Password Must Change using SSSD in Samba 4.1.10
by Ashish Yadav
Hi,
I am trying to implement the *password must change at next logon* in CentOS
6.5 client using sssd 1.11.6 where Samba 4.1.10 is my backend server.
Here are the list of things which I have done,
1. I have setup the CentOS to do the Domain login using sssd service. I can
able to login into the CentOS client using Domain user's credentials from
display
and from SSH also, no problem at all.
2. Next thing which I want to implement is that password must change
feature into Samba 4.1.10 server. To do that, I have been using Windows 7
ultimate
which is already in Domain and I am using RSAT tools for users and groups
where I have a option to check "password must change at next logon" option
for particular user.
After doing that Windows machine is honoring this and telling user to
change the password and allowing user to login after changing the password.
3. As far as the CentOS client is concerned, it was not honoring the
password must change and allowing user to login without asking for password
change using sssd with current password.
Here is the configuration file of sssd service,
[sssd]
config_file_version = 2
services = nss, pam
domains = EXAMPLE
sbus_timeout = 30
[nss]
filter_users = root
filter_groups = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
offline_credentials_expiration = 0
[domain/EXAMPLE]
entry_cache_timeout = 600
entry_cache_group_timeout = 600
min_id = 1000
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_schema = rfc2307bis
ldap_uri = ldap://smbad.intra.example.com:390/
ldap_search_base = dc=intra,dc=example,dc=com
cache_credentials = true
krb5_server = smbad.intra.example.com:8880
krb5_realm= INTRA.EXAMPLE.COM <http://intra.example.com/>
ldap_default_bind_dn = cn=admin,dc=intra,dc=example,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = 6pNEn7Eo3zmz9MxciGLx
4. I have also tried to achieve above thing using command line tool
"pdbedit" but without any luck. Here is the link <
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/passdb.html#pd...
>
which I have followed.
Please share your thoughts in order to help me and move forward to solve
this problem.
Thanks very much and regards,
Ashishkumar S. Yadav
9 years, 3 months
- 3
- 4
Unable to kill SSSD processes
by Patrick Mayo
Hello, Everyone!
I'm encountering an interesting issue on one of our production systems.
Because it's production, I'm trying not to reboot the system if not needed.
The core issue being that RDS ldap users are currently unable to log into
this box at all due to SSSD being in some sort of funk state. The
/var/log/secure file shows a lot of pam_sss(crond:session): Request to sssd
failed. Connection refused errors.
A status check against the service shows that it is running, but attempting
a stop results in a failed attempt.
[root@server~]# service sssd status
sssd (pid 13504) is running...
[root@server~]# service sssd stop
Stopping sssd: [FAILED]
ps shows that the following results and attempting to kill -9 any of them
doesn't seem to work. No error is reported, the processes just persist past
the kill -9 order.
[root@server~]# ps aux | grep sss | grep -v grep
root 7532 0.0 0.0 150828 2168 ? D Jan03 0:00
/usr/libexec/sssd/sssd_nss -d 0 --debug-to-files
root 13504 0.1 0.0 95808 2928 ? D Jan05 1:44
/usr/sbin/sssd -f -D
root 16390 0.0 0.0 150784 2172 ? D Jan03 0:00
/usr/libexec/sssd/sssd_pam -d 0 --debug-to-files
root 24156 0.0 0.0 179396 5428 ? D 2014 8:21
/usr/libexec/sssd/sssd_be -d 0 --debug-to-files --domain default
root 29972 0.0 0.0 58988 544 ? D Jan05 0:00 rm -f
/var/lib/sss/db/cache_default.ldb /var/lib/sss/db/config.ldb
/var/lib/sss/db/sssd.ldb
Also, whenever I try to do anything with the /var/lib/sss/db/ directory or
the files within it, the console becomes unresponsive. This even happens if
I ls the path and ctrl+c won't break commands issued to this location and
the console locks up.
I'm still new to strace, but I used that while trying to ls
/var/lib/sss/db/ and the results stopped with getdents(3, being the final
entry and the same unresponsive console issue as before. I also setup
strace to monitor the pids of the sssd related processes with commands
similar to the one below, but the output files aren't being populated with
anything.
strace -s 2000 -o /path/to/file/out.txt -fp 12345 &
/var/log/messages doesn't really seem to include anything that relates to
this issue.
/var/log/sssd/sssd_nss.log and /var/log/sssd/sssd_pam.log are both empty
with no archives
/var/log/sssd/sssd_[domain].log has a timestamp of Jan 4th, but is empty.
