March 2017 - sssd-users - Fedora mailing-lists

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

Does anyone use id_provider=local ?
by Jakub Hrozek 16 Oct '17

16 Oct '17

Hi, are there any SSSD users who actively use a configuration with: id_provider=local ? If so, what is your use-case? We're considering deprecating and eventually removing this provider upstream. The replacemant for id_provider=local would be id_provider=files: https://fedorahosted.org/sssd/wiki/DesignDocs/FilesProvider which is already under review and later extension of the SSSD's D-Bus interface to allow manipulating custom user attributes. My current plan for deprecating the local provider is to only build the provider and the tools around it if a configure-time flag is provided. This flag would be disabled by default. Then, if noone complains, eventually just remove the code.

3 5

Authenticating to RODC using SSSD
by Abhijit Tikekar 15 May '17

15 May '17

Hi, Has anyone had any success while setting up SSSD with RODC AD Server? We are setting this up on CentOS 6.8 machines but doesn't seem to work. Computer object is created and replicated to RODC. Verified that all configuration file parameters are identical to the ones mentioned in the link below. https://access.redhat.com/discussions/2838371 I assume we still have to join the server to RODC? Is the joining process still the same as we do for a Writable DC. When using "net ads join" I get the following error: Failed to join domain: Failed to set account flags for machine account (NT_STATUS_NOT_SUPPORTED) in the logs, we also get the following( Debug level set to 7) (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [sdap_set_sasl_options] (0x0100): Will look for testdmzlin(a)X.Y.LOCAL in default keytab (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [select_principal_from_keytab] (0x0200): trying to select the most appropriate principal from keytab (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [find_principal_in_keytab] (0x0400): No principal matching testdmzlin(a)X.Y.LOCAL found in keytab. (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [find_principal_in_keytab] (0x0400): No principal matching TESTDMZLIN$(a)X.Y.LOCAL found in keytab. (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [find_principal_in_keytab] (0x0400): No principal matching host/testdmzlin(a)X.Y.LOCAL found in keytab. (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [find_principal_in_keytab] (0x0400): No principal matching *$(a)X.Y.LOCAL found in keytab. (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [find_principal_in_keytab] (0x0400): No principal matching host/*(a)X.Y.LOCAL found in keytab. (Tue Feb 14 11:20:42 2017) [sssd[be[x.y.local]]] [find_principal_in_keytab] (0x0400): No principal matching host/*@(null) found in keytab. But if i try to query this RODC using "ldapsearch" it works. ldapsearch -H ldap://RODC_ServerName.x.y.local/ -Y GSSAPI -N -b "dc=x,dc=y,dc=local" "(&(objectClass=user)(sAMAccountName=firstname.lastname))" What else can I check to troubleshoot this issue? Thanks, ~ Abhi

3 12

'no primary group ID provided' when trying to use ldap mode against AD
by Daniel Hermans 24 Apr '17

24 Apr '17

Hi, i'd like to use sssd in ldap mode against Active Directory so I have defined: id_provider = ldap auth_provider = ldap Yes krb5 would be better but i only have a BIND account and cannot add computer objects. This 'should' be possible - it works with nslcd. As I don't have Posix attributes i'm using: ldap_id_mapping = true fallback_homedir = /home/%d/%u default_shell = /bin/bash sssd can bind with LDAPS and can seem to get user info from the domain: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users The UID mapping seems to succeed: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID But it gets no further with this message: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ). Any ideas what I'm doing wrong? Is this possible? Various (old) posts suggests it is. This was first (incorrectly) posted to sssd-devel, Jakub Hrozek updated and told me to define ldap_idmap_default_domain_sid so sssd no longer reports this: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain Thanks in advance!!

4 9

adcli -v info SEGVs
by Joakim Tjernlund 30 Mar '17

30 Mar '17

On and off I see adcli 0.8.2 SEGV, I can provoke SEGV using adcli -v info INFINERA.COM: adcli -v info INFINERA.COM * Discovering domain controllers: _ldap._tcp.INFINERA.COM * Sending netlogon pings to domain controller: cldap://10.120.34.22 * Sending netlogon pings to domain controller: cldap://10.220.32.12 * Sending netlogon pings to domain controller: cldap://10.120.2.22 * Sending netlogon pings to domain controller: cldap://10.210.0.22 * Sending netlogon pings to domain controller: cldap://10.120.34.21 * Received NetLogon info from: PA-DC02.infinera.com ! Could not parse NetLogon discovery data Segmentation fault (core dumped) adcli -v info INFINERA.COM * Discovering domain controllers: _ldap._tcp.INFINERA.COM * Sending netlogon pings to domain controller: cldap://10.100.98.21 * Sending netlogon pings to domain controller: cldap://10.100.130.21 * Sending netlogon pings to domain controller: cldap://10.120.34.22 * Sending netlogon pings to domain controller: cldap://10.220.32.12 * Sending netlogon pings to domain controller: cldap://10.120.2.22 * Received NetLogon info from: SV-DC01.infinera.com * Received NetLogon info from: SV-DC03.infinera.com * Received NetLogon info from: PA-DC02.infinera.com ! Could not parse NetLogon discovery data Segmentation fault (core dumped) and here is one that didn't SEGV: adcli -v info INFINERA.COM * Discovering domain controllers: _ldap._tcp.INFINERA.COM * Sending netlogon pings to domain controller: cldap://10.210.34.21 * Sending netlogon pings to domain controller: cldap://10.220.0.11 * Sending netlogon pings to domain controller: cldap://10.100.130.21 * Sending netlogon pings to domain controller: cldap://10.220.32.14 * Sending netlogon pings to domain controller: cldap://10.220.32.12 * Received NetLogon info from: se-dc01.infinera.com [domain] domain-name = infinera.com domain-short = INFINERA domain-forest = infinera.com domain-controller = se-dc01.infinera.com domain-controller-site = Sweden domain-controller-flags = gc ldap ds kdc timeserv closest writable full-secret ads-web domain-controller-usable = yes domain-controllers = se-dc01.infinera.com in-dc01.infinera.com sv-dc03.infinera.com ch-dc02.infinera.com ch- dc01.infinera.com sv-dc02.infinera.com uk-dc01.infinera.com in-dc02.infinera.com md-dc01.infinera.com sv- dc01.infinera.com sv-dc04.infinera.com pa-dc02.infinera.com md-dc02.infinera.com pa-dc01.infinera.com se- dc02.infinera.com [computer] computer-site = Sweden Any ideas?

2 4

Weird issue with SSSD and OCSERV
by Michael Leer 29 Mar '17

29 Mar '17

I getting a weird issue with SSSD, we are using SSSD for AD auth, we are using ocserv for VPN and it doesn't always appear to check SSSD, I am seeing it check PAM_unix get the auth failure and then simply return the failure instead of trying SSSD, if I restart the service then for a few requests will use PAM_sss (SSSD) and then will begin to simply use pam_unix again When I restart the service it appears to work correctly for a moment Mar 29 16:42:31 ip-10-0-21-4 m[10038]: pam_unix(ocserv:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=X.X.X.X user=UserY Mar 29 16:42:32 ip-10-0-21-4 m[10038]: pam_sss(ocserv:auth): authentication success; logname= uid=0 euid=0 tty= ruser= rhost=X.X.X.X user=UserY Then it will get the following after a few minutes Mar 29 17:03:03 ip-10-0-21-4 m[10038]: pam_unix(ocserv:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=X.X.X.X user=UserX Mar 29 17:03:05 ip-10-0-21-4 m[10038]: PAM authenticate error: Authentication failure Mar 29 17:03:05 ip-10-0-21-4 m[10038]: PAM-auth pam_auth_pass: Authentication failure michael.leer(a)crownpeak.com Switchboard:+44 (0)20 7019 4700 crownpeak.com Forrester Wave for WCM 2017 Crownpeak, Studio 1001 Highgate Studios, 53-79 Highgate Road, London, NW5 1TL Registered in England: No. 3592714, VAT No. 625574723

2 1

KRB5CCNAME hardcoded?
by Joakim Tjernlund 29 Mar '17

29 Mar '17

I have tried to set KRB5CCNAME to something predicable, both in sssd.conf(krb5_ccname_template = FILE:/tmp/krb5cc_:%U) and krb5.conf(default_ccache_name = FILE:/tmp/krb5cc_%{uid}) but what ever I do KRB5CCNAME reads: KRB5CCNAME=FILE:/tmp/krb5cc_<UID>_ryxWRPDHZD Is the name hardcoded nowadays(in sssd 1.15.2)? Jocke

2 5

sssd on wheezy
by mourik jan heupink 28 Mar '17

28 Mar '17

Hi, I'm trying to get sssd 1.8.4 (comes with debian wheezy) to work with samba4. As this is an older sssd version, I'll have to use the ldap modus, and not the AD config. As I'm having trouble using the GSSAPI keytab (sssd logs "failed to connect, going offline") I would like to attempt simpler DN/password authentication. Your docs talk about it, so I guess the option exists: > https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%2… My question: would anyone be willing to share an sssd.conf that works with samba4/rfc2307bis AD DCs, but using password authentication? (Or can anyone point me to a doc where this is explained?) Best regards, MJ

2 3

applies override_homedir dynamically
by Yunchih Chen 28 Mar '17

28 Mar '17

Hi friends: I'm managing a workstation where user home directories are mounted from a NFS server. Sometimes the NFS server goes down and user gets stuck when she tries to login with ssh. We have a daemon that periodically checks the health of NFS server. If it goes down, we'd like to apply the "override_homedir" option to override home directory string from LDAP into some local directory like /tmp so that user can still login, despite lack of home directory. It seems that whenever I add/remove the "override_homedir" to/from sssd.conf, I must restart the sssd daemon. I wonder if I can ask sssd daemon to dynamically reload without a restart? Or do you have better solution for this scenario? Thank you!!

