 27 Aug '14

27 Aug '14

On (27/08/14 00:53), Daniel Jung wrote: >Hi Lukas, > >Yes it does work after recompling nss with libnsspem and upgrading openldap >lib. I do agree that 5.6 should really be upgraded . > >I had tested the cert using openssl s_client and ldapsearch -ZZ and both >worked fine. However, sssd didnt work. Curious did you compile SSSD to use >openssl instead of nss ? > I did not recompile anything. It means libnss3.so was used. LS

1 0

Same user name and group name in AD
by Andre Pitanga 25 Aug '14

25 Aug '14

Hi list- I'm working on a project using Active Directory 2008 R2 with Identity Management for UNIX service to provide authentication and identity for Linux users via sssd. Using this setup, is it possible to have the Linux username and group name be the same (e.g. user apache, group apache)? I've learned that the sAMAccountName attribute must be unique across the domain but I'm not sure if sssd uses this attribute to "translate" the UID and GID to names in Linux. Hope this makes sense! Our sssd.conf is: [sssd] config_file_version = 2 debug_level = 0 domains = example.com services = nss, pam [domain/example.com] id_provider = ad access_provider = ad # We rely on UNIX extended attributes in AD ldap_id_mapping = false enumerate = true -- Andre Pitanga RHCE 100-077-478 (917) 745-6256 andre.pitanga(a)redhat.com Red Hat, Inc. Red Hat Consulting

5 8

problem sudo with centos 6.5
by alireza baghery 25 Aug '14

25 Aug '14

hi i integrated AD windows 208 R2 with IPA server (centos 6.5) i write a sudo policy and access for specified user and host with allow any command. user can execute sudo in centos 7 but when user loggin on centos 6.5 can not execute sudo and get error below user@AD is not in sudoers file. i write email to IPA guys but they tell there is a bug in 6.5 around sudo and AD users. i can not migrate to centOS 7.please tell me how to solve this problem. i configure /etc/nsswitch.conf --sudoers: file sss /etc/sss/sss.conf----service nss, pam,ssh,sudo /etc/sysconfig/network ----- NISDOMAIN=ad.com thanks

1 0

Command in ~/.ssh/authorized_keys not triggered
by XuQing Tan 24 Aug '14

24 Aug '14

Hi, folks I have successfully setup sssd that the project members can login with their LDAP credentials. we also have gitlab installed in the same server, gitlab relies on the SSH trigger (command="..." in authorized_keys file) for git ssh auth. but the problem is I can't get git ssh auth login success because the gitlab-shell comamnd not triggered: cat ~/.ssh/authorized_keys command="*date >> a.log;* /opt/git/gitlab-shell/bin/gitlab-shell key-2",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsIDug9GByMA0KWakMxt2jJTKhR4Rr53zA3iIGNyI5FFszppaAaKLyEjwi46IcPD6247eiudhNkptqAk5Ao71+iydbkuT882F+IEzgD6f4nl2fBqWyZPN/AtG8ojnQJWVOwN2W02IPgXYx+Kpbg9LAk2ac8nW/JK9A90X8+BmCcdWJzjXzoXp2RsOPeofcXcAyjr5vhHP4ES1xxC+jZ4UcpCbOLhIC1EwHGZk1Kwc1WV7IeZBd0tjjuJs1q9zDzAKNFG93U9cVZ6/92N46TNgHRcp+BRuYpGO/vK1sn2Or3x/hq/ruvjGpes+kFQ35VwSAA2DncPV0CPfn9opUXkcXw== jenkins-ci(a)example.com i added "date >> a.log" in front of the gitlab-shell, the expect result is ~/a.log should be generated and datetime are logged in the file. (i test this on a normal server, which means without SSSD setup, it worked as expected) but on the SSSD enabled server, i did not see ~/a.log created, that means the command not triggered. so do you have any clue why the command not triggered? let me know if need to provide more info, like conf file, etc. Thanks & Best Regards! /// (. .) --------ooO--(_)--Ooo-------- | Nick Tan | ------------------------------------

1 1

sssd auth issue on centos 5.10
by Daniel Jung 22 Aug '14

22 Aug '14

Hi, sssd shows the following error when a user tries to log on using password. enumerate is false. Using 1.5.1.70 Any idea why this is happening? Thanks (Mon Aug 11 19:47:39 2014) [sssd] [mt_svc_exit_handler] (2): Child [LDAP] terminated with signal [11] (Mon Aug 11 19:47:39 2014) [sssd] [sbus_dispatch] (3): Connection is not open for dispatching. (Mon Aug 11 19:47:39 2014) [sssd] [mt_svc_restart] (6): Scheduling service LDAP for restart 1 (Mon Aug 11 19:47:39 2014) [sssd] [start_service] (4): Queueing service LDAP for startup (Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5): Entering. (Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5): Adding connection 0x129cea40. (Mon Aug 11 19:47:39 2014) [sssd] [sbus_init_connection] (5): Adding connection 129CEA40 (Mon Aug 11 19:47:39 2014) [sssd] [sbus_server_init_new_connection] (5): Got a connection (Mon Aug 11 19:47:39 2014) [sssd] [monitor_service_init] (3): Initializing D-BUS Service (Mon Aug 11 19:47:39 2014) [sssd] [client_registration] (4): Received ID registration: (%BE_LDAP,1) (Mon Aug 11 19:47:39 2014) [sssd] [mark_service_as_started] (5): Marking LDAP as started.

3 22

Startup segfault loop of domain_be on Ubuntu 14.04
by Chris Hartman 22 Aug '14

22 Aug '14

Hi guys, Ubuntu 14.04 x86_64 SSSD 1.11.5 Active Directory backend I've been experiencing this problem for a few weeks with no luck in troubleshooting it. During boot, the sssd_be process will continually spawn and crash due to a segfault. When it gets stuck in this loop, domain account login is almost impossible (local accounts still work). I've attached sanitized logs and my sssd.conf file. Please have a look and let me know what you think. Thanks! -Chris

4 17

using ldap -> sssd -> AD (sssd as a proxy)
by Gerardo Padierna 22 Aug '14

22 Aug '14

Hi, I'd like to know if it somehow possible to use sssd as a proxy authenticator, by which I mean the following: · I want to authenticate users defined on a windows AD 2003 server on a Solaris box (sssd is not available) · I'm already using sssd on RHEL boxes -> I'd like to maintain the same UID/GID mapping on the Solarix boxes as those already used on the RHEL machines · I was wondering if there's a conf (or a hack) that makes it possible to authenticate an AD user on a box (which can't run sssd) the following way: Soraris box -> asks ldap server -> asks sssd (on same box or not) -> asks AD Since sssd is a client, I can't figure out how to do that, but maybe there's a way (that's why I was thinking that maybe, by combining an ldap server with sssd, they could act together as an authentication provider). Again: The reason why not using directly just one ldap client on the Solaris boxes is to maintain the same UID/GIDs already defined in other sssd-based hosts. Thanks a lot for any suggestions on this. -- *Gerardo Padierna Nanclares* <mailto:asl.gerardo@gmail.com>