The previous archived log shows the following entries which occurred the
same day that ps shows some of the sssd processes started on.
[root@eh01db01 ~]# zcat /var/log/sssd/sssd.log.1.gz
(Sat Jan 3 05:19:16 2015) [sssd] [mt_svc_sigkill] (0): [default][24156] is
not responding to SIGTERM. Sending SIGKILL.
(Sat Jan 3 05:22:56 2015) [sssd] [mt_svc_sigkill] (0): [nss][24159] is not
responding to SIGTERM. Sending SIGKILL.
(Sat Jan 3 05:34:16 2015) [sssd] [mt_svc_sigkill] (0): [pam][24160] is not
responding to SIGTERM. Sending SIGKILL.
This is a new issue that hasn't been seen on any of our systems before. I'm
hoping to find what the root cause is so that if it occurs again we'll know
how to react, or, better yet, can preemptively fix other systems that may
be effected. I'm sort of at a loss on where to proceed from here. Rebooting
seems like an option that may fix the issue if sssd starts without issue,
which would be great, but it still leaves me wondering what the actual
problem really is. Any advice is greatly appreciated!
Thanks,
9 years, 3 months
- 4
- 3
Attempting to Get sssd to Work With Samba 4.3 Active Directory
by Scott Harvey`
Hi,
I am trying to Authenticate Linux Users against the Samba 4.3 Active
Directory.
The Wiki reference I used is:
https://wiki.samba.org/index.php?title=Local_user_management_and_authenti...
and
https://wiki.samba.org/index.php/Using_RFC2307_on_a_Samba_DC#What_is_RFC2...
The Linux Server configuration is:
[root@netserver02 ~]# cat /etc/redhat-release
CentOS release 6.6 (Final)
[root@netserver02 ~]# uname -a
Linux netserver02.harvey.net 2.6.32-504.3.3.el6.x86_64 #1 SMP Wed Dec 17
01:55:02 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
I used the Method 1: Connecting to AD via Kerberos (recommended)
explained in "Local_user_management_and_authentication"
wiki page.
There was a time where this worked i.e. I was able to read back Active
Directory Objects i.e. users and
groups. Although I have not gotten this to work since this was a few
days ago.
It seems like I may have turned on the ldapd communication, CentOS 6 has
a gui for configuration how
to authenticate users I used the plus manual configuration file edits
and I loaded up the sssd cache.
I was never able to repeat this and I the Unix Id's did not match what I was
entering for the Unix Attributes in the Windows 8.1 RSAT tools.
The user id's and group id's had very high numbers i.e. up in the 70000's
I followed the steps for sssd configuration in
"Local_user_management_and_authentication"
Created a service principle user i.e used the domain controller server
name as the account.
and all of the.
The domain was provisioned with the --use-rfc2307 see
"Using_RFC2307_on_a_Samba_DC" This
describes what you need to do to set up the Active Directory controller
to create records for a "nis"
server. I confirmed all 55 records were loaded in with the correct
names for the host domain
and nisdomain names, actually the samba-tool provision now does that
when the --use-rfc2307 is one
of the options.
I attempted to use getent passwd getent group to see if was able to see
any of the users or groups from
the active directory. I was not able to. Here is the log of sssd -d 3 -i
Note samba is acting as a DNS server it works with my workstations and
laptops using dhcp.
Version of sssd that is installed:
[root@netserver02 convTmpYpSetupToDomain]# sssd --version
1.11.6
The ssd configuration file is shown after this log transaction.
[root@netserver02 convTmpYpSetupToDomain]# sssd -d 4 -i -c
/etc/sssd/sssd.conf
(Sat Jan 3 20:04:34 2015) [sssd] [get_ping_config] (0x0100): Time
between service pings for [netserver02.harvey.net]: [10]
(Sat Jan 3 20:04:34 2015) [sssd] [get_ping_config] (0x0100): Time
between SIGTERM and SIGKILL for [netserver02.harvey.net]: [60]
(Sat Jan 3 20:04:34 2015) [sssd] [start_service] (0x0100): Queueing
service netserver02.harvey.net for startup
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_res_get_opts] (0x0100): Lookup order: ipv4_first
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[recreate_ares_channel] (0x0100): Initializing new c-ares channel
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[monitor_common_send_id] (0x0100): Sending ID:
(%BE_netserver02.harvey.net,1)
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sss_names_init_from_args] (0x0100): Using re
[(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s].