2 1

Bug #3131 in the sssd-1.14?
by Ondrej Valousek 28 Mar '17

28 Mar '17

Hi, which version from the 1.14 line contains a fix for bug #1313 (fixed in 1.13.5)? I am running 1.14.0-43 from CentOS-7 and it seems to suffer from the same problem. Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

3 3

Shell customization for SSSD users
by me＠vitalykarasik.com 28 Mar '17

28 Mar '17

We have a few RHEL7 boxes for developers, users are authenticated with SSSD against AD. Each developer has his/her own Linux machine, all Linuxes are managed by Puppet. Till now all users used BASH ("default_shell = /bin/bash"). Now we have a few users which want ZSH. Because we'd like to keep sssd.conf standard on all linuxes, we thought about use something like: allowed_shells = /bin/zsh,/bin/bash shell_fallback = /bin/bash So if certain linux box has ZSH installed, user will get it; else it will use BASH. We tried this config, and played with other shell-related config params - nothing work. Users receive /bin/sh instead of bash and zsh. Any ideas? TIA, Vitaly

3 3

wbinfo-like tool for sssd
by smfrench＠gmail.com 24 Mar '17

24 Mar '17

When debugging sssd it would be nice to be able to do various operations that getent can't do (e.g. 'name-to-sid' or 'sid-to-uid' etc.) or nss is not configured to do (testing that auth works e.g.) and the wbinfo tools has a pretty good list of the typical things that an admin or developer would want to do to test sssd or winbind, but ... I couldn't find an sssd equivalent of wbinfo and it looks like this is a know issue, e.g. I saw this thread http://serverfault.com/questions/795004/what-is-the-sssd-equivalent-for-wbi… and others. Is there any work in progress on an sssd equivalent of wbinfo?

3 2

hbac_eval_user_element timing
by Lachlan Musicman 24 Mar '17

24 Mar '17

What controls how long hbac_eval_user_element waits for responses? Is is [pam] pam_id_timeout or [nss] memcache_timeout or other? I am still seeing a disconnect between how many groups a person is in and how many hbac_eval_user_element is returning, and I was wondering if it was a timeout issue. cheers L. ------ The most dangerous phrase in the language is, "We've always done it this way." - Grace Hopper

2 1

NT_STATUS_LOGON_FAILURE on Debian 9 with kerberos and sssd libwbclient
by Martin Scott 24 Mar '17

24 Mar '17

Hi, I have Debian 9 samba installed with sssd. Samba Version 4.5.6-Debian SSSD 1.15.0 I have configured samba to use the sssd libwbclient but keep get a login failure for valid user name and password when using smbclient -k I can't work out why this is happening, any help would be greatly appreciated. Log snippet below [2017/03/24 09:03:00.756770, 5, pid=1814, effective(0, 0), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2017/03/24 09:03:00.756775, 5, pid=1814, effective(0, 0), real(0, 0)] ../source3/auth/token_util.c:639(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2017/03/24 09:03:00.756785, 4, pid=1814, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:439(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2017/03/24 09:03:00.756790, 1, pid=1814, effective(0, 0), real(0, 0)] ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego) Failed to generate session_info (user and group token) for session setup: NT_STATUS_LOGON_FAILURE [2017/03/24 09:03:00.756803, 5, pid=1814, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:159(dbwrap_check_lock_order) check lock order 1 for smbXsrv_session_global.tdb [2017/03/24 09:03:00.756808, 10, pid=1814, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:114(debug_lock_order) lock order: 1:smbXsrv_session_global.tdb 2:<none> 3:<none> [2017/03/24 09:03:00.756817, 10, pid=1814, effective(0, 0), real(0, 0)] ../source3/lib/dbwrap/dbwrap_ctdb.c:1064(fetch_locked_internal) Locking db 1795596909 key 18669855 [2017/03/24 09:03:00.756832, 10, pid=1814, effective(0, 0), real(0, 0)] ../source3/lib/ctdbd_conn.c:617(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=84, vnn=4026531841, opcode=128, srvid=1795596909 len=100, magic=43544442, vers=1, gen=0, op=7, reqid=84 [2017/03/24 09:03:00.756854, 5, pid=1814, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:127(dbwrap_lock_order_state_destructor) release lock order 1 for smbXsrv_session_global.tdb [2017/03/24 09:03:00.756860, 10, pid=1814, effective(0, 0), real(0, 0)] ../lib/dbwrap/dbwrap.c:114(debug_lock_order) lock order: 1:<none> 2:<none> 3:<none> [2017/03/24 09:03:00.756865, 10, pid=1814, effective(0, 0), real(0, 0)] ../source3/lib/dbwrap/dbwrap_ctdb.c:932(db_ctdb_record_destr) Unlocking db 1795596909 key 18669855 [2017/03/24 09:03:00.756891, 3, pid=1814, effective(0, 0), real(0, 0)] ../source3/smbd/error.c:82(error_packet_set) NT error packet at ../source3/smbd/sesssetup.c(293) cmd=115 (SMBsesssetupX) NT_STATUS_LOGON_FAILURE

3 4

Multiple Active Directory Domain Controllers - what if one is down ...
by smfrench＠gmail.com 21 Mar '17

21 Mar '17

In testing using "realm join" to join an Active Directory domain with two domain controllers, we ran into a problem where "realm join" would fail when one of the two Domain Controllers were down. It looks like in a common case where nslookup shows two entries for myrealm.ad.test but the first one is down (can't ping it), that realmd doesn't try the second one automatically - but rather fails the 'realm join'

3 3

realm join and net join incompatibilities
by smfrench＠gmail.com 20 Mar '17

20 Mar '17

In tracing through problems with realm join (in a Samba/ctdb cluster), I was noticing that realm join implicitly calls 'net ads join' (which should be a good thing) but it passes '-s' with a temporary smb.conf to 'net ads join' (which is a bad thing since it leaves out clustering=yes and the include=registry). What I was noticing was that to get sssd AND Samba to work after 'realm join' you had to run 'net ads join' (explicitly) on at least one node of the cluster (but that is risky because then sssd doesn't know about the keytab update that 'net ads join' just did). If you don't run 'net ads join' after 'realm join' - Samba will fail because it doesn't think it is joined to a domain (so session setups to it will get a 'NO_LOGON_SERVER' error, and 'net ads testjoin' will show it is not joined as well) - presumably because the 'net ads join' that realmd does implicitly on 'realm join' has the wrong smb.conf passed in to it (with no clustering). Comparing traces of the two joins - the main difference I see is that there are no ctdb related events logged in the 'realm join' implicitly called 'net ads join' (and secrets.tdb is missing the entry for the domain on all nodes). Any thoughts of 1) how to force 'realm join' to use a better smb.conf rather than the temporary one it chooses during 'net ads join' or 2) how to safely do a 'net ads join' after 'realm join' (and not confuse sssd)?