2 2

id, ACLs, and remote groups
by Peter Kirby 21 Aug '14

21 Aug '14

I'm running CentOS 7, fully updated with SSSD version 1.11.2. I used realm to setup SSSD and everything seems to be working fine for authentication. I'm even able to filter access based on an ldap group. My id and access providers are both set to ad. When I try to run: id username, all I get is the "domain users" group listed as the primary group. However, if I run something like: getent group test-group, and then again run id on a user in that group, test-group now shows up in the list along with domain users. While I don't particularly care about the output from id, I'm seeing the same behavior when trying to use ACLs. The scenario is the same as above. Before getent group test-group, the users do not have access via ACL to files. As soon as I run getent, everything starts working as it should. I have tried enumerate = true in sssd.conf and confirmed sss is in nsswitch.conf where it should be, but I cannot seem to make remote groups work. I suspect I'm missing something very small, but I've been searching manuals, google, and the logs for days and I haven't found any solution yet. I would appreciate any suggestions anyone might have. Thanks, Peter -- Peter Kirby System and Database Administrator @ Harding University

4 8

sssd with ctdb
by steve 20 Aug '14

20 Aug '14

Hi Can we use sssd instead of winbind in a ctdb cluster joined to AD in the same way it works on a non clustered file server? Cheers, Steve

3 4

krb5_child can't create ccache with error 13 [Permission Denied]
by Chris Malton 20 Aug '14

20 Aug '14

Hi guys, I'm fairly sure I'm missing something here, but I can't see why. For some reason, I get this in the logs: (Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [sss_get_ccache_name_for_principal] (0x4000): Location: [FILE:/tmp/krb5cc_1332601725_XXXXXX] (Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [sss_get_ccache_name_for_principal] (0x2000): krb5_cc_cache_match failed: [-1765328243][Can't find client principal cmalton_it(a)KEGS.LOCAL in cache collection] (Wed Aug 20 07:51:33 2014) [[sssd[krb5_child[3650]]]] [create_ccache] (0x0020): 574: [13][Permission denied] So... here's some debug logs/configs: krb5_child log: http://paste.ubuntu.com/8095446/ sssd_kegs.local.log: http://paste.ubuntu.com/8095643/ krb5.conf: http://paste.ubuntu.com/8095464/ sssd.conf: http://paste.ubuntu.com/8095470/ # ls -alh /tmp total 16K drwxrwxrwx 2 root root 4.0K Aug 20 08:21 . drwxr-xr-x 22 root root 4.0K Jul 8 19:40 .. -rw------- 1 root root 7.4K Aug 20 07:19 krb5cc_0 I'm at a loss - anyone else able to tell me what's wrong or point me in the right direction? Cheers, Chris

3 5

LDAP bind with Session Tracking Control
by Michael Ströder 19 Aug '14

19 Aug '14

HI! Would be pretty cool if sssd would send the Session Tracking Control along with its LDAP bind requests when checking user's passwords. http://tools.ietf.org/html/draft-wahl-ldap-session LDAP servers which support this control (like OpenLDAP) can then log e.g. the SSH client's IP address along with received bind requests. Ciao, Michael.

2 2

Re: [SSSD-users] Caching credentials while online
by Jacob Weber 15 Aug '14

15 Aug '14

> I've marked #2408 as a duplicate of #1807. Sorry I made you file another > ticket, Jacob. But #1807 is present in 1.13 which is the next upstream > version we'll be working on and I doubt we'd had time to implement this > RFE sooner. No problem. I'm going to use mod_authz_ldap to deal with my Apache problem for now, since that has caching. But it would be nice to have some caching for normal logins, to reduce the load on the LDAP server. Jacob

1 0

Re: [SSSD-users] Caching credentials while online
by Jacob Weber 15 Aug '14

15 Aug '14

> Can you file a RFE? Sure: https://fedorahosted.org/sssd/ticket/2408 > Could you check in the logs what takes the longest during the whole > request? If your server is really fast, maybe you can add > debug_microseconds to the config file to increase the resolution.. I tried, but I'm not seeing a particular area that's slower than others. I can try looking more carefully when I have some time. The lookup doesn't make a huge difference in one request, but it adds up. In particular, this machine runs Subversion over Apache, and authenticates against the system users (using SSSD). Unfortunately SVN over Apache makes a ton of separate requests. Since SSSD doesn't cache, I'm probably going to look into having Apache use a method that does, like mod_ldap. > Maybe the new option could cover both the initgroups and authentication, > not sure. It's a bit of slippery slope, because on a Linux system > authentication is actually the only moment where groups are set. On the > other hand, group membership don't change that often.. Plus, if you're doing offline caching, you're already going down that slope... Jacob

5 5

Caching credentials while online
by Jacob Weber 14 Aug '14

14 Aug '14

Using SSSD with LDAP, is it possible to cache credentials for a period, even while online? I'd like to speed up authentication on certain servers. I have cache_credentials = true in sssd.conf. When I authenticate, I can see "Password successfully cached for [username]" in the log file. Then if I go offline, the cache is used. But while I'm online, it contacts the server each time. Thanks, Jacob

2 1

disjointed AD namespace
by Daniel Shown 14 Aug '14

14 Aug '14

I'm having trouble authenticating to an AD domain with a disjointed namespace using SSSD. Here's what I'm up against: netbios domain name: BLAH domain (& kerberos realm): DS.BLAH.COM UPNs: username(a)BLAH.COM to join to the domain I have to have workgroup: BLAH in smb.conf, which is not generally how smb and winbind are config'ed (usually it would be DS instead of BLAH). I can create a kerberos ticket for user(a)DS.BLAH.COM. I can do an "id user(a)ds.blah.com" and get valid response. but when I try to "su user(a)ds.blah.com" I get an invalid password, and a log entry indicating "[sssd[krb5_child[29198]]]: Cannot resolve servers for KDC in realm "BLAH.COM"". I'm assuming that it's looking for the KDC there because of the setting in smb.conf. I'm running SSSD 1.9.2 on CentOS 6.5. I've tried various settings googling around, and so my current sssd.conf file looks like: [sssd] services = nss, pam, ssh, pac config_file_version = 2 domains = ds.blah.com debug_level = 10 [nss] [pam] [sudo] [autofs] [ssh] [pac] [domain/ds.blah.com] cache_credentials = False krb5_store_password_if_offline = False id_provider = ad auth_provider = ad access_provider = ad ad_server = dc1.ds.blah.com ad_hostname = host.ds.blah.com krb5_realm = DS.BLAH.COM ad_domain = ds.blah.com ad_enable_dns_sites = True krb5_canonicalize = false debug_level = 5 Any suggestions would be greatly appreciated. =================================== *Daniel Shown,* Linux Systems Administrator Advanced Technology Group Information Technology Services <http://www.slu.edu/its> at Saint Louis University <http://www.slu.edu/>. 314-977-2583 =================================== "The aim of education is the knowledge, not of facts, but of values." — William S. Burroughs "I’m supposed to be a scientific person but I use intuition more than logic in making basic decisions." — Seymour R. Cray