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sss_fqnames_init] (0x0100): Found the pattern for domain name
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_get_common_options] (0x0100): No AD server set, will use service
discovery!
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_get_common_options] (0x0100): Setting domain case-insensitive
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_failover_init] (0x0100): No primary servers defined, using service
discovery
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[_ad_servers_init] (0x0100): Added service discovery for AD
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_dyndns_init] (0x0100): Dynamic DNS updates are on. Checking for
nsupdate..
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_set_ad_id_options] (0x0100): Option krb5_realm set to
NETSERVER02.HARVEY.NET
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_set_ad_id_options] (0x0100): Option ldap_krb5_keytab set to
/etc/krb5.sssd.keytab
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sdap_set_sasl_options] (0x0100): Will look for
netserver02.harvey.net(a)NETSERVER02.HARVEY.NET in /etc/krb5.sssd.keytab
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sdap_set_sasl_options] (0x0100): Option ldap_sasl_authid set to
netserver02$
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sdap_set_sasl_options] (0x0100): Option ldap_sasl_realm set to HARVEY.NET
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_set_search_bases] (0x0100): Search base not set. SSSD will attempt
to discover it later, when connecting to the LDAP server.
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_get_auth_options] (0x0100): Option krb5_server set to (null)
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_get_auth_options] (0x0100): Option krb5_realm set to
NETSERVER02.HARVEY.NET
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_get_auth_options] (0x0100): Option krb5_use_kdcinfo set to true
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[check_and_export_options] (0x0100): No KDC explicitly configured, using
defaults.
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[check_and_export_options] (0x0100): No kpasswd server explicitly
configured, using the KDC or defaults.
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[check_and_export_options] (0x0100): ccache is of type FILE
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_process_init] (0x0080): No SUDO module provided for
[netserver02.harvey.net] !!
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_process_init] (0x0080): No autofs module provided for
[netserver02.harvey.net] !!
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_process_init] (0x0020): No selinux module provided for
[netserver02.harvey.net] !!
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_process_init] (0x0020): No host info module provided for
[netserver02.harvey.net] !!
(Sat Jan 3 20:04:34 2015) [sssd] [client_registration] (0x0100):
Received ID registration: (%BE_netserver02.harvey.net,1)
(Sat Jan 3 20:04:34 2015) [sssd] [mark_service_as_started] (0x0100):
Now starting services!
(Sat Jan 3 20:04:34 2015) [sssd] [get_ping_config] (0x0100): Time
between service pings for [nss]: [10]
(Sat Jan 3 20:04:34 2015) [sssd] [get_ping_config] (0x0100): Time
between SIGTERM and SIGKILL for [nss]: [60]
(Sat Jan 3 20:04:34 2015) [sssd] [start_service] (0x0100): Queueing
service nss for startup
(Sat Jan 3 20:04:34 2015) [sssd] [get_ping_config] (0x0100): Time
between service pings for [pam]: [10]
(Sat Jan 3 20:04:34 2015) [sssd] [get_ping_config] (0x0100): Time
between SIGTERM and SIGKILL for [pam]: [60]
(Sat Jan 3 20:04:34 2015) [sssd] [start_service] (0x0100): Queueing
service pam for startup
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[id_callback] (0x0100): Got id ack and version (1) from Monitor
(Sat Jan 3 20:04:34 2015) [sssd[pam]] [monitor_common_send_id]
(0x0100): Sending ID: (pam,1)
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [monitor_common_send_id]
(0x0100): Sending ID: (nss,1)
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [sss_names_init_from_args]
(0x0100): (Sat Jan 3 20:04:34 2015) [sssd[pam]]
[sss_names_init_from_args] (0x0100): Using re
[(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
Using re
[(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))].
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [sss_fqnames_init] (0x0100): (Sat
Jan 3 20:04:34 2015) [sssd[pam]] [sss_fqnames_init] (0x0100): Using fq
format [%1$s@%2$s].
Using fq format [%1$s@%2$s].