2 2

Announcing SSSD 1.15.2
by Jakub Hrozek 15 Mar '17

15 Mar '17

SSSD 1.15.2 =========== The SSSD team is proud to announce the release of version 1.15.2 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- * It is now possible to configure certain parameters of a trusted domain in a configuration file sub-section. In particular, it is now possible to configure which Active Directory DCs the SSSD talks to with a configuration like this:: [domain/ipa.test] # IPA domain configuration. This domain trusts a Windows domain win.test [domain/ipa.test/win.test] ad_server = dc.win.test * Several issues related to socket-activating the NSS service, especially if SSSD was configured to use a non-privileged userm were fixed. The NSS service now doesn't change the ownership of its log files to avoid triggering a name-service lookup while the NSS service is not running yet. Additionally, the NSS service is started before any other service to make sure username resolution works and the other service can resolve the SSSD user correctly. * A new option "cache_first" allows the administrator to change the way multiple domains are searched. When this option is enabled, SSSD will first try to "pin" the requested name or ID to a domain by searching the entries that are already cached and contact the domain that contains the cached entry first. Previously, SSSD would check the cache and the remote server for each domain. This option brings performance benefit for setups that use multiple domains (even auto-discovered trusted domains), especially for ID lookups that would previously iterate over all domains. Please note that this option must be enabled with care as the administrator must ensure that the ID space of domains does not overlap. * The SSSD D-Bus interface gained two new methods: "FindByNameAndCertificate" and "ListByCertificate". These methods will be used primarily by IPA and `mod_lookup_identity <https://github.com/adelton/mod_lookup_identity/> to correctly match multple users who use the same certificate for Smart Card login. * A bug where SSSD did not properly sanitize a username with a newline character in it was fixed. Packaging Changes ----------------- None in this release Documentation Changes --------------------- * A new option "cache_first" was added. Please see the Highlights section for more details * The "override_homedir" option supports a new template expansion "l" that expands to the first letter of username Tickets Fixed ------------- Please note that due to a bug in the pagure.io tracker, some tickets that have dependencies set to other tickets cannot be closed at the moment. * <https://pagure.io/SSSD/sssd/issue/3317> - Newline characters (\n) must be sanitized before LDAP requests take place * <https://pagure.io/SSSD/sssd/issue/3316> - sssd-secrets doesn't exit on idle * <https://pagure.io/SSSD/sssd/issue/3314> - sssd ignores entire groups from proxy provider if one member is listed twice * <https://pagure.io/SSSD/sssd/issue/3164> - when group is invalidated using sss_cache dataExpireTimestamp entry in the domain and timestamps cache are inconsistent * <https://pagure.io/SSSD/sssd/issue/2668> - [RFE] Add more flexible templating for override_homedir config option * <https://pagure.io/SSSD/sssd/issue/2599> - Make it possible to configure AD subdomain in the server mode * <https://pagure.io/SSSD/sssd/issue/3322> - chown in ExecStartPre of sssd-nss.service hangs forever * <https://pagure.io/SSSD/sssd/issue/843> - Login time increases strongly if more than one domain is configured * <https://pagure.io/SSSD/sssd/issue/2320> - use the sss_parse_inp request in other responders than dbus Detailed Changelog ------------------ * Fabiano Fidêncio (7): * RESPONDER: Wrap up the code to setup the idle timeout * SECRETS: Shutdown the responder in case it becomes idle * CACHE_REQ: Move cache_req_next_domain() into a new tevent request * CACHE_REQ: Check the caches first * NSS: Don't set SocketUser/SocketGroup as "sssd" in sssd-nss.socket * NSS: Ensure the NSS socket is started before any other services' sockets * NSS: Don't call chown on NSS service's ExecStartPre * Ignacio Reguero (1): * UTIL: first letter of user name template for override_homedir * Jakub Hrozek (9): * Updating the version for the 1.15.2 release * Allow manual start for sssd-ifp * NSS: Fix invalidating memory cache for subdomain users * UTIL: Add a new macro SAFEALIGN_MEMCPY_CHECK * UTIL: Add a generic iobuf module * BUILD: Detect libcurl during configure * UTIL: Add a libtevent libcurl wrapper * TESTS: test the curl wrapper with a command-line tool * Updating the translations for the 1.15.2 release * Justin Stephenson (1): * MAN: Add dyndns_auth option * Lukas Slebodnik (3): * test_secrets: Fail in child if sssd_secrets cannot start * test_utils: Add test coverage for %l in override_homedir * util-test: Extend unit test for sss_filter_sanitize_ex * Michal Židek (4): * data_provider: Fix typo in DEBUG message * SUBDOMAINS: Configurable search bases * SUBDOMAINS: Allow options ad(_backup)_server * MAN: Add trusted domain section man entry * Pavel Březina (4): * cache_req: use rctx as memory context during midpoint refresh * CACHE_REQ: Make "cache_req_{create_and_,}add_result()" more generic * CACHE_REQ: Move result manipulation into a separate module * CACHE_REQ: shortcut if object is found * Petr Čech (2): * sss_cache: User/groups invalidation in domain cache * PROXY: Remove duplicit users from group * Sumit Bose (7): * sysdb: allow multiple results for searches by certificate * cache_req: allow multiple matches for searches by certificate * ifp: add ListByCertificate * ifp: add FindByNameAndCertificate * PAM: allow muliple users mapped to a certificate * nss: ensure that SSS_NSS_GETNAMEBYCERT only returns a unique match * IPA: get overrides for all users found by certificate * Thorsten Scherf (1): * Fixed typo in debug output * Victor Tapia (1): * UTIL: Sanitize newline and carriage return characters.

1 0

sssd sasl/gssapi Authentication through NAT
by knauf＠patronas.com 13 Mar '17

13 Mar '17

Hello, I have a Problem to auth. the identity of a principal to a NAT'ed Server via gssapi. Our KDC/LDAP is externally available through a NAT_IP (and NAT_HOSTNAME) The Connection to the Server looks fine: ------------------------------------------ nc -v NAT_IP 389 Ncat: Version 6.40 ( http://nmap.org/ncat ) Ncat: Connected to NAT_IP:389. ------------------------------------------ relevant part of: /etc/sssd/sssd.conf ------------------------------------------ [domain/XXXXX.XX] ldap_sasl_mech = gssapi ldap_sasl_authid = host/FQDN_HOST ldap_sasl_canonicalize = false ldap_user_principal = userPrincipalName ldap_krb5_keytab = /etc/krb5.keytab ldap_krb5_init_creds = true ldap_krb5_ticket_lifetime = 86400 sudo_provider = ldap access_provider = ldap ldap_access_order = host ------------------------------------------ After restarting the sssd Daemon, i got the following Error Message (sssd_DOMAIN.log): ------------------------------------------ [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: host/FQDN_HOST [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-2)[Local error] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [1432158225]: Authentication Failed [_be_fo_set_port_status] (0x8000): Setting status: PORT_NOT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_recv: 2048 [fo_set_port_status] (0x0100): Marking port 389 of server 'NAT_IP' as 'not working' [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'NAT_IP' as 'not working ------------------------------------------ After spending some time to this Problem, i could limit the Problem to a DNS reverse lookup Problem during the gssapi authentication. If i set the following entry into /etc/hosts all works fine, but this Solution is not practicable for me: NAT_IP REAL_HOSTNAME Perhaps you have some clues for me to solve this Problem? Thanks & greets Steffen

3 9

Separation of access by domain groups for different server services
by Aleksey Maksimov 12 Mar '17

12 Mar '17

Hello SSSD guru's ! Need your advice. Current configuration on my web-server: # hostnamectl ____________________________________________________________________________ Operating System: Debian GNU/Linux 8 (jessie) Kernel: Linux 3.16.0-4-amd64 Architecture: x86-64 # sssd --version ____________________________________________________________________________ 1.11.7 # cat /etc/sssd/sssd.conf ____________________________________________________________________________ [sssd] domains = ad.holding.com config_file_version = 2 services = nss, pam default_domain_suffix = ad.holding.com [domain/ad.holding.com] ad_server = dc01.ad.holding.com, dc02.ad.holding.com ad_backup_server = dc05.ad.holding.com, dc07.ad.holding.com ad_domain = ad.holding.com krb5_realm = AD.HOLDING.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True ldap_use_tokengroups = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = simple subdomains_provider = none ldap_idmap_default_domain_sid = S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx simple_allow_groups = SRV-Linux-Servers-Administrators(a)ad.holding.com # cat /etc/pam.d/common-account | grep sss ____________________________________________________________________________ account [default=bad success=ok user_unknown=ignore] pam_sss.so # cat /etc/pam.d/common-auth | grep sss ____________________________________________________________________________ auth [success=1 default=ignore] pam_sss.so use_first_pass # cat /etc/pam.d/common-password | grep sss ____________________________________________________________________________ password sufficient pam_sss.so use_authtok # cat /etc/pam.d/common-session | grep sss ____________________________________________________________________________ session optional pam_sss.so Now with this configuration everything is working fine. Only users of the domain group "SRV-Linux-Servers-Administrators(a)ad.holding.com" can log in to the server. Now I need to allow connection to the server (Kerberos SSO to web site on Apache) for other domain users. New domain group "SRV-WebServer-Operators(a)ad.holding.com" must connect to the Apache web server. But these users can not login on the server. That is, users of group "SRV-WebServer-Operators" are not in group "SRV-Linux-Servers-Administrators" Please tell me how, with the help of the SSSD/PAM/NSS, to properly restrict access in this situation. So far I've created a custom PAM-service: # cat /etc/pam.d/apache2-operators auth required pam_sss.so account required pam_sss.so And I set up a web server to use this PAM-service. Here is a snippet of the working configuration of the web server: ... <Directory "/sub/folder"> # # Kerberos SSO auth with PAM authz # AuthType Kerberos AuthName "Kerberos Login" Krb5Keytab /etc/apache2/Apache-AD-Krb.keytab KrbAuthRealms AD.HOLDING.COM KrbMethodK5Passwd off # Require valid-user Require pam-account apache2-operators # ... </Directory> ... Access to the site works if the user enters both the group "SRV-Linux-Servers-Administrators" But if the user does not belong to group "SRV-Linux-Servers-Administrators" then he can not connect to the site. How can I allow a user from group "SRV-WebServer-Operators" to connect to the site, but not allow logging in to the server?