2 2

LDAP and useradd, groupmod, passwd, etc.
by Jacob Weber 13 Aug '14

13 Aug '14

If I use SSSD on CentOS with an LDAP domain, do tools like useradd, groupmod, and passwd affect LDAP users/groups, or do they only affect the ones in /etc/passwd and /etc/group? I'd prefer the latter, but I'm not sure whether this is something that can be configured. I know there are also luseradd and lgroupmod, but I'm using a tool (Ansible) that relies on the standard commands. Thanks, Jacob

2 1

FW: NFS+KERB+SSSD Ubuntu 14.04
by Longina Przybyszewska 12 Aug '14

12 Aug '14

>I fail to see how SSSD can be to blame for any of this, as the mount has nothing to do with mapping users. I don't blame SSSD either ;) The only context to SSSD could be - joining computers to AD - as I joined both computers with 'realmd' method recommended by SSSD team. The Kerberos keys created by realm are good enough for authentication users with SSSD. 'Realm' does not support adding SPN principal into AD ; To create nfs principal for server I used method described in https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server with the following commands: setspn -A nfs/jota.nat.c.example.com jota ktpass /princ nfs/jota.nat.c.example.com(a)NAT.C.EXAMPLE.COM /out jota-nfs-2.keytab /crypto all /ptype KRB5_NT_PRINCIPAL -desonly /mapuser NAT-EXAMPLE\JOTA$ -setupn -setpass +rndPass +answer (NAT-EXAMPLE in my case is short AD domain name) I added keytab for nfs principal to the NFS server's /etc/krb5.keytab root@jota:/# klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-crc) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-md5) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (arcfour-hmac) 4 host/JOTA(a)NAT.C.SDU.DK (des-cbc-crc) 4 host/JOTA(a)NAT.C.SDU.DK (des-cbc-md5) 4 host/JOTA(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 host/JOTA(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 host/JOTA(a)NAT.C.SDU.DK (arcfour-hmac) 4 JOTA$(a)NAT.C.SDU.DK (des-cbc-crc) 4 JOTA$(a)NAT.C.SDU.DK (des-cbc-md5) 4 JOTA$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 JOTA$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 JOTA$(a)NAT.C.SDU.DK (arcfour-hmac) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-crc) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-md5) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (arcfour-hmac) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) ...and I am getting persistent "Permission denied " on client. Version of nfs-utils Is the same: root@jota:/home/alongina# dpkg -l | grep nfs ii libnfsidmap2:amd64 0.25-5 amd64 NFS idmapping library ii nfs-common 1:1.2.8-6ubuntu1.1 amd64 NFS support files common to client and server ii nfs-kernel-server 1:1.2.8-6ubuntu1.1 amd64 support for NFS kernel server >I've always gone for an nfs/fqn userPrincipal for both client and server, which I understand to be a touch outdated with current nfs-utils. If you're using AD, it's also important to set the >userAccountControl to limit the kerberos tickets to not include PAC, or else you'll have issues with user accounts that are members of a significant number of groups. >I think the significant bit is "Wrong principal in request" on the server. >Possibly things to check: >Check kvno lines up correctly for all machine credentials. When in doubt, delete the machine objects and start again. Kvno seems to be OK ; (SSSD could be the proof) >Previously NFS was very limited in what enctypes it could cope with. Try again with: >[libdefaults] >default_tkt_enctypes = arcfour-hmac I added that option to /etc/krb5.conf (on both, and rebooted both); Still permission denied... ON client: Output from rpc.gssd after issuing 'mount' command -------------------------------- Success getting keytab entry for 'JEDI$(a)NAT.C.EXAMPLE.COM' INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM' are good until 1407800571 INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM' are good until 1407800571 using FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM as credentials cache for machine creds using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM creating context using fsuid 0 (save_uid 0) creating tcp client for server jota.nat.c.example.com DEBUG: port already set to 2049 creating context with server nfs(a)jota.nat.c.example.com WARNING: Failed to create krb5 context for user with uid 0 for server jota.nat.c.example.com WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM for server jota.nat.c.example.com WARNING: Machine cache is prematurely expired or corrupted trying to recreate cache for server jota.nat.c.example.com Full hostname for 'jota.nat.c.example.com' is 'jota.nat.c.example.com' Full hostname for 'jedi.nat.c.example.com' is 'jedi.nat.c.example.com' Success getting keytab entry for 'JEDI$(a)NAT.C.EXAMPLE.COM' INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM' are good until 1407800571 INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM' are good until 1407800571 using FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM as credentials cache for machine creds using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM creating context using fsuid 0 (save_uid 0) creating tcp client for server jota.nat.c.example.com DEBUG: port already set to 2049 creating context with server nfs(a)jota.nat.c.example.com WARNING: Failed to create krb5 context for user with uid 0 for server jota.nat.c.example.com WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM for server jota.nat.c.example.com WARNING: Failed to create machine krb5 context with any credentials cache for server jota.nat.c.example.com doing error downcall Kerberos cache on the client: root@jedi:/home/longinap# klist -ce /tmp/krb5ccmachine_NAT.C.EXAMPLE.COM Ticket cache: FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM Default principal: JEDI$(a)NAT.C.EXAMPLE.COM Valid starting Expires Service principal 08/11/2014 15:42:51 08/12/2014 01:42:51 krbtgt/NAT.C.EXAMPLE.COM(a)NAT.C.EXAMPLE.COM renew until 08/12/2014 15:42:51, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 08/11/2014 15:42:51 08/12/2014 01:42:51 nfs/jota.nat.c.example.com(a)NAT.C.EXAMPLE.COM renew until 08/12/2014 15:42:51, Etype (skey, tkt): arcfour-hmac, arcfour-hmac ------------------- Encryption mismatch? Principal mismach? !"#¤%&! -- Longina _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 4

how to map unix group name to other attribute than "cn" of the group entry
by XuQing Tan 12 Aug '14

