sssd able to login the user but failed on sudo
by Karim
Hi Team,
i have two forests both working fine in terms of authentication.
I added a user to sudoers from one of the domains and he is getting access denied.
the user is able to login with no problem, sudo is not working.
in the secure log it shows "account is expired"
in the SSSD logs it shows error
"attempting to kinit for realm xxxxxx" then
"clients credentials has been revoked"
i checked the account and it is not expired nor locked.
additionally: I have another account on the same forest which i used to join to the domain and it is working fine on both authentication and sudoers.
I also tried ldap_user_principal = no suchattribute and krb5_use_enterprise_principal = false
but the problem remains.
what could be the reason behind being able to access and later getting clients credential revoked for sudoes?
Thanks
8 years, 4 months
RHEL/CentOS 6 problems with missing supplemental groups for AD users
by John Beranek
Hi,
I've been investigating problems with the SSSD 1.11 versions supplied in
RHEL/CentOS 6.6 for a while now. I've followed:
https://access.redhat.com/solutions/1264443
https://fedorahosted.org/sssd/ticket/2472
and also created a case with Red Hat support. However, I'm still no closer
to solving the issue.
After updating servers to the SSSD in 6.6, intermittently (for particular
users but not on all servers, and not necessarily all the time) users don't
get their supplementary groups. e.g:
[root@rhel6-template sssd]# id matthewbe
uid=46721(matthewbe) gid=20513(domain users) groups=20513(domain users)
This is with the latest SSSD on a RHEL6.6 server, i.e.:
sssd-1.11.6-30.el6_6.3.x86_64
Our environment is Windows 2003 AD controllers, and users *without* POSIX
attributes in their AD records. So, snippets of sanitised sssd.conf:
[domain/AD]
debug_level = 9
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
ad_server = dc01.local,dc02.local
ad_backup_server = ad.local
ad_domain = ad.local
# ID mapping
min_id = 20000
ldap_idmap_range_min = 20000
#ldap_idmap_range_max = 220000
ldap_idmap_range_size = 200000
ldap_idmap_default_domain_sid = S-1-5-21-2365159532-2245169678-2931239768
ldap_schema = ad
ldap_id_mapping = true
override_homedir = /home/AD/%u
override_shell = /bin/bash
# access controls
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
# performance
ldap_referrals = false
I've tried a few config changes to fix the issue, but none has fixed it,
including:
ldap_use_tokengroups = False
ldap_group_objectsid = objectSID
ldap_user_objectsid = objectSID
ldap_deref_threshold = 0
ldap_schema = rfc2307bis
Given Red Hat support hasn't been able to fix our issue, what else can I do?
Cheers,
John
--
John Beranek To generalise is to be an idiot.
http://redux.org.uk/ -- William Blake
8 years, 5 months
ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder
HI!
Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with
StartTLS or LDAPS using client certs?
In a project they have certs in all systems anyway (because of using puppet)
and I'd like to let the sssd instances on all the systems authenticate to the
LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid
having to set/configure passwords for each system's sssd.
Ciao, Michael.
8 years, 6 months
login with shortname in AD cross realm
by Longina Przybyszewska
Hi,
Is it possible to configure SSSD to make possible to login with short names across trusty domains?
The sAMAccount name attribute in AD are unique, and all users have Posix attributes assigned so there is no risk for name mismatch between different domains.
I use ad provider and all default setting for AD backend(gc_search_enable) ;
If use_fully_qualified_names = False only users from client machines native domain can login with shortnames; Users from other domains are "unknown".
I can successfully make ldapsearch to Global Catalog in top domain for login names=shortname for users from different domains:
ldapsearch -H ldap://ldap.c.example.com:3268 -Y GSSAPI -N -b "dc=c,dc=example,dc=org" "(&(objectClass=user)(sAMAccountName=user))"
user = user-a from a.c.example.org
user = user-b from b.c.example.org
best,
Longina
8 years, 7 months
AutoFS and variables
by Brendan Kearney
i want to have an automount configured so that
nas.bpk2.com:/export/music is mounted on /home/<username>/Music. i want
to use the HOME variable, but several attempts have not gotten the job
done. i have tried $HOME/Music, ${HOME}/Music, and {$HOME}/Music, and
none have worked.