2 3

username is mapped to username\@MYDOMAIN.COM\@MYDOMAIN.COM@MYDOMAIN.COM in kerberos
by Maciej Piechotka 09 Mar '17

09 Mar '17

On one computer (Arch) I have misconfigured sssd and when I try to use PAM sssd tries to get ticket for username\@MYDOMAIN.COM\@MYDOMAIN.COM@MYDOMAIN.COM. On others (Gentoo) it works find. (Tue Mar 7 16:10:03 2017) [[sssd[ldap_child[5845]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [MYHOSTNAME$(a)MYDOMAIN.COM] (Tue Mar 7 16:10:03 2017) [[sssd[ldap_child[5845]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab] (Tue Mar 7 16:10:03 2017) [[sssd[ldap_child[5845]]]] [ldap_child_get_tgt_sync] (0x0100): Will canonicalize principals (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [child_sig_handler] (0x0100): child [5845] finished successfully. (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: MYHOSTNAME$ (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 3268 of server 'DC1.mydomain.com' as 'working' (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'DC1.mydomain.com' as 'working' (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=username(a)mydomain.com,cn=users,cn=mydomain.com,cn=sysdb] has set [ts_cache] attrs. (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sdap_ad_tokengroups_get_posix_members] (0x0080): Domain not found for SID S-1-5-32-545 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=username(a)mydomain.com,cn=users,cn=mydomain.com,cn=sysdb] has set [ts_cache] attrs. (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [username(a)mydomain.com] (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data: (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): domain: mydomain.com (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): user: username(a)mydomain.com (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): rhost: <RHOST> (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 5844 (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): logon name: username(a)mydomain.com (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [dp_pam_handler] (0x0100): Got request with the following data (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): domain: mydomain.com (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): user: username(a)mydomain.com (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): service: sshd (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): tty: ssh (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): ruser: (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): rhost: <RHOST> (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): authtok type: 1 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): priv: 1 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): cli_pid: 5844 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): logon name: not set (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [krb5_auth_send] (0x0100): Home directory for user [username(a)mydomain.com] not known. (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server dc3.mydomain.com: [<DC3IP>] TTL 3600 (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [unpack_buffer] (0x0100): cmd [241] uid [1019289252] gid [400513] validate [true] enterprise principal [true] offline [false] UPN [username\@MYDOMAIN.COM@MYDOMAIN.COM] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1019289252_XXXXXX] old_ccname: [KEYRING:persistent:200389252] keytab: [/etc/krb5.keytab] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [check_use_fast] (0x0100): Not using FAST. (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [switch_creds] (0x0200): Switch user to [1019289252][400513]. (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [switch_creds] (0x0200): Switch user to [0][0]. (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [become_user] (0x0200): Trying to become user [1019289252][400513]. (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [set_lifetime_options] (0x0100): Renewable lifetime is set to [7d] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [set_lifetime_options] (0x0100): Lifetime is set to [3d] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [get_and_save_tgt] (0x0020): 1302: [-1765328378][Client 'username\@MYDOMAIN.COM\@MYDOMAIN.COM@MYDOMAIN.COM' not found in Kerberos database] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [map_krb5_error] (0x0020): 1371: [-1765328378][Client 'username\@MYDOMAIN.COM\@MYDOMAIN.COM@MYDOMAIN.COM' not found in Kerberos database] (Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [child_sig_handler] (0x0100): child [5846] finished successfully. (Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [4 (System error)][mydomain.com] (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]: System error. (Tue Mar 7 16:10:03 2017) [sssd[pam]] [filter_responses] (0x0100): [pam_response_filter] not available, not fatal. (Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_reply] (0x0200): blen: 27 (Tue Mar 7 16:10:05 2017) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Tue Mar 7 16:10:08 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected! Logging over ssh with GSSAPI works.

2 2

el6 1.15.1 diff from 1.14.2 cannot use 2FA
by Mario Rossi 09 Mar '17

09 Mar '17

Hi, I pulled the unofficial 1.15.1 el6 sssd and installed it today on a host where RSA securid is used ( RSA + openldap) . I am trying to log in to the server and I am getting ( please note pam_unix fails but that's fine as we use ldap ) : Mar 9 09:17:38 barni sshd[7597]: error: PAM: Authentication failure for abcd from X.Y.86.223 Mar 9 09:17:38 barni sshd[7597]: Connection closed by X.Y.86.223 port 40924 [preauth] Mar 9 09:18:04 barni sshd[8012]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.Y.86.223 user=abcd Mar 9 09:18:04 barni sshd[8012]: pam_sss(*sshd:auth*): received for user abcd: *7 (Authentication failure)* Mar 9 09:18:04 barni sshd[8012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.Y.86.223 user=abcd I have reverted to 1.14.2 and it magically works :) Is there any functionality changed from 1.15.1 to 1.14.2 before I start enabling debugging and go through the logs ? The only service needing 2FA is sshd so I use a separate system-auth-ac file. With 1.15.1 I get propted for 2FA each time so it does not go to LDAP password: *1.14.2:* [gvasiliu@localhost Downloads]$ ssh -q barni Enter SecureKey: *Password: * *1.15.1:* [gvasiliu@localhost Downloads]$ ssh -q barni Enter SecureKey: Enter SecureKey: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0 https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html# Could this be related to https://pagure.io/SSSD/sssd/issue/2984 ? root(a)barni[*/etc/pam.d*]# cat *sshd* #%PAM-1.0 auth required pam_securid.so reserve auth include system-auth-ac_new account required pam_nologin.so account include system-auth-ac_new password include system-auth-ac_new session optional pam_keyinit.so force revoke session include system-auth-ac_new session required pam_loginuid.so root(a)barni[*/etc/pam.d*]# cat *system-auth-ac_new* #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth sufficient pam_sss.so auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account [default=bad success=ok user_unknown=ignore] pam_sss.so #account required pam_access.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password sufficient pam_sss.so use_authtok password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_sss.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so Thank you

2 1

Windows ACL's not set through samba
by Martin Scott 09 Mar '17

09 Mar '17

Hi, I have a debian 9 (stretch) samba domain member. I am using sssd rather than winbind and also managing samba with ctdb as this will eventually run in a clustered environment. I have inherited the configuration for this that has only been previously tested with public shares. I am not a sysadmin, I am primarily a java developer and the task of making this work has fallen to me. I need the domain admins or at least the domain administrator to be able to alter ownership of shares from windows and set ACL's on shares and subfolders. My first attempts where on debian 8 and I could not administer the shares from windows or assign ACL's. If I changed the ownership on the samba domain member to 'administrator@smb.local:domain admins(a)smb.local' I could appear to do some administration. I could set ownership and ACL's on the share and sub folders. However these appeared only in windows and the acl's were never set on the inux side. Some reading lead me to believe that I needed to use libwbclient-sssd to make this work. Hence the move to debian 9. In debian 9 I ran into the same issue when using the samba libwbclient. I can set acl's from the command line on debian and windows does detect these, but setting the acl's from windows doesn't appear to work. When I changed to use the libwbclient-sssd things got worse. I can't logon to the shares as the auth appears to be ntlmssp. If I used smbclient -k the auth is krb5 but logon still fails. Both these work with the samba libwbclient and the usernames and passwords are correct. So I have multiple problems... acl's cannot be set from windows onto the debian shares libwbclient-sssd doesn't support ntlm and logon fails with krb5 My questions are 1. Is it possible for a domain administrator to set acl's from windows onto samba shares? 2. Has anyone a got a configuration with sssd where a domain administrator can set acl's from windows onto samba shares? 3. How can I force all clients to use krb5 rather than ntlm? The full config I am using is listed below debian_version = 9.0 apt-get install ctdb apt-get install samba apt-get install sssd apt-get install libwbclient-sssd apt-get install smbclient apt-get install libkrb5-dev apt-get install libkrb5-3 apt-get install libsasl2-modules-gssapi-mit ######################################################### cat /etc/samba/smb.conf [global] workgroup = SMB server string = SMB Gateway map to guest = bad uid clustering = yes server max protocol = SMB2_10 #================== ACL support ===================== store dos attributes = Yes dos filemode = Yes vfs objects = acl_xattr #================== Added to try and prevent ntlm auth ===================== client lanman auth = no lanman auth = no ntlm auth = no client NTLMv2 auth = no #================== Performance Options ===================== socket options = TCP_NODELAY max xmit = 262144 deadtime = 15 smb2 max read = 8388608 smb2 max trans = 8388608 smb2 max write = 8388608 dbwrap_tdb_mutexes:* = yes min receivefile size = 131072 aio read size = 16384 aio write size = 16384 write cache size = 262144 #==================== Logging Options ================= log file = /var/log/samba/log.%m max log size = 50 log level = 10 #========= Standalone / Domain Server Options ========= security = ads #================ Domain Members Options ============== realm = SMB.local kerberos method = system keytab #================ fix file issues ============== dos filemode = yes unix extensions = no #================ No printers ================== load printers = no printing = bsd printcap name = /dev/null disable spoolss = yes #======================= Shares ======================= [share2] path = /var/testshares/share2 writeable = True ######################################################### cat /etc/krb5.conf [libdefaults] default_realm = SMB.LOCAL ######################################################### cat /etc/nsswitch.conf passwd: compat sss group: compat sss shadow: compat sss gshadow: files hosts: files dns sss networks: files protocols: db files services: db files sss ethers: db files rpc: db files ######################################################### cat /etc/sssd/sssd.conf [sssd] config_file_version = 2 domains = SMB.local services = nss, pam debug_level = 9 [nss] debug_level = 9 [pam] debug_level = 9 [domain/SMB.local] debug_level = 9 default_shell = /bin/bash krb5_realm = SMB.LOCAL id_provider = ad access_provider = ad cache_credentials = true use_fully_qualified_names = true krb5_store_password_if_offline = true ad_gpo_access_control = disabled ######################################################### cat /etc/sysconfig/ctdb # Options to ctdbd, read by ctdbd_wrapper(1) # # See ctdbd.conf(5) for more information about CTDB configuration variables. # Shared recovery lock file to avoid split brain. No default. # # Do NOT run CTDB without a recovery lock file unless you know exactly # what you are doing. CTDB_RECOVERY_LOCK=/tmp/ctdb.lock # List of nodes in the cluster. Default is below. CTDB_NODES=/etc/ctdb/nodes # List of public addresses for providing NAS services. No default. CTDB_PUBLIC_ADDRESSES=/etc/ctdb/public_addresses # What services should CTDB manage? Default is none. CTDB_MANAGES_SAMBA=yes # CTDB_MANAGES_WINBIND=yes # CTDB_MANAGES_NFS=yes # Raise the file descriptor limit for CTDB? ulimit -n 10000 # Default is to use the log file below instead of syslog. CTDB_LOGFILE=/var/log/log.ctdb CTDB_SYSLOG=no # Default log level is ERR. NOTICE is a little more verbose. CTDB_DEBUGLEVEL=NOTICE # Set some CTDB tunable variables during CTDB startup? # CTDB_SET_TraverseTimeout=60 CTDB_SERVICE_SMB=smbd ######################################################### cat /etc/ctdb/nodes 127.0.0.1 ######################################################### ctdb public_addresses is empty ######################################################### testparm -s Load smb config files from /etc/samba/smb.conf rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) Processing section "[share]" Loaded services file OK. Server role: ROLE_DOMAIN_MEMBER # Global parameters [global] realm = SMB.LOCAL server string = SMB Gateway workgroup = SMB log file = /var/log/samba/log.%m max log size = 50 clustering = Yes disable spoolss = Yes load printers = No printcap name = /dev/null max xmit = 262144 min receivefile size = 131072 server max protocol = SMB2 unix extensions = No client NTLMv2 auth = No kerberos method = system keytab map to guest = Bad Uid security = ADS deadtime = 15 dbwrap_tdb_mutexes:* = yes idmap config * : backend = tdb store dos attributes = Yes dos filemode = Yes printing = bsd aio read size = 16384 aio write size = 16384 write cache size = 262144 vfs objects = acl_xattr [share] path = /var/testshares/share3 read only = No ######################################################### domain successfully joined with net ads join -Uadministrator%password dns successfully registered with net ads dns register stretch.smb.local 192.168.1.156 -Uadministrator%password getent passed administrator(a)SMB.local administrator@SMB.local:*:778800500:778800513:Administrator:/:/bin/bash