12 Aug '14

Hi Folks in our project, there is already one legacy openldap server runing. we managed the user and groups with posixAccount and posixGroup. recently, we setup ssh ldap integration with sssd, we can login to the linux box with ldap user credentials, so far so good. except one thing, we found there are some groups name are too long (large than 32 char) which violate the 32 char unix group name length contraints according to "groupadd" man page. we can't modiy the attribute "cn" of posixGroup since it's already used in other integrated system. so i'm wondering, is there any way to map the unix group name to something else, rather than the defualt attribute "cn"? i did search the sssd conf manual, nothing found, so i'd like to consult you here. Thanks & Best Regards! /// (. .) --------ooO--(_)--Ooo-------- | Nick Tan | ------------------------------------

5 15

Externally defined, cross-domain group membership. Prohibited?
by Nordgren, Bryce L -FS 11 Aug '14

11 Aug '14

I have an external LDAP metadirectory acting as an identity provider for my linux domain. The metadirectory overrides and supplements the upstream identity source (e.g., it passes thru sn, givenName, mail, telephoneNumber; but overrides or adds uidNumber, gidNumber, loginShell, etc.) The directory also holds RFC2307 group information, and the groups contain members from multiple upstream sources. Authentication via simple bind (for web apps) is passed thru to the relevant upstream provider. LDAP works great. For command line login, I want to use Kerberos. Each upstream provider is configured as a domain within sssd which uses LDAP for identities and Kerberos for authentication. The local, linux domain-wide groups are included as one of the domain definitions, but not the others. For instance, I have defined domain A, B, and C. Domain A contains group information having members from all three. Domains B and C essentially have no groups defined. "Getent passwd user works." Authentication works. "getent group test" works, initially...SSSD is removing users from my group. sss_cache -G restores the user (i.e., getent group test includes the user), but the first time the user tries to exercise their permissions by accessing a file on the filesystem, they get a permission denied and are removed from the group (getent group test does not include the user). Are cross-realm groups something that sssd is designed to prohibit? This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