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [sss_fqnames_init] (0x0100): (Sat
Jan 3 20:04:34 2015) [sssd[pam]] [sss_fqnames_init] (0x0100): Found the
pattern for domain name
Found the pattern for domain name
(Sat Jan 3 20:04:34 2015) [sssd[pam]] [dp_common_send_id] (0x0100):
Sending ID to DP: (1,PAM)
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [dp_common_send_id] (0x0100):
Sending ID to DP: (1,NSS)
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_client_init] (0x0100): Set-up Backend ID timeout [0x1361080]
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_client_init] (0x0100): Set-up Backend ID timeout [0x137ae30]
(Sat Jan 3 20:04:34 2015) [sssd[pam]] [responder_set_fd_limit]
(0x0100): Maximum file descriptors set to [8192]
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[client_registration] (0x0100): Cancel DP ID timeout [0x1361080]
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[client_registration] (0x0100): Added Frontend client [PAM]
(Sat Jan 3 20:04:34 2015) [sssd] [client_registration] (0x0100):
Received ID registration: (pam,1)
(Sat Jan 3 20:04:34 2015) [sssd[pam]] [dp_id_callback] (0x0100): Got id
ack and version (1) from DP
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Sat Jan 3 20:04:34 2015) [sssd[pam]] [id_callback] (0x0100): Got id
ack and version (1) from Monitor
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[resolv_getsrv_send] (0x0100): Trying to resolve SRV record of
'_ldap._tcp.netserver02.harvey.net'
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[resolv_discover_srv_done] (0x0040): SRV query failed [4]: Domain name
not found
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[fo_set_port_status] (0x0100): Marking port 0 of server '(no name)' as
'not working'
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[resolve_srv_done] (0x0040): Unable to resolve SRV [1432158225]: SRV
record not found
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[set_srv_data_status] (0x0100): Marking SRV lookup of service 'AD' as
'not resolved'
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_resolve_server_process] (0x0080): Couldn't resolve server (SRV
lookup meta-server), resolver returned (1432158225)
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[fo_resolve_service_send] (0x0020): No available servers for service 'AD'
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5
[Input/output error])
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[ad_subdomains_get_conn_done] (0x0080): No AD server is available,
cannot get the subdomain list while offline
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [responder_set_fd_limit]
(0x0100): Maximum file descriptors set to [8192]
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[client_registration] (0x0100): Cancel DP ID timeout [0x137ae30]
(Sat Jan 3 20:04:34 2015) [sssd[be[netserver02.harvey.net]]]
[client_registration] (0x0100): Added Frontend client [NSS]
(Sat Jan 3 20:04:34 2015) [sssd] [client_registration] (0x0100):
Received ID registration: (nss,1)
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [dp_id_callback] (0x0100): Got id
ack and version (1) from DP
(Sat Jan 3 20:04:34 2015) [sssd[nss]] [id_callback] (0x0100): Got id
ack and version (1) from Monitor
(Sat Jan 3 20:04:44 2015) [sssd] [service_send_ping] (0x0100): Pinging
netserver02.harvey.net
(Sat Jan 3 20:04:44 2015) [sssd] [service_send_ping] (0x0100): Pinging nss
(Sat Jan 3 20:04:44 2015) [sssd] [service_send_ping] (0x0100): Pinging pam
(Sat Jan 3 20:04:44 2015) [sssd] [ping_check] (0x0100): Service
netserver02.harvey.net replied to ping
(Sat Jan 3 20:04:44 2015) [sssd] [ping_check] (0x0100): Service pam
replied to ping
(Sat Jan 3 20:04:44 2015) [sssd] [ping_check] (0x0100): Service nss
replied to ping
(Sat Jan 3 20:04:54 2015) [sssd] [service_send_ping] (0x0100): Pinging
netserver02.harvey.net
(Sat Jan 3 20:04:54 2015) [sssd] [service_send_ping] (0x0100): Pinging nss
(Sat Jan 3 20:04:54 2015) [sssd] [service_send_ping] (0x0100): Pinging pam
(Sat Jan 3 20:04:54 2015) [sssd] [ping_check] (0x0100): Service
netserver02.harvey.net replied to ping
(Sat Jan 3 20:04:54 2015) [sssd] [ping_check] (0x0100): Service pam
replied to ping
(Sat Jan 3 20:04:54 2015) [sssd] [ping_check] (0x0100): Service nss