1 0

Samba issue using sssd and AD authentication
by John Beranek 09 Mar '17

09 Mar '17

Hi all, I've been having this issue with my configuration for ages, and I've just been working around the problem rather than fixing it. I have a CentOS 6.8 server running sssd 1.13.3 and Samba 3.6.23. The server is joined to an AD domain, I've tried using both adcli and "net ads", it doesn't seem to matter which one I use. Initially both normal authentication and access to the server via Samba works with AD users, but after a certain period of time (it seems to be in the region of a month or two), Samba access to the server stops working. Running smbclient on the server shows the problem as well as normal access from a Windows workstation, and smbclient says: $ smbclient //myserver/johnb Enter johnb's password: session setup failed: NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE My workaround has been to rejoin the server to the domain, which clears the issue. Any idea what could be causing this? Obfuscated config files: /etc/samba/smb.conf: [global] workgroup = AD password server = dc1.example.com dc2.example.com * realm = EXAMPLE.COM security = ads client signing = yes client use spnego = yes kerberos method = secrets and keytab idmap config * : backend = tdb idmap config * : range = 10000 - 19999 /etc/sssd/sssd.conf: [sssd] config_file_version = 2 services = nss, pam, sudo domains = AD [domain/AD] # Base configuration cache_credentials = True #debug_level = 9 #debug_level = 0x97e0 #debug_level = 0xfff0 debug_level = 4 dyndns_update = false id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad refresh_expired_interval = 4050 # AD specific options ad_enable_dns_sites = true ad_server = _srv_,dc1.example.com,dc2.example.com ad_backup_server = example.com ad_domain = example.com # ID mapping ldap_id_mapping = false # Sudo ldap_sudo_search_base = ou=sudoers,dc=example,dc=com John -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake

3 13

Disabling SMBv1 on DC breaks authentication from clients
by Brenden Morgenthaler 09 Mar '17

09 Mar '17

We have multiple linux servers configured with SSSD/realmd for authentication to Active Directory. The systems are configured without winbind so using Kerberos to authenticate to the domain. Once SMBv1 was disabled on the domain controller none of the machines could authenticate users. Any idea on why this would happen when we should be configured for kerberos authentication? **** /etc/sssd/sssd.conf **** [nss] filter_groups = root filter_users = root reconnection_retries = 3 shell_fallback = /bin/bash fallback_homedir = /home/%u [pam] reconnection_retries = 3 [sssd] domains = internal.example.domain config_file_version = 2 services = nss, pam, ifp [domain/internal.example.domain] id_provider = ad auth_provider = ad access_provider = ad chpass_provider = ad dyndns_update = False ad_domain = internal.example.domain krb5_realm = INTERNAL.EXAMPLE.DOMAIN realmd_tags = manages-system joined-with-adcli cache_credentials = False krb5_store_password_if_offline = False ldap_id_mapping = True use_fully_qualified_names = False ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell entry_cache_timeout = 0 ad_enable_gc = False **** /etc/krb5.conf **** [libdefaults] default_realm = INTERNAL.EXAMPLE.DOMAIN **** realm list **** % sudo realm list internal.example.domain type: kerberos realm-name: INTERNAL.EXAMPLE.DOMAIN domain-name: internal.example.domain configured: kerberos-member server-software: active-directory client-software: sssd required-package: sssd-tools required-package: sssd required-package: libnss-sss required-package: libpam-sss required-package: adcli required-package: samba-common-bin login-formats: %U login-policy: allow-realm-logins -- Brenden

3 5

Setting ACLs through Samba from Windows?
by Omen Wild 08 Mar '17

08 Mar '17

A small group of us have been trying to get our Ubuntu servers fully integrated into AD with sssd and Samba. We have slowly chipped away at the issues. We believe we are left with one major issue: Windows cannot set ACLs through Samba. The Windows permission dialog seems to work, but when you click Apply they vanish, and getfacl on Ubuntu shows they were not applied. The host is Ubuntu 16.04.2, up to date as of today, so sssd 1.13.4-1ubuntu1.1 and Samba 2:4.3.11+dfsg-0ubuntu0.16.04.3. Our AD is set up with OU.AD3.UCDAVIS.EDU as a child domain in the same forest as the parent domain, AD3.UCDAVIS.EDU, with users in AD3.UCDAVIS.EDU and computers and groups in OU.AD3.UCDAVIS.EDU. The sssd part seems to be setup correctly. We can login via SSH and auth correctly with Samba. Windows honors the ACLs that are set on the Ubuntu side, but setting ACLs on Windows fails to actually apply. The Samba config is attached. [storage] is on ZFS with: root@phys-adtest:~# zfs get all storage | grep acl storage aclinherit restricted local storage acltype posixacl local And [storage2] is on ext4 with the user_xattr mount option added. The behavior, where ACLs vanish after clicking Apply in Windows is the same with both of them. I had previously found a thread with the issue on a Samba mailing list indicating it "must be a sssd issue because it works with winbind", but can't find the thread now. Anyone have any clues as to what may be going wrong or what config options I should check? I can post debug logs if it would help. Thanks, Omen -- Omen Wild Systems Administrator Metro Cluster