2 2

NFS+KERB+SSSD Ubuntu 14.04
by Longina Przybyszewska 11 Aug '14

11 Aug '14

Hi, I really struggle with "permission denied" while mounting NFS share with sec=krb5; Both machines(Ubuntu 14.04) , NFS client and server are configured with SSSD, and authentication seems to work (only one test user for configuration with PoSIX ids ;) 'getent passwd longina' returns correct values on both. I joined both machines to AD with 'realmd', and additionaly created SPN principal nfs/jota.nat.c.example.com(a)NAT.C.EXAMPLE.COM with setspn.exe on AD and added keys to the /etc/krb5.keytab . I expect to be able to mount NFS share with sec=krb5 as root on client using machine credentials. HERE some debugging output Output on client (jedi) from 'rpc.gssd' while mounting nfs share ----------------- doing error downcall handling gssd upcall (/run/rpc_pipefs/nfs/clnt9) handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 ' handling krb5 upcall (/run/rpc_pipefs/nfs/clnt9) process_krb5_upcall: service is '<null>' Full hostname for 'jota.nat.c.sdu.dk' is 'jota.nat.c.sdu.dk' Full hostname for 'jedi.nat.c.sdu.dk' is 'jedi.nat.c.sdu.dk' Success getting keytab entry for 'JEDI$(a)NAT.C.SDU.DK' INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK' are good until 1407542806 INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK' are good until 1407542806 using FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK as credentials cache for machine creds using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK creating context using fsuid 0 (save_uid 0) creating tcp client for server jota.nat.c.sdu.dk DEBUG: port already set to 2049 creating context with server nfs(a)jota.nat.c.sdu.dk WARNING: Failed to create krb5 context for user with uid 0 for server jota.nat.c.sdu.dk WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK for server jota.n\ at.c.sdu.dk WARNING: Machine cache is prematurely expired or corrupted trying to recreate cache for server jota.nat.c.sdu.dk Full hostname for 'jota.nat.c.sdu.dk' is 'jota.nat.c.sdu.dk' Full hostname for 'jedi.nat.c.sdu.dk' is 'jedi.nat.c.sdu.dk' Success getting keytab entry for 'JEDI$(a)NAT.C.SDU.DK' INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK' are good until 1407542806 INFO: Credentials in CC 'FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK' are good until 1407542806 using FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK as credentials cache for machine creds using environment variable to select krb5 ccache FILE:/tmp/krb5ccmachine_NAT.C.SDU.DK creating context using fsuid 0 (save_uid 0) creating tcp client for server jota.nat.c.sdu.dk DEBUG: port already set to 2049 creating context with server nfs(a)jota.nat.c.example.com WARNING: Failed to create krb5 context for user with uid 0 for server jota.nat.c.example.com WARNING: Failed to create machine krb5 context with credentials cache FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM for server jota.n\ at.c.example.com WARNING: Failed to create machine krb5 context with any credentials cache for server jota.nat.c.example.com doing error downcall destroying client /run/rpc_pipefs/nfs/clnta destroying client /run/rpc_pipefs/nfs/clnt9 ----------- client(jedi): hostname: jedi ---------- root@jedi:/var/lib/sss/db# klist -c klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0) root@jedi:/var/lib/sss/db# klist -c /tmp/krb5ccmachine_NAT.C.EXAMPLE.COM Ticket cache: FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM Default principal: JEDI$(a)NAT.C.EXAMPLE.COM Valid starting Expires Service principal 08/08/2014 16:06:46 08/09/2014 02:06:46 krbtgt/NAT.C.EXAMPLE.COM(a)NAT.C.EXAMPLE.COM renew until 08/09/2014 16:06:46 08/08/2014 16:06:46 08/09/2014 02:06:46 nfs/jota.nat.c.example.com(a)NAT.C.EXAMPLE.COM renew until 08/09/2014 16:06:46 root@jedi:/var/lib/sss/db# klist -ce /tmp/krb5ccmachine_NAT.C.EXAMPLE.COM Ticket cache: FILE:/tmp/krb5ccmachine_NAT.C.EXAMPLE.COM Default principal: JEDI$(a)NAT.C.EXAMPLE.COM Valid starting Expires Service principal 08/08/2014 16:06:46 08/09/2014 02:06:46 krbtgt/NAT.C.EXAMPLE.COM(a)NAT.C.EXAMPLE.COM renew until 08/09/2014 16:06:46, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 08/08/2014 16:06:46 08/09/2014 02:06:46 nfs/jota.nat.c.example.com(a)NAT.C.EXAMPLE.COM renew until 08/09/2014 16:06:46, Etype (skey, tkt): arcfour-hmac, arcfour-hmac ------------ root@jedi:/etc# klist -ek Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 6 host/jedi.nat.c.example.com(a)NAT.C.EXAMPLE.COM (des-cbc-crc) 6 host/jedi.nat.c.example.com(a)NAT.C.EXAMPLE.COM (des-cbc-md5) 6 host/jedi.nat.c.example.com(a)NAT.C.EXAMPLE.COM (aes128-cts-hmac-sha1-96) 6 host/jedi.nat.c.example.com(a)NAT.C.EXAMPLE.COM (aes256-cts-hmac-sha1-96) 6 host/jedi.nat.c.example.com(a)NAT.C.EXAMPLE.COM (arcfour-hmac) 6 host/JEDI(a)NAT.C.EXAMPLE.COM (des-cbc-crc) 6 host/JEDI(a)NAT.C.EXAMPLE.COM (des-cbc-md5) 6 host/JEDI(a)NAT.C.EXAMPLE.COM (aes128-cts-hmac-sha1-96) 6 host/JEDI(a)NAT.C.EXAMPLE.COM (aes256-cts-hmac-sha1-96) 6 host/JEDI(a)NAT.C.EXAMPLE.COM (arcfour-hmac) 6 JEDI$(a)NAT.C.EXAMPLE.COM (des-cbc-crc) 6 JEDI$(a)NAT.C.EXAMPLE.COM (des-cbc-md5) 6 JEDI$(a)NAT.C.EXAMPLE.COM (aes128-cts-hmac-sha1-96) 6 JEDI$(a)NAT.C.EXAMPLE.COM (aes256-cts-hmac-sha1-96) 6 JEDI$(a)NAT.C.EXAMPLE.COM (arcfour-hmac) ------------------------- Server (jota): --------------------- hostname: jota.nat.c.example.com ------- root@jota:/home/alongina# klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-crc) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-md5) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (arcfour-hmac) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 nfs/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-crc) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (des-cbc-md5) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 host/jota.nat.c.sdu.dk(a)NAT.C.SDU.DK (arcfour-hmac) 4 host/JOTA(a)NAT.C.SDU.DK (des-cbc-crc) 4 host/JOTA(a)NAT.C.SDU.DK (des-cbc-md5) 4 host/JOTA(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 host/JOTA(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 host/JOTA(a)NAT.C.SDU.DK (arcfour-hmac) 4 JOTA$(a)NAT.C.SDU.DK (des-cbc-crc) 4 JOTA$(a)NAT.C.SDU.DK (des-cbc-md5) 4 JOTA$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96) 4 JOTA$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96) 4 JOTA$(a)NAT.C.SDU.DK (arcfour-hmac) root@jota:/# ps ax | grep rpc 512 ? Ss 0:00 rpcbind 625 ? Ss 0:00 rpc.statd -L 670 ? S< 0:00 [rpciod] 769 ? Ss 0:00 rpc.idmapd 850 ? Ss 0:00 rpc.gssd 2348 ? Ss 0:00 /usr/sbin/rpc.svcgssd -vvvvvvvvvv 2350 ? Ss 0:00 /usr/sbin/rpc.mountd --manage-gids root@jota:/home/alongina# klist -c klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0) -------------- root@jota:/home/alongina# cat /etc/exports # /nfs *(rw,crossmnt,no_subtree_check,sec=krb5:krb5p:krb5i) ---------------- root@jota:/home/alongina# kinit -k JOTA\$(a)NAT.C.EXAMPLE.COM --------------- root@jota:/home/alongina# klist -c Ticket cache: FILE:/tmp/krb5cc_0 Default principal: JOTA$(a)NAT.C.EXAMPLE.COM Valid starting Expires Service principal 08/08/14 16:36:44 09/08/14 02:36:44 krbtgt/NAT.C.EXAMPLE.COM(a)NAT.C.EXAMPLE.COM renew until 09/08/14 16:36:44 /var/log/syslog (rpc.svcgssd) Aug 8 16:34:56 jota rpc.svcgssd[2348]: finished handling null request Aug 8 16:34:56 jota rpc.svcgssd[2348]: entering poll Aug 8 16:34:56 jota rpc.svcgssd[2348]: leaving poll Aug 8 16:34:56 jota rpc.svcgssd[2348]: handling null request Aug 8 16:34:56 jota rpc.svcgssd[2348]: svcgssd_limit_krb5_enctypes: Calling gss_set_allowable_enctypes with 7 enctypes from the kernel Aug 8 16:34:56 jota rpc.svcgssd[2348]: WARNING: gss_accept_sec_context failed Aug 8 16:34:56 jota rpc.svcgssd[2348]: ERROR: GSS-API: error in handle_nullreq: gss_accept_sec_context(): GSS_S_FAILURE (Unspecified GSS failure. Minor code may provide more information) - Wrong principal in request Aug 8 16:34:56 jota rpc.svcgssd[2348]: sending null reply Mange hilsner Longina

3 9

Merging local/ldap groups
by Jacob Weber 08 Aug '14

08 Aug '14

Is it possible to merge a group that's defined locally with one defined on an LDAP server? I'm running a Subversion server. I need certain local users like apache to have write access to the repository files. But I also need my LDAP users to be able to write to them. I was thinking of creating a local group in /etc/group, containing the local users. Then I'd create a group on the LDAP server with the same name and numeric ID, containing the LDAP users. The repository files would then be assigned to that group, so they're writable by both sets of users. Is that a bad idea? Thanks, Jacob

3 3

Re: [SSSD-users] Merging local/ldap groups
by Jacob Weber 08 Aug '14

08 Aug '14

> Only one local user needs access? Can it be owned by apache and writeable by the LDAP group? > > Filesystem ACLs let you specify two groups, will that work? > > Intentionally creating a GID collision at the scope of the local machine does not appear to have solved your problem, so I'd undo that right away. It's probably going to be more than one user. I'm thinking ACLs might be the way to go. Jacob

1 0

Merging local/ldap groups
by Jacob Weber 08 Aug '14

08 Aug '14

> if you're using the RFC2307 schema (and not RFC2307bis) then it's > possible to just include a local user in the memberUid attribute. See: Thanks...unfortunately I'm using RFC2307bis, so that won't work. Jacob

2 1

SSSD (1.11.6 with LDAP/Krb5 providers) Init group lookup failed.
by 杉山昌治 08 Aug '14