replied to ping
(Sat Jan 3 20:05:04 2015) [sssd] [service_send_ping] (0x0100): Pinging
netserver02.harvey.net
(Sat Jan 3 20:05:04 2015) [sssd] [service_send_ping] (0x0100): Pinging nss
(Sat Jan 3 20:05:04 2015) [sssd] [service_send_ping] (0x0100): Pinging pam
(Sat Jan 3 20:05:04 2015) [sssd] [ping_check] (0x0100): Service
netserver02.harvey.net replied to ping
(Sat Jan 3 20:05:04 2015) [sssd] [ping_check] (0x0100): Service nss
replied to ping
(Sat Jan 3 20:05:04 2015) [sssd] [ping_check] (0x0100): Service pam
replied to ping
(Sat Jan 3 20:05:14 2015) [sssd] [service_send_ping] (0x0100): Pinging
netserver02.harvey.net
(Sat Jan 3 20:05:14 2015) [sssd] [service_send_ping] (0x0100): Pinging nss
(Sat Jan 3 20:05:14 2015) [sssd] [service_send_ping] (0x0100): Pinging pam
(Sat Jan 3 20:05:14 2015) [sssd] [ping_check] (0x0100): Service
netserver02.harvey.net replied to ping
(Sat Jan 3 20:05:14 2015) [sssd] [ping_check] (0x0100): Service nss
replied to ping
(Sat Jan 3 20:05:14 2015) [sssd] [ping_check] (0x0100): Service pam
replied to ping
(Sat Jan 3 20:05:24 2015) [sssd] [service_send_ping] (0x0100): Pinging
netserver02.harvey.net
(Sat Jan 3 20:05:24 2015) [sssd] [service_send_ping] (0x0100): Pinging nss
(Sat Jan 3 20:05:24 2015) [sssd] [service_send_ping] (0x0100): Pinging pam
(Sat Jan 3 20:05:24 2015) [sssd] [ping_check] (0x0100): Service
netserver02.harvey.net replied to ping
(Sat Jan 3 20:05:24 2015) [sssd] [ping_check] (0x0100): Service nss
replied to ping
(Sat Jan 3 20:05:24 2015) [sssd] [ping_check] (0x0100): Service pam
replied to ping
^C(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit_signal] (0x0040):
Monitor received Interrupt: terminating children
(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit] (0x0040): Returned with: 0
(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit] (0x0020): Terminating
[pam][25954]
(Sat Jan 3 20:05:28 2015) [sssd[be[netserver02.harvey.net]]]
[sbus_dispatch] (0x0080): (Sat Jan 3 20:05:28 2015) [sssd]
[monitor_quit] (0x0020): Connection is not open for dispatching.
Child [pam] exited gracefully
(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit] (0x0020): Terminating
[nss][25953]
(Sat Jan 3 20:05:28 2015) [sssd[be[netserver02.harvey.net]]]
[sbus_dispatch] (0x0080): Connection is not open for dispatching.
(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit] (0x0020): Child [nss]
exited gracefully
(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit] (0x0020): Terminating
[netserver02.harvey.net][25951]
(Sat Jan 3 20:05:28 2015) [sssd] [monitor_quit] (0x0020): Child
[netserver02.harvey.net] exited gracefully
[root@netserver02 convTmpYpSetupToDomain]#
contents of sssd.conf
--------------------------------------------------------------------
[sssd]
services = nss, pam
config_file_version = 2
domains = netserver02.harvey.net
#domains = default
debug_level = 2
#
filter_users_in_groups = false
#
#ldap_user_principal = netserver02$.harvey.net(a)HARVEY.NET
#
#ldap_referrals = true
#
[nss]
#
allowed_shells = /bin/bash
shell_fallback = /bin/bash
#
[pam]
[domain/netserver02.harvey.net]
#[domain/default]
# Using id_provider=ad sets the best defaults on its own
id_provider = ad
# In sssd, the default access provider is always 'permit'. The AD access
# provider by default checks for account expiration
access_provider = ad
#
#dyndns_update=false
# Uncomment to use POSIX attributes on the server
ldap_id_mapping=false
#ad_enable_dns_sites = true
# Uncomment if the client machine hostname doesn't match the
# computer object on the DC.
#ad_hostname = dc1.samdom.example.com
ad_hostname = netserver02.harvey.net
#Uncomment if DNS SRV resolution is not working
#ad_server = netserver02.harvey.net
# Uncomment if the domain section is named differently than your Samba
domain
#ad_domain = harvey.net
# Enumeration is discouraged for performance reasons.
#enumerate = true
# location of the keytab
krb5_keytab=/etc/krb5.sssd.keytab
--------------------------------------------------------------------------------------------------------------------
How do you get this to work?
It seems like this is the way to go for using a single user data base
for Windows and Linux
it seems like it wants to work.
Scott Harvey
9 years, 3 months
- 3
- 6