what is the correct way to use a variable with AutoFS and SSSD? i have
used the hard values to get things working for my id, but want to have
this work for all users.
dn:
automountKey=/home/brendan/Music,automountMapName=auto.shares,cn=autofs,ou=Daemons,dc=bpk2,dc=com
automountinformation: nas.bpk2.com:/export/music
automountkey: /home/brendan/Music
description: music
objectclass: automount
objectclass: top
thanks,
brendan
8 years, 7 months
pam_sss logging and fail2ban
by Orion Poplawski
I'm looking for some help with this problem. I'd like to have fail2ban block
systems trying to authenticate via smtp or imap. However, for known users I get:
Jan 28 13:33:36 mail auth: pam_unix(dovecot:auth): authentication failure;
logname= uid=0 euid=0 tty=dovecot ruser=frank rhost=189.22.108.130
user=known_user
Jan 28 13:33:37 mail auth: pam_sss(dovecot:auth): authentication failure;
logname= uid=0 euid=0 tty=dovecot ruser=frank rhost=189.22.108.130 user=known_user
and for unknown users I get:
Jan 28 13:27:16 mail auth: pam_unix(dovecot:auth): authentication failure;
logname= uid=0 euid=0 tty=dovecot ruser=unknown_user rhost=189.22.108.130
so I can't key off of the pam_unix messages because that will lock out known
users, and keying off of pam_sss will only block attacks that guess a correct
username. Is there some way I can get pam_sss to log the unknown user attempts?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 http://www.nwra.com
8 years, 8 months
sssd-ad GPO not working
by Koen de Boeve
Hi all,
I am having issues getting remote and local GPO restrictions to work
I am using:
- 2 Samba 4.1.16 PDC's on CentOS 6.5 64bit
- 1 CentOS 7 installation with sssd 1.12.3. as testclient.
other GPO's are working fine for windows machines.
Authentication against the Samba4 Domain on the testclient with sssd is
working fine too.
I am now trying to use a Group Policy to deny access for 'testuser' for
both local login as well as remote login ( ssh and xrdp )
This is not working at all.
I created a GPO which I linked to OU=Linux,OU=Servers,DC=mydomain,DC=com
in there, I have one machine, called ITCOPY.
the GPO sets Deny Logon and Deny Remote Desktop access for MYDOMAIN\testuser
The GPO is set to be Enforced and the Security target is Authenticated
Users.
as you can see, I set access_control back to permissive, so I should see
some indication that the GPO is working in the log file.
Any help would be much appreciated!
Regards, Koen
My sssd conf:
# =========================================
[sssd]
domains = mydomain.com
config_file_version = 2
services = nss, pam
[domain/mydomain.com]
ad_domain = mydomain.com
ad_server = pdc.mydomain.com
krb5_realm = mydomain.com
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
debug_level = 9
enumerate = True
access_provider = ad
#ad_access_filter =
(&(memberOf=CN=linuxadmin,CN=Users,DC=mydomain,DC=com)(unixHomeDirectory=*))
id_provider = ad
auth_provider = ad
chpass_provider = ad
ad_gpo_access_control = permissive
ldap_schema = ad
dyndns_update = true
dyndns_refresh_interval = 43200
dyndns_update_ptr = true
dyndns_ttl = 3600
ad_gpo_map_remote_interactive = +xrdp-sesman
# =====================================
This is part of the sssd log file:
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_access_send]
(0x0400): service sshd maps to Remote Interactive
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_access_send]
(0x4000): server_hostname from uri: pdc.mydomain.com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_connect_done] (0x0400): sam_account_name is ITCOPY$
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_site_dn_retrieval_done] (0x0400): som_list[0]->som_dn is
OU=Linux,OU=Servers,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_site_dn_retrieval_done] (0x0400): som_list[1]->som_dn is
OU=Servers,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_site_dn_retrieval_done] (0x0400): som_list[2]->som_dn is
DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_site_dn_retrieval_done] (0x0400): som_list[3]->som_dn is
cn=Default-First-Site-Name,cn=Sites,CN=Configuration,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_som_attrs_done] (0x4000): gpoptions attr not found or has no
value; defaults to 0
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x0400): som_dn:
OU=Linux,OU=Servers,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x4000): gplink_list[0]:
[cn={D49E3752-2ECB-42F6-A418-2AE1F3092929},cn=policies,cn=system,DC=mydomain,DC=com;
2]
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_som_attrs_done] (0x4000): gpoptions attr not found or has no
value; defaults to 0