08 Aug '14

Hello I also have a group issue on sssd 1.11.6 with LDAP/Krb5 provider. When I used sssd-1.9.2-129.el6_5.4.x86_64, I could get all belonging groups by "id" command. After I updated to sssd-1.11.6-1, I could get only primary group by "id" command. I needed to retrieve each group information by "getent group" command, After that I could get all belonging groups by "id" command. It looks like the initial group lookup failed on sssd-1.11.6-1. Is this behavior a bug or spec of version 1.11.6 or I missed something in configuration file ? I would appreciate your kind support. Reproduce Procedures ================ 1. Set up desired sssd version 2. Remove cache files # rm -f /var/lib/sss/db/cache* 3. Start sssd # sssd -i -d7 -c sssd.conf-LDAP 4. Check account information by "id" command # id shoji-lab 5. Check group information by "getent group" command # getent group G-Role-ISOps-Server 6. Check account information again. # id shoji-lab Test Result (sssd-1.9.2-129) ==================== [admin@jpbl0-in00-is16 ~]$ rpm -q sssd sssd-1.9.2-129.el6_5.4.x86_64 [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users),20166(U-Role-ISOps-Server),20165(G-Role-ISOps-Server) [admin@jpbl0-in00-is16 ~]$ getent group G-Role-ISOps-Server G-Role-ISOps-Server:*:20165:shoji-lab,bmulvany-lab,banban-lab,test_shoji,mokbrian-lab,arionk-lab,bleej-lab,haughtoj-lab,tstevens-lab,dkeane-lab,danoneil-lab,srpenn-lab [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users),20166(U-Role-ISOps-Server),20165(G-Role-ISOps-Server) Test Result (sssd-1.11.6-1) ==================== [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users) [admin@jpbl0-in00-is16 ~]$ getent group G-Role-ISOps-Server G-Role-ISOps-Server:*:20165:shoji-lab,bmulvany-lab,banban-lab,test_shoji,mokbrian-lab,arionk-lab,bleej-lab,haughtoj-lab,tstevens-lab,dkeane-lab,danoneil-lab,srpenn-lab [admin@jpbl0-in00-is16 ~]$ id shoji-lab uid=20000(shoji-lab) gid=20002(Domain Users) groups=20002(Domain Users),20165(G-Role-ISOps-Server) Error Log Summary (sssd-1.11.6-1) ========================== (Fri Aug 8 03:30:18 2014) [sssd[nss]] [nss_memcache_initgr_check] (0x1000): Got request for [shoji-lab@labsso] (Fri Aug 8 03:30:18 2014) [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 22 error message: Init group lookup failed (Fri Aug 8 03:30:18 2014) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 3, 22, Init group lookup failed Will try to return what we have in cache (Fri Aug 8 03:30:18 2014) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x418450:3:shoji-lab@labsso] (Fri Aug 8 03:30:18 2014) [sssd[be[labsso]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,22,Init group lookup failed (Fri Aug 8 03:30:18 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected! SSSD Configuration : Using LDAP/Krb5 providers ==================================== [sssd] config_file_version = 2 services = nss, pam, sudo domains = labsso [nss] [pam] [sudo] [domain/labsso] enumerate = false ldap_id_use_start_tls = False id_provider = ldap auth_provider = krb5 chpass_provider = krb5 krb5_realm = LABSSO.LABROOT.ISOPS.EXAMPLE.COM krb5_server = jpbw0-in00-is82.labsso.labroot.isops.example.com krb5_kpasswd = jpbw0-in00-is82.labsso.labroot.isops.example.com ldap_schema = rfc2307bis ldap_force_upper_case_realm = True ldap_user_object_class = person ldap_group_object_class = group ldap_user_gecos = displayName ldap_user_home_directory = unixHomeDirectory ldap_uri = ldap://jpbw0-in00-is82.labsso.labroot.isops.example.com ldap_search_base = DC=labsso,DC=labroot,DC=isops,DC=example,DC=com ldap_default_bind_dn = bindisops-lab(a)labsso.labroot.isops.example.com ldap_default_authtok_type = password ldap_default_authtok = password ldap_referrals = False LDAP Server (Active Directory) User/Group Hierarchy ======================================== shoji-lab (uid=20000, @LABSSO) G-Role-ISOps-Server (gid=20165, @LABSSO) U-Role-ISOps-Server (gid=20166, @LABSSO) Regards, Shoji Sugiyama

2 1

SSSD with AD provider - can't obtain group information in subdomain
by 杉山昌治 06 Aug '14