4 7

Re: [Freeipa-interest] Announcing SSSD 1.15.1
by Dave Sirrine 08 Mar '17

08 Mar '17

Big win for many: Local files and fallback... I've socialized. Thank you! Regards, David Sirrine Principal Technical Account Manager, Public Sector Strategic Customer Engagement 804-343-6037 (Office) 804-212-7510 (Cell) On Mon, Mar 6, 2017 at 2:13 PM, Ellen Newlands <enewland(a)redhat.com> wrote: > Congratulations! Very solid work here. > > On Sat, Mar 4, 2017 at 1:50 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote: > >> SSSD 1.15.1 >> =========== >> >> The SSSD team is proud to announce the release of version 1.15.1 of the >> System Security Services Daemon. >> >> This is the first release that is available from SSSD's new home >> at https://pagure.io/SSSD/sssd The tarball can be downloaded from >> https://releases.pagure.org/SSSD/sssd/ >> RPM packages will be made available for Fedora shortly. >> >> Feedback >> -------- >> Please provide comments, bugs and other feedback via the sssd-devel or >> sssd-users mailing lists: >> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel >> https://lists.fedorahosted.org/mailman/listinfo/sssd-users >> >> Highlights >> ---------- >> * Several issues related to starting the SSSD services on-demand via >> socket activation were fixed. In particular, it is no longer possible >> to have a service started both by sssd and socket-activated. Another >> bug which might have caused the responder to start before SSSD started >> and cause issues especially on system startup was fixed. >> * A new 'files' provider was added. This provider mirrors the contents >> of '/etc/passwd' and '/etc/shadow' into the SSSD database. The purpose >> of this new provider is to make it possible to use SSSD's interfaces, >> such as the D-Bus interface for local users and enable leveraging the >> in-memory fast cache for local users as well, as a replacement for >> `nscd`. >> In future, we intend to extend the D-Bus interface to also provide >> setting >> and retrieving additional custom attributes for the files users. >> * SSSD now autogenerates a fallback configuration that enables the >> files domain if no SSSD configuration exists. This allows distributions >> to enable the 'sssd' service when the SSSD package is installed. Please >> note that SSSD must be build with the configuration option >> '--enable-files-domain' for this functionality to be enabled. >> * Support for public-key authentication with Kerberos (PKINIT) was >> added. This support will enable users who authenticate with a Smart >> Card >> to obtain a Kerberos ticket during authentication. >> >> Packaging Changes >> ----------------- >> * The new files provider comes as a new shared library 'libsss_files.so' >> and a new manual page >> * A new helper binary called 'sssd_check_socket_activated_responders' >> was added. This binary is used in the 'ExecStartPre' directive to check >> if the service that corresponds to socket about to be started was also >> started explicitly and abort the socket startup if it was. >> >> Documentation Changes >> --------------------- >> * A new PAM module option 'prompt_always' was added. This option is >> related to fixing https://pagure.io/SSSD/sssd/issue/2984 which >> changed the behaviour of the PAM module so that 'pam_sss' always >> uses an auth token that was on stack. The new 'prompt_always' option >> makes it possible to restore the previous behaviour. >> >> Tickets Fixed >> ------------- >> * https://pagure.io/SSSD/sssd/issue/3112 - When sssd.conf is missing, >> create one with id_provider=files >> * https://pagure.io/SSSD/sssd/issue/3220 - Improve successful Dynamic >> DNS update log messages >> * https://pagure.io/SSSD/sssd/issue/3227 - sssd doesn't update PTR >> records if A/PTR zones are configured as non-secure and secure >> * https://pagure.io/SSSD/sssd/issue/3230 - Use the same logic for >> matching GC results in initgroups and user lookups >> * https://pagure.io/SSSD/sssd/issue/3260 - handle default_domain_suffix >> for ssh requests with default_domain_suffix >> * https://pagure.io/SSSD/sssd/issue/3262 - Implement a files provider >> to mirror the contents of /etc/passwd and /etc/groups >> * https://pagure.io/SSSD/sssd/issue/3270 - [RFE] Add PKINIT support to >> SSSD Kerberos proivder >> * https://pagure.io/SSSD/sssd/issue/3298 - Socket activation of SSSD >> doesn't work and leads to chaos >> * https://pagure.io/SSSD/sssd/issue/3299 - SSSD does not start if using >> only the local provider and services line is empty >> * https://pagure.io/SSSD/sssd/issue/3300 - Avoid running two instances >> of the same service >> * https://pagure.io/SSSD/sssd/issue/3309 - Coverity warns about an >> unused value in IPA sudo code >> * https://pagure.io/SSSD/sssd/issue/3313 - cache_req should use an >> negative cache entry for UPN based lookups >> * https://pagure.io/SSSD/sssd/issue/2984 - Don't prompt for password if >> there is already one on the stack >> * https://pagure.io/SSSD/sssd/issue/1126 - Reuse cache_req() in >> responder code >> >> Detailed Changelog >> ------------------ >> * Fabiano Fidêncio (11): >> >> * IFP: Update ifp_iface_generated.c >> * MONITOR: Wrap up sending sd_notify "ready" into a new function >> * MONITOR: Don't timeout if using local provider + socket-activated >> responders >> * MONITOR: Don't return an error in case we fail to register a service >> * SYSTEMD: Add "After=sssd.service" to the responders' sockets units >> * SYSTEMD: Avoid starting a responder socket in case SSSD is not >> started >> * SYSTEMD: Don't mix up responders' socket and monitor activation >> * SYSTEMD: Force responders to refuse manual start >> * CACHE_REQ: Add cache_req_data_set_bypass_cache() >> * PAM: Use cache_req to perform initgroups lookups >> * TESTS: Adapt pam-srv-tests to deal with cache_req related changes >> >> * Jakub Hrozek (42): >> >> * Updating the version to track the 1.15.1 release >> * AD: Use ad_domain to match forest root domain, not the configured >> domain from sssd.conf >> * SUDO: Only store lowercased attribute value once >> * NEGCACHE: Add API to reset all users and groups >> * NSS: Add sbus interface to clear memory cache >> * UTIL: Add a new domain state called DOM_INCONSISTENT >> * RESPONDER: Add a responder sbus interface to set domain state >> * RESPONDER: A sbus interface to reset negatively cached users and >> groups >> * DP: Add internal DP interface to set domain state >> * DP: Add internal interface to reset negative cache from DP >> * DP: Add internal interface to invalidate memory cache from DP >> * RESPONDER: Use the NEED_CHECK_DOMAIN macro >> * RESPONDER: Include the files provider in NEEDS_CHECK_PROVIDER >> * RESPONDER: Contact inconsistent domains >> * UTIL: Add a generic inotify module >> * CONFDB: Re-enable the files provider >> * FILES: Add the files provider >> * CONFDB: Make pwfield configurable per-domain >> * CONFDB: The files domain defaults to "x" as pwfield >> * MAN: Document the pwfield configuration option >> * TESTS: move helper fixtures to back up and restore a file to a >> utility module >> * TESTS: add a helper module with shared NSS constants >> * TESTS: Add a module to call nss_sss's getpw* from tests >> * TESTS: Add a module to call nss_sss's getgr* from tests >> * TESTS: Add files provider integration tests >> * MONITOR: Remove checks for sssd.conf changes >> * MONITOR: Use the common inotify code to watch resolv.conf >> * MAN: Add documentation for the files provider >> * EXAMPLES: Do not point to id_provider=local >> * SBUS: Document how to free the result of sbus_create_message >> * FILES: Fix reallocation logic >> * TESTS: Remove unused import >> * DOC: Deprecate README, add README.md >> * MONITOR: Enable an implicit files domain if one is not configured >> * TESTS: Enable the files domain for all integration tests >> * TESTS: Test the files domain autoconfiguration >> * CONFDB: Refactor reading the config file >> * CONFDB: If no configuration file is provided, create a fallback >> configuration >> * UTIL: Store UPN suffixes when creating a new subdomain >> * SYSDB: When searching for UPNs, search either the whole DB or only >> the given domain >> * CACHE_REQ: Only search the given domain when looking up entries by >> UPN >> * Updating translations for the 1.15.1 release >> >> * Justin Stephenson (5): >> >> * FAILOVER: Improve port status log messages >> * SUDO: Add skip_entry boolean to sudo conversions >> * TESTS: Add to IPA DN test >> * DYNDNS: Update PTR record after non-fatal error >> * DYNDNS: Correct debug log message of realm >> >> * Lukas Slebodnik (13): >> >> * BUILD: Fix linking of test_wbc_calls >> * Suppres implicit-fallthrough from gcc 7 >> * pam_sss: Suppress warning format-truncation >> * TOOLS: Fix warning format-truncation >> * sssctl: Fix warning may be used uninitialized >> * ldap_child: Fix use after free >> * SYSTEMD: Update journald drop-in file >> * Partially revert "CONFIG: Use default config when none provided" >> * BUILD: Fix linking of test_sdap_initgr >> * intg: Fix python3 issues >> * FILES: Remove unnecessary check >> * Update link to commit template >> * Use pagure links as a reference to upstream >> >> * Pavel Březina (17): >> >> * SBUS: remove unused symbols >> * SBUS: use sss_ptr_hash for opath table >> * SBUS: use sss_ptr_hash for nodes table >> * SBUS: use sss_ptr_hash for signals table >> * ssh: fix number of output certificates >> * ssh: do not create again fq name >> * sss_parse_inp_send: provide default_domain as parameter >> * cache_req: add ability to not use default domain suffix >> * cache_req: search user by name with attrs >> * cache_req: add api to create ldb_result from message >> * cache_req: move dp request to plugin >> * cache_req: add host by name search >> * ssh: rewrite ssh responder to use cache_req >> * ssh: fix typo >> * cache_req: always go to dp first when looking up host >> * NSS: Rename the interface to invalidate memory cache initgroup >> records for consistency >> * CONFDB: The files provider always enumerates >> >> * Petr Čech (5): >> >> * LDAP: Better logging message >> * SYSDB: Removing of sysdb_try_to_find_expected_dn() >> * TEST: create_multidom_test_ctx() extending >> * TESTS: Tests for sdap_search_initgr_user_in_batch >> * IPA_SUDO: Unused value fix >> >> * Sumit Bose (17): >> >> * sdap_extend_map: make sure memory can be freed >> * check_duplicate: check name member before using it >> * pam_sss: check conversation callback >> * PAM: store user object in the preq context >> * PAM: fix memory leak in pam_sss >> * PAM: use sentinel error code in PAM tests >> * utils: new error codes >> * LDAP/proxy: tell frontend that Smartcard auth is not supported >> * authtok: enhance support for Smartcard auth blobs >> * PAM: forward Smartcard credentials to backends >> * p11: return name of PKCS#11 module and key id to pam_sss >> * pam: enhance Smartcard authentication token >> * KRB5: allow pkinit pre-authentication >> * authtok: fix tests on big-endian >> * pam: use authtok from PAM stack if available >> * cache_req: use own namespace for UPNs >> * PAM: Improve debugging on smartcard creds forward >> >> _______________________________________________ >> Freeipa-interest mailing list >> Freeipa-interest(a)redhat.com >> https://www.redhat.com/mailman/listinfo/freeipa-interest > > > > _______________________________________________ > Freeipa-interest mailing list > Freeipa-interest(a)redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-interest >