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x0400): som_dn:
OU=Servers,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x4000): gplink_list[0]:
[cn={691A69C9-FEF3-4A42-8129-64E8741F9D2C},cn=policies,cn=system,DC=mydomain,DC=com;
1]
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x4000): ignored gpo skipped
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_som_attrs_done] (0x4000): gpoptions attr not found or has no
value; defaults to 0
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x0400): som_dn: DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_gplink_list] (0x4000): gplink_list[0]:
[CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mydomain,DC=com;
0]
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[0]->gpo_dn:
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[1]->gpo_dn:
cn={D49E3752-2ECB-42F6-A418-2AE1F3092929},cn=policies,cn=system,DC=mydomain,DC=com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): populating attrs for gpo_guid:
{31B2F340-016D-11D2-945F-00C04FB984F9}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_extract_smb_components] (0x4000): input_path:
\\mydomain.com\sysvol\mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): smb_server: smb://pdc.mydomain.com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): smb_share: /sysvol
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): smb_path:
/mydomain.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): gpo_func_version: 2
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): gpo_flags: 0
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_parse_machine_ext_names] (0x4000): num_gpo_cse_guids: 3
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[0] is
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[1] is
{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[2] is
{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): populating attrs for gpo_guid:
{D49E3752-2ECB-42F6-A418-2AE1F3092929}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_extract_smb_components] (0x4000): input_path:
\\mydomain.com\SysVol\mydomain.com\Policies\{D49E3752-2ECB-42F6-A418-2AE1F3092929}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): smb_server: smb://pdc.mydomain.com
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): smb_share: /SysVol
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): smb_path:
/mydomain.com/Policies/{D49E3752-2ECB-42F6-A418-2AE1F3092929}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): gpo_func_version: 2
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_get_gpo_attrs_done] (0x4000): gpo_flags: 0
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_parse_machine_ext_names] (0x4000): num_gpo_cse_guids: 1
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_parse_machine_ext_names] (0x4000): gpo_cse_guids[0] is
{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl
candidate_gpo_guid:{31B2F340-016D-11D2-945F-00C04FB984F9}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_filter_gpos_by_dacl] (0x4000): GPO not applicable to target per
security filtering
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_filter_gpos_by_dacl] (0x4000): examining dacl
candidate_gpo_guid:{D49E3752-2ECB-42F6-A418-2AE1F3092929}
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_filter_gpos_by_dacl] (0x4000): GPO not applicable to target per
security filtering
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]]
[ad_gpo_process_gpo_done] (0x0400): no applicable gpos found after dacl
filtering
(Fri Jan 23 14:21:23 2015) [sssd[be[mydomain.com]]] [ad_gpo_access_done]
(0x0400): GPO-based access control successful.
8 years, 8 months
sssd cache detection ?
by Ash Nand
Hi there.
Does sssd export any library/function which would allow one to test if the
dataset *was* coming from a cache and NOT the real source (assuming source
outage)?
I have a LDAP backend provider here with a generous cache timeout. I was
wondering if it would be possible to tap somewhere , to achieve something
equivalent to `getent -s sss passwd xxx` but only if/when user xxx was
cached by sssd and in offline mode.
In other words detect when sssd is in offline mode, the sssd cache is
transparently servicing clients without resorting to parsing log files.
thkx
-ash
8 years, 8 months
SSSD Kerberos (kinit)
by Günther J. Niederwimmer
Hello,
I play now same days with sssd, bur on my Installation, it is not possible to
config ssd for a "krb5_renew_interval ="
I tested CentOs 7 and SUSE but this is not working ?
Can any help me to find a correct sssd.conf or is this broken in sssd?
--
mit freundlichen Grüßen / best Regards,
Günther J. Niederwimmer
8 years, 8 months