06 Aug '14

Hello I'm struggle with configuration of sssd to retrieve group information defined in a subdomain. I would have your support to solve my issue. Here is my AD configuration. There are 3 AD servers. Root Domain labroot.example.com (just for top AD management) Sub Domain labsso.labroot.example.com (user, global group and universal group are defined here) Subsub Domain labbu.labsso.labroot.example.com (local domain group is defined here) I created a user and groups in those AD servers as below. User/Groups in Domain sso.example.com ======================== User test_user (MemberOf=G-Group-Server) Group G-Role-ISOps-Server (Type: Global Group, Members=test_user, MemberOf=U-Role-ISOps-Server) Group U-Role-ISOps-Server (Type: Universal Group, Members=G-Role-ISOps-Server) User/Groups in Domain sso.example.com ======================== Group D-Role-Server (Type: Domain Local Group, Members=U-Role-ISOps-Server) As for SSSD, I tried to use both "1.11.6" and "1.12.1" with "AD provider" as backend. I expected to get all groups (G-Role-ISOps-Server, U-Role-ISOps-Server and D-ISOps-Server) as a result of "id test_user" command. But I could not find domain local group (D-Role-ISOps-Server) in groups of the user "test_user". as the result of "id test_user" command. I also could not find any members as the result of "getent group D-Role-ISOps-Server" command. I tried to use single domain (sso-ad-ad) and multiple domains (sso-ad-ad and bu-ad-ad) in sssd configuration, but the result is the almost same. (when I use sso-ad-ad domain only, I could not get anything as result of "getent group d-role-isops-server"). # id test_user uid=638201126(test_user) gid=638200513(domain users) groups=638200513(domain users),638201113(g-role-server),638201118(u-role-server),638200512(domain admins) # getent group d-role-isops-server d-role-isops-server:*:927601110: I'm not sure how SSSD AD provider searches group information based on members/memberOf attributes, I suspect missing "memberOf" in universal group (U-Role-*) and "member of domain local group" (U-Role-ISOps-Server) is out of scope of LABBU domain might be clue of my issue. Please advise me what's wrong on my configuration and resolution of my issue. Thanks in advance. Shoji *** Configurations and LDAP search results *** sssd.conf file ========== [sssd] config_file_version = 2 services = nss, pam domains = sso-ad-ad, bu-ad-ad # domains = sso-ad-ad [nss] fallback_homedir = /home/SSO/%u default_shell = /bin/bash [pam] [domain/sso-ad-ad] id_provider = ad auth_provider = ad access_provider = ad ad_server = jpbw0-in00-is82.labsso.labroot.isops.example.com ad_hostname = jpbw0-in00-is82.labsso.labroot.isops.example.com ldap_schema = ad ad_enable_gc = true ldap_id_mapping = true debug_level = 1 [domain/bu-ad-ad] id_provider = ad auth_provider = ad chpass_provider = ad ad_server = jpbw0-in00-is81.labbu.labsso.labroot.isops.example.com ad_hostname = jpbw0-in00-is81.labbu.labsso.labroot.isops.example.com ldap_id_mapping = true debug_level = 1 LDAP Search in Global Catalog of LABSSO ================================== I can search the domain local group in the global catalog. [root@jpbl0-in00-is11 providers]# ldapsearch -Y GSSAPI -LLL -H "ldap:// jpbw0-in00-is82.labsso.labroot.isops.example.com:3268" -b "DC=labsso,DC=labroot,DC=isops,DC=example,DC=com" "(&(name=d-role-isops-server)(objectclass=group)(name=*))" SASL/GSSAPI authentication started SASL username: host/ jpbl0-in00-is11.lab.isops.ibm.com(a)LABSSO.LABROOT.ISOPS.EXAMPLE.COM SASL SSF: 56 SASL data security layer installed. dn: CN=D-Role-ISOps-Server,OU=BU0-ISOps,OU=Roles,DC=labbu,DC=labsso,DC=labroot,DC=isops,DC=example,DC=com objectClass: top objectClass: group cn: D-Role-ISOps-Server description: Server Team distinguishedName: CN=D-Role-ISOps-Server,OU=BU0-ISOps,OU=Roles,DC=labbu,DC=labsso,DC=labroot,DC=isops,DC=example,DC=com instanceType: 0 whenCreated: 20131029185150.0Z whenChanged: 20131029185448.0Z uSNCreated: 17964 uSNChanged: 18034 name: D-Role-ISOps-Server objectGUID:: YflnJQk4IUK4YUAHO43J6w== objectSid:: AQUAAAAAAAUVAAAAml0mRju+InNXWri7VgQAAA== sAMAccountName: D-Role-ISOps-Server sAMAccountType: 536870912 groupType: -2147483644 objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=labroot,DC=isops,DC=example,DC=com dSCorePropagationData: 16010101000000.0Z LDAP Search in LABSSO ==================== I can not search the domain local group in normal domain. [root@jpbl0-in00-is11]# ldapsearch -Y GSSAPI -LLL -H "ldap:// jpbw0-in00-is82.labsso.labroot.isops.example.com" -b "DC=labsso,DC=labroot,DC=isops,DC=example,DC=com" "(&(name=d-role-isops-server)(objectclass=group)(name=*))" SASL/GSSAPI authentication started SASL username: host/ jpbl0-in00-is11.lab.isops.example.com(a)LABSSO.LABROOT.ISOPS.EXAMPLE.COM SASL SSF: 56 SASL data security layer installed. # refldap:// labbu.labsso.labroot.isops.example.com/DC=labbu,DC=labsso,DC=labroot, DC=isops,DC=example,DC=com # refldap:// DomainDnsZones.labsso.labroot.isops.example.com/DC=DomainDnsZones,DC= labsso,DC=labroot,DC=isops,DC=example,DC=com

2 11

Primary group with ldap_id_mapping
by Jacob Weber 05 Aug '14

05 Aug '14

If I have ldap_id_mapping turned on, how does SSSD determine a user's primary group? I don't think ldap_user_gid_number is used in this case, since the numeric IDs are determined on the client side. Thanks, Jacob

2 1

sssd fails to connect to LDAP after high load on the server
by Daniel Jung 04 Aug '14

04 Aug '14

Hi, There were few cases where SSSD seems to stop working and required restart when the server's load average gets high ~ 80 on 24threads(processors) platform. Running 6.5 centos with 1.9.2-129 x86_64 On 6.5, sssd_nss.log shows the following: Thu Jul 31 20:28:38 2014) [sssd[nss]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Thu Jul 31 20:28:38 2014) [sssd[nss]] [sss_process_init] (0x0010): fatal error setting up backend connector (Thu Jul 31 20:30:19 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. (Thu Jul 31 20:44:16 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. (Thu Jul 31 20:44:46 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. (Thu Jul 31 20:45:16 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. (Thu Jul 31 20:45:46 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. <snip> Fri Aug 1 19:55:18 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. (Fri Aug 1 19:55:48 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. (Fri Aug 1 19:56:18 2014) [sssd[nss]] [nss_dp_reconnect_init] (0x0010): Could not reconnect to LDAP provider. Also the /var/log/messages: Jul 31 20:26:22 sssd[nss]: Shutting down Jul 31 20:26:22 ssd[be[LDAP]]: Shutting down Jul 31 20:26:24 sssd[be[LDAP]]: Starting up Jul 31 20:26:24 sssd[nss]: Starting up Jul 31 20:28:34 sssd[be[LDAP]]: Shutting down Jul 31 20:28:34 sssd[nss]: Shutting down Jul 31 20:28:38 sssd[nss]: Starting up Jul 31 20:28:38 sssd[be[LDAP]]: Starting up Jul 31 20:28:40 sssd[nss]: Starting up Jul 31 20:30:05 sssd[be[LDAP]]: Shutting down Jul 31 20:30:25 sssd[be[LDAP]]: Starting up Seems like restart @20:30:25 didnt properly restart sssd daemon? I believe 1.9.2-129 is the latest avail? enumerate is false, ldap_network_timeout is 5 and we have multiple ldap_uri settings where hosts are separated by "," Would appreciate if you can shed some light on this. Thanks.