1 0

Re: account not authenticating in child domain
by Gilbert, Sonia 08 Mar '17

08 Mar '17

Update: Uninstalled and re-installed all realmd components. Performed a realm join to parent domain. Authentication to parent domain is restored but authentication to subdomain is still not working. Even though sssd is trying to authenticate to the correct domain controller it fails. I suspect it is because sssd does not know about principal in child domain and keytab does not have entries for child domain host. What do I need to do to point sssd to the master kdc in child domain and authenticate users? Do we need to create a computer object for the server in child domain? When you kinit to child domain (a.abc.com) - it fails "Response was not form master KDC" - it does go to the secondary domain controller in the child domain. See output of KRB5_TRACE=/dev/stdout below. Other configs and logs below: Secure.log Krb5.log Output of realm list Output of klist -k Sssd.conf Krb5.conf Output of pam.d system-auth [root@server01 log]# KRB5_TRACE=/dev/stdout kinit -V username(a)a.abc.com Using default cache: /tmp/krb5cc_0 Using principal: username(a)a.abc.com [21234] 1488228264.116970: Getting initial credentials for username(a)a.abc.com [21234] 1488228264.117539: Sending request (209 bytes) to a.abc.com [21234] 1488228264.246215: Resolving hostname sdc01.a.abc.com. [21234] 1488228264.313399: Sending initial UDP request to dgram x.x.166.251:88 [21234] 1488228264.383772: Received answer (219 bytes) from dgram x.x.166.251:88 [21234] 1488228264.448453: Response was not from master KDC [21234] 1488228264.448519: Received error from KDC: -1765328359/Additional pre-authentication required [21234] 1488228264.448584: Processing preauth types: 16, 15, 19, 2 [21234] 1488228264.448622: Selected etype info: etype aes256-cts, salt "a.abc.comusername", params "" Password for username(a)a.abc.com: [21234] 1488228274.851028: AS key obtained for encrypted timestamp: aes256-cts/D574 [21234] 1488228274.851105: Encrypted timestamp (for 1488228256.665529): plain 301AA011180F32303137303232373230343431365AA10502030A27B9, encrypted 6818747034DA70128C9E22CF1A56A1815E14509E91693BB286BB899BBAE65F321141405718086D119447EB82A34498D0E16EA8E2F5FF71CA [21234] 1488228274.851138: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [21234] 1488228274.851170: Produced preauth for next request: 2 [21234] 1488228274.851208: Sending request (289 bytes) to a.abc.com [21234] 1488228274.982261: Resolving hostname infsdcpci02.a.abc.com. [21234] 1488228275.48986: Sending initial UDP request to dgram x.x.166.252:88 [21234] 1488228275.118201: Received answer (186 bytes) from dgram x.x.166.252:88 [21234] 1488228275.182721: Response was not from master KDC [21234] 1488228275.182772: Received error from KDC: -1765328360/Preauthentication failed [21234] 1488228275.182830: Preauth tryagain input types: 16, 15, 19, 2 [21234] 1488228275.182862: Retrying AS request with master KDC [21234] 1488228275.182889: Getting initial credentials for username(a)a.abc.com [21234] 1488228275.182963: Sending request (209 bytes) to a.abc.com (master) kinit: Preauthentication failed while getting initial credentials ######################################################################### secure.log - because we are using authlite for two-factor authentication, system-auth points to the auth.py script (note that it uses the same script for parent domain and successfully authenticates using two factor) Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: Traceback (most recent call last): Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: File "/usr/lib64/security/auth.py", line 163, in pam_sm_authenticate Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: update_password(pamh) Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: File "/usr/lib64/security/auth.py", line 152, in update_password Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: pwd.getpwnam(domain + sep + res['OTP']) Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: KeyError: getpwnam(): name not found: a.abc.com \jufgkdildfnkjvceveehvtfnckjleingtneevlgugrdhngrccjuirirnhckltihb Feb 27 17:45:34 server01 cw[30366]: pam_sss(conwrks:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=username(a)a.abc.com Feb 27 17:45:34 server01 cw[30366]: pam_sss(conwrks:auth): received for user username(a)a.abc.com: 4 (System error) ##################################################################################### Krb5.log (In ther krb5.log, sssd authenticates to the parent domain "Attempting kinit for realm [ABC.COM" and gets "KDC policy rejects" error. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [main] (0x0400): krb5_child started. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x1000): total buffer size: [145] (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x0100): cmd [241] uid [1915601461] gid [1915601461] validate [true] enterprise principal [true] offline [false] UPN [username(a)a.abc.com] (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x2000): No old ccache (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1915601461_XXXXXX] old_ccname: [not set] keytab: [/etc/krb5.keytab] (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [check_use_fast] (0x0100): Not using FAST. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [become_user] (0x0200): Trying to become user [1915601461][1915601461]. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [main] (0x2000): Running as [1915601461][1915601461]. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [k5c_setup] (0x2000): Running as [1915601461][1915601461]. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true] (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [main] (0x0400): Will perform online auth (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [ABC.COM] (Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [get_and_save_tgt] (0x0020): 1234: [-1765328372][KDC policy rejects request] (Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [map_krb5_error] (0x0020): 1303: [-1765328372][KDC policy rejects request] (Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [k5c_send_data] (0x0200): Received error code 1432158209 (Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [pack_response_packet] (0x2000): response packet size: [4] (Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [main] (0x0400): krb5_child completed successfully [root@server01 etc]# realm list -all (shouldn't this output show both realms?) abc.com type: kerberos realm-name: ABC.COM domain-name: abc.com configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common login-formats: %U login-policy: allow-permitted-logins permitted-logins: permitted-groups: Remote Access Users(a)abc.com, Remote Access Users(a)a.abc.com ###################################################### [root@PHXRASPCI01 pam.d]# klist -k (keytab only has entries for parent domain) Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 host/server01.abc.com(a)ABC.COM 2 host/server01.abc.com(a)ABC.COM 2 host/server01.abc.com(a)ABC.COM 2 host/server01.abc.com(a)ABC.COM 2 host/server01.abc.com(a)ABC.COM 2 host/server01(a)ABC.COM 2 host/server01(a)ABC.COM 2 host/server01(a)ABC.COM 2 host/server01(a)ABC.COM 2 host/server01(a)ABC.COM 2 SERVER01$(a)ABC.COM 2 SERVER01$(a)ABC.COM 2 SERVER01$(a)ABC.COM 2 SERVER01$(a)ABC.COM 2 SERVER01$(a)ABC.COM [root@SERVER01 pam.d]# ############################################################# [root@server01 etc]# more /etc/sssd/sssd.conf [sssd] domains = abc.com config_file_version = 2 services = nss, pam [domain/abc.com] ad_domain = abc.com krb5_realm = ABC.COM ad_server = dc01.abc.com,dc02.abc.com,_srv_ realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = simple debug_level = 8 simple_allow_groups = TDI Remote Access Users(a)abc.com, TDI Remote Access Users(a)a.abc.com ######################################################## [root@server01 etc]# more /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d # forwardable = true rdns = false default_realm = ABC.COM # default_ccache_name = KEYRING:persistent:%{uid} # kdc_timesync = 1 [realms] ABC.COM = { kdc = dc01.abc.com kdc = dc02.abc.com admin_server = dc01.abc.com } [domain_realm] .abc.com = ABC.COM abc.com = ABC.COM ################################################## system-auth [root@server01 pam.d]# more system-auth-ac #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth optional pam_python.so /usr/lib64/security/auth.py auth sufficient pam_sss.so use_first_pass forward_pass #auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so [ Sonia Gilbert, -Engineer II, Information Protection & Compliance Team 3375 Koapaka Street, 3rd Floor, Honolulu, HI 96819 | P: 808.564.7503 Sonia.Gilbert(a)HawaiianAir.com<mailto:Sonia.Gilbert@HawaiianAir.com> [HA Email Signature Logo]