2 1

/usr/lib/samba/ldb : No such file or directory
by shadrock uhuru 01 Aug '14

01 Aug '14

Hi Steve i think i have found the problem this is a portion of the samba install steps from https://wiki.archlinux.org/index.php/Samba_4_Active_Directory_Domain_Contro… if you intend to use the LDB utilities, you will need to set the LDB_MODULES_PATH # echo "export LDB_MODULES_PATH=\"\${LDB_MODULES_PATH}:/usr/lib/samba/ldb\"" > /etc/profile.d/sambaldb.sh # chmod 0755 /etc/profile.d/sambaldb.sh cat /etc/profile.d/sambaldb.sh export LDB_MODULES_PATH="${LDB_MODULES_PATH}:/usr/lib/samba/ldb" # export LDB_MODULES_PATH=":/usr/lib/samba/ldb" there is no value for ${LDB_MODULES_PATH} i assumed that ${LDB_MODULES_PATH} would be exported by samba4, i then looked further at what was actually exported and decided that the "${LDB_MODULES_PATH}:" section may not be needed so i export LDB_MODULES_PATH="/usr/lib/samba/ldb" and the error disappeared. i hope nothing breaks further down the line by removing ${LDB_MODULES_PATH}: shadrock / >> / hi everyone > />/ could anyone explain the following line in the startup sequence, > />/ ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory > />/ the directory exist with file in it . > / > Have you checked permissions and selinux context? > Was it removed and then copied from other place? > Labels and permission might be off then. > >> / how do i fix it ? > />/ shadrock > />/ > />/ > />/ sssd -i -d7 > />/ (Fri Aug 1 14:08:42:941358 2014) [sssd] [check_file] (0x0400): lstat > />/ for [/var/run/nscd/socket] failed: [2][No such file or directory]. > />/ (Fri Aug 1 14:08:43:034141 2014) [sssd] [ldb] (0x0400): > />/ server_sort:Unable to register control with rootdse! > />/ (Fri Aug 1 14:08:43:039640 2014) [sssd] [confdb_get_domain_internal] > />/ (0x0400): No enumeration for [tissisat.co.uk]! > />/ (Fri Aug 1 14:08:43:040001 2014) [sssd] [confdb_get_domain_internal] > />/ (0x1000): pwd_expiration_warning is -1 > />/ (Fri Aug 1 14:08:43:040678 2014) [sssd] [ldb] (0x0400): > />/ server_sort:Unable to register control with rootdse! > />/ (Fri Aug 1 14:08:43 2014) [sssd] [server_setup] (0x0400): CONFDB: > />/ /var/lib/sss/db/config.ldb > />/ ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory > />/ (Fri Aug 1 14:08:43 2014) [sssd] [sysdb_domain_init_internal] (0x0200): > />/ DB File for tissisat.co.uk: /var/lib/sss/db/cache_tissisat.co.uk.ldb > />/ ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory > />/ (Fri Aug 1 14:08:43 2014) [sssd] [ldb] (0x0400): asq: Unable to > />/ register control with rootdse! > />/ (Fri Aug 1 14:08:43 2014) [sssd] [sbus_new_server] (0x0400): D-BUS > />/ Server listening on > />/ unix:path=/var/lib/sss/pipes/private/sbus-monitor,guid=4e3498299402c9fa69fe2d4553db915b/

1 0

/usr/lib/samba/ldb : No such file or directory
by shadrock uhuru 01 Aug '14

01 Aug '14

hi everyone could anyone explain the following line in the startup sequence, ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory the directory exist with file in it . how do i fix it ? shadrock sssd -i -d7 (Fri Aug 1 14:08:42:941358 2014) [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed: [2][No such file or directory]. (Fri Aug 1 14:08:43:034141 2014) [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (Fri Aug 1 14:08:43:039640 2014) [sssd] [confdb_get_domain_internal] (0x0400): No enumeration for [tissisat.co.uk]! (Fri Aug 1 14:08:43:040001 2014) [sssd] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 (Fri Aug 1 14:08:43:040678 2014) [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (Fri Aug 1 14:08:43 2014) [sssd] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory (Fri Aug 1 14:08:43 2014) [sssd] [sysdb_domain_init_internal] (0x0200): DB File for tissisat.co.uk: /var/lib/sss/db/cache_tissisat.co.uk.ldb ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory (Fri Aug 1 14:08:43 2014) [sssd] [ldb] (0x0400): asq: Unable to register control with rootdse! (Fri Aug 1 14:08:43 2014) [sssd] [sbus_new_server] (0x0400): D-BUS Server listening on unix:path=/var/lib/sss/pipes/private/sbus-monitor,guid=4e3498299402c9fa69fe2d4553db915b

3 2

/usr/lib/samba/ldb : No such file or directory
by shadrock uhuru 01 Aug '14

01 Aug '14

Hi Steve i'm working on archlinux there is no selinux to be concerned with the directory and all the files in //usr/lib/samba/ldb are permission 755 and owned by root:root and they have not been changed in any way. shadrock / > >/ hi everyone > />/ could anyone explain the following line in the startup sequence, > />/ ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory > />/ the directory exist with file in it . > / > Have you checked permissions and selinux context? > Was it removed and then copied from other place? > Labels and permission might be off then. > > >/ how do i fix it ? > />/ shadrock > />/ > />/ > />/ sssd -i -d7 > />/ (Fri Aug 1 14:08:42:941358 2014) [sssd] [check_file] (0x0400): lstat > />/ for [/var/run/nscd/socket] failed: [2][No such file or directory]. > />/ (Fri Aug 1 14:08:43:034141 2014) [sssd] [ldb] (0x0400): > />/ server_sort:Unable to register control with rootdse! > />/ (Fri Aug 1 14:08:43:039640 2014) [sssd] [confdb_get_domain_internal] > />/ (0x0400): No enumeration for [tissisat.co.uk]! > />/ (Fri Aug 1 14:08:43:040001 2014) [sssd] [confdb_get_domain_internal] > />/ (0x1000): pwd_expiration_warning is -1 > />/ (Fri Aug 1 14:08:43:040678 2014) [sssd] [ldb] (0x0400): > />/ server_sort:Unable to register control with rootdse! > />/ (Fri Aug 1 14:08:43 2014) [sssd] [server_setup] (0x0400): CONFDB: > />/ /var/lib/sss/db/config.ldb > />/ ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory > />/ (Fri Aug 1 14:08:43 2014) [sssd] [sysdb_domain_init_internal] (0x0200): > />/ DB File for tissisat.co.uk: /var/lib/sss/db/cache_tissisat.co.uk.ldb > />/ ldb: unable to stat module :/usr/lib/samba/ldb : No such file or directory > />/ (Fri Aug 1 14:08:43 2014) [sssd] [ldb] (0x0400): asq: Unable to > />/ register control with rootdse! > />/ (Fri Aug 1 14:08:43 2014) [sssd] [sbus_new_server] (0x0400): D-BUS > />/ Server listening on > />/ unix:path=/var/lib/sss/pipes/private/sbus-monitor,guid=4e3498299402c9fa69fe2d4553db915b/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2014