2 3

Announcing SSSD 1.15.1
by Jakub Hrozek 04 Mar '17

04 Mar '17

SSSD 1.15.1 =========== The SSSD team is proud to announce the release of version 1.15.1 of the System Security Services Daemon. This is the first release that is available from SSSD's new home at https://pagure.io/SSSD/sssd The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- * Several issues related to starting the SSSD services on-demand via socket activation were fixed. In particular, it is no longer possible to have a service started both by sssd and socket-activated. Another bug which might have caused the responder to start before SSSD started and cause issues especially on system startup was fixed. * A new 'files' provider was added. This provider mirrors the contents of '/etc/passwd' and '/etc/shadow' into the SSSD database. The purpose of this new provider is to make it possible to use SSSD's interfaces, such as the D-Bus interface for local users and enable leveraging the in-memory fast cache for local users as well, as a replacement for `nscd`. In future, we intend to extend the D-Bus interface to also provide setting and retrieving additional custom attributes for the files users. * SSSD now autogenerates a fallback configuration that enables the files domain if no SSSD configuration exists. This allows distributions to enable the 'sssd' service when the SSSD package is installed. Please note that SSSD must be build with the configuration option '--enable-files-domain' for this functionality to be enabled. * Support for public-key authentication with Kerberos (PKINIT) was added. This support will enable users who authenticate with a Smart Card to obtain a Kerberos ticket during authentication. Packaging Changes ----------------- * The new files provider comes as a new shared library 'libsss_files.so' and a new manual page * A new helper binary called 'sssd_check_socket_activated_responders' was added. This binary is used in the 'ExecStartPre' directive to check if the service that corresponds to socket about to be started was also started explicitly and abort the socket startup if it was. Documentation Changes --------------------- * A new PAM module option 'prompt_always' was added. This option is related to fixing https://pagure.io/SSSD/sssd/issue/2984 which changed the behaviour of the PAM module so that 'pam_sss' always uses an auth token that was on stack. The new 'prompt_always' option makes it possible to restore the previous behaviour. Tickets Fixed ------------- * https://pagure.io/SSSD/sssd/issue/3112 - When sssd.conf is missing, create one with id_provider=files * https://pagure.io/SSSD/sssd/issue/3220 - Improve successful Dynamic DNS update log messages * https://pagure.io/SSSD/sssd/issue/3227 - sssd doesn't update PTR records if A/PTR zones are configured as non-secure and secure * https://pagure.io/SSSD/sssd/issue/3230 - Use the same logic for matching GC results in initgroups and user lookups * https://pagure.io/SSSD/sssd/issue/3260 - handle default_domain_suffix for ssh requests with default_domain_suffix * https://pagure.io/SSSD/sssd/issue/3262 - Implement a files provider to mirror the contents of /etc/passwd and /etc/groups * https://pagure.io/SSSD/sssd/issue/3270 - [RFE] Add PKINIT support to SSSD Kerberos proivder * https://pagure.io/SSSD/sssd/issue/3298 - Socket activation of SSSD doesn't work and leads to chaos * https://pagure.io/SSSD/sssd/issue/3299 - SSSD does not start if using only the local provider and services line is empty * https://pagure.io/SSSD/sssd/issue/3300 - Avoid running two instances of the same service * https://pagure.io/SSSD/sssd/issue/3309 - Coverity warns about an unused value in IPA sudo code * https://pagure.io/SSSD/sssd/issue/3313 - cache_req should use an negative cache entry for UPN based lookups * https://pagure.io/SSSD/sssd/issue/2984 - Don't prompt for password if there is already one on the stack * https://pagure.io/SSSD/sssd/issue/1126 - Reuse cache_req() in responder code Detailed Changelog ------------------ * Fabiano Fidêncio (11): * IFP: Update ifp_iface_generated.c * MONITOR: Wrap up sending sd_notify "ready" into a new function * MONITOR: Don't timeout if using local provider + socket-activated responders * MONITOR: Don't return an error in case we fail to register a service * SYSTEMD: Add "After=sssd.service" to the responders' sockets units * SYSTEMD: Avoid starting a responder socket in case SSSD is not started * SYSTEMD: Don't mix up responders' socket and monitor activation * SYSTEMD: Force responders to refuse manual start * CACHE_REQ: Add cache_req_data_set_bypass_cache() * PAM: Use cache_req to perform initgroups lookups * TESTS: Adapt pam-srv-tests to deal with cache_req related changes * Jakub Hrozek (42): * Updating the version to track the 1.15.1 release * AD: Use ad_domain to match forest root domain, not the configured domain from sssd.conf * SUDO: Only store lowercased attribute value once * NEGCACHE: Add API to reset all users and groups * NSS: Add sbus interface to clear memory cache * UTIL: Add a new domain state called DOM_INCONSISTENT * RESPONDER: Add a responder sbus interface to set domain state * RESPONDER: A sbus interface to reset negatively cached users and groups * DP: Add internal DP interface to set domain state * DP: Add internal interface to reset negative cache from DP * DP: Add internal interface to invalidate memory cache from DP * RESPONDER: Use the NEED_CHECK_DOMAIN macro * RESPONDER: Include the files provider in NEEDS_CHECK_PROVIDER * RESPONDER: Contact inconsistent domains * UTIL: Add a generic inotify module * CONFDB: Re-enable the files provider * FILES: Add the files provider * CONFDB: Make pwfield configurable per-domain * CONFDB: The files domain defaults to "x" as pwfield * MAN: Document the pwfield configuration option * TESTS: move helper fixtures to back up and restore a file to a utility module * TESTS: add a helper module with shared NSS constants * TESTS: Add a module to call nss_sss's getpw* from tests * TESTS: Add a module to call nss_sss's getgr* from tests * TESTS: Add files provider integration tests * MONITOR: Remove checks for sssd.conf changes * MONITOR: Use the common inotify code to watch resolv.conf * MAN: Add documentation for the files provider * EXAMPLES: Do not point to id_provider=local * SBUS: Document how to free the result of sbus_create_message * FILES: Fix reallocation logic * TESTS: Remove unused import * DOC: Deprecate README, add README.md * MONITOR: Enable an implicit files domain if one is not configured * TESTS: Enable the files domain for all integration tests * TESTS: Test the files domain autoconfiguration * CONFDB: Refactor reading the config file * CONFDB: If no configuration file is provided, create a fallback configuration * UTIL: Store UPN suffixes when creating a new subdomain * SYSDB: When searching for UPNs, search either the whole DB or only the given domain * CACHE_REQ: Only search the given domain when looking up entries by UPN * Updating translations for the 1.15.1 release * Justin Stephenson (5): * FAILOVER: Improve port status log messages * SUDO: Add skip_entry boolean to sudo conversions * TESTS: Add to IPA DN test * DYNDNS: Update PTR record after non-fatal error * DYNDNS: Correct debug log message of realm * Lukas Slebodnik (13): * BUILD: Fix linking of test_wbc_calls * Suppres implicit-fallthrough from gcc 7 * pam_sss: Suppress warning format-truncation * TOOLS: Fix warning format-truncation * sssctl: Fix warning may be used uninitialized * ldap_child: Fix use after free * SYSTEMD: Update journald drop-in file * Partially revert "CONFIG: Use default config when none provided" * BUILD: Fix linking of test_sdap_initgr * intg: Fix python3 issues * FILES: Remove unnecessary check * Update link to commit template * Use pagure links as a reference to upstream * Pavel Březina (17): * SBUS: remove unused symbols * SBUS: use sss_ptr_hash for opath table * SBUS: use sss_ptr_hash for nodes table * SBUS: use sss_ptr_hash for signals table * ssh: fix number of output certificates * ssh: do not create again fq name * sss_parse_inp_send: provide default_domain as parameter * cache_req: add ability to not use default domain suffix * cache_req: search user by name with attrs * cache_req: add api to create ldb_result from message * cache_req: move dp request to plugin * cache_req: add host by name search * ssh: rewrite ssh responder to use cache_req * ssh: fix typo * cache_req: always go to dp first when looking up host * NSS: Rename the interface to invalidate memory cache initgroup records for consistency * CONFDB: The files provider always enumerates * Petr Čech (5): * LDAP: Better logging message * SYSDB: Removing of sysdb_try_to_find_expected_dn() * TEST: create_multidom_test_ctx() extending * TESTS: Tests for sdap_search_initgr_user_in_batch * IPA_SUDO: Unused value fix * Sumit Bose (17): * sdap_extend_map: make sure memory can be freed * check_duplicate: check name member before using it * pam_sss: check conversation callback * PAM: store user object in the preq context * PAM: fix memory leak in pam_sss * PAM: use sentinel error code in PAM tests * utils: new error codes * LDAP/proxy: tell frontend that Smartcard auth is not supported * authtok: enhance support for Smartcard auth blobs * PAM: forward Smartcard credentials to backends * p11: return name of PKCS#11 module and key id to pam_sss * pam: enhance Smartcard authentication token * KRB5: allow pkinit pre-authentication * authtok: fix tests on big-endian * pam: use authtok from PAM stack if available * cache_req: use own namespace for UPNs * PAM: Improve debugging on smartcard creds forward

1 0

nsupdate/sss_ssh_authorized_keys not working until sssd.conf is touched
by Michael Smith 03 Mar '17

03 Mar '17

Hi all, I've been using sssd with AD on Ubuntu 16.04 for several months (sssd 1.13.4). I've joined probably a few dozen VMs to a domain. More often than not, /var/lib/sss/pipes/ssh is not created right away after joining, and the dynamic DNS registration with nsupdate doesn't happen. There are no errors in /var/log/sssd/*; sssd_ssh just doesn't run, and dyndns doesn't happen either. I can reboot or restart sssd as many times as I like and it won't fix it. But as soon as I would bump up the debuglevel in /etc/sssd/sssd.conf and "systemctl restart sssd", everything would work. Eventually I figured out that it wasn't dependent on the debug level at all - if I just touch /etc/sssd/sssd.conf to update the timestamp, and restart sssd, that's enough to fix it. The next time I join a machine I'll start with debuglevel set to 9. In the meantime, is there anything that could explain this behaviour: the sshd integration and dyndns registration don't work until (1) the domain is joined and (2) sssd.conf's mtime is changed? Thanks, Mike sssd.conf: [domain/my.domain] access_provider = ad ad_domain = my.domain ad_gpo_access_control = disabled ad_hostname = myhostname.my.domain cache_credentials = False debug_level = 3 default_shell = /bin/bash dns_resolver_timeout = 30 dyndns_refresh_interval = 28800 dyndns_update = True dyndns_update_ptr = True entry_cache_timeout = 120 fallback_homedir = /home/%u id_provider = ad krb5_realm = MY.DOMAIN krb5_store_password_if_offline = False ldap_access_filter = (memberOf:1.2.840.113556.1.4.1941:=cn=somegroup,ou=Groups,ou=xxx,dc=my,dc=domain) ldap_group_nesting_level = 2 ldap_id_mapping = True ldap_schema = ad ldap_user_ssh_public_key = sshPublicKey memcache_timeout = 120 use_fully_qualified_names = False [nss] filter_users = root,named,avahi,haldaemon,dbus,radiusd,news,nscd,centos,ubuntu [ssh] [sssd] config_file_version = 2 domains = my.domain services = nss,pam,ssh

2 3

The SSSD project has migrated from fedorahosted.org to pagure.io
by Jakub Hrozek 03 Mar '17

03 Mar '17

Hi, because fedorahosted.org was sunset: https://lwn.net/Articles/711887/ we have migrated the SSSD project hosting to pagure.io: https://pagure.io/SSSD/sssd Currently we are in a bit of a flux in the sense that the git repo has been migrated: https://pagure.io/SSSD/sssd.git And the github mirror is fetching data from the canonical pagure repo. The bug tracker has been migrated: https://pagure.io/SSSD/sssd/roadmap the bug numbers are the same as they were in Trac and the trac issue links should redirect seamlesly. However, the wiki has not been migrated yet. The fedora project kindly agreed to keep the old wiki around until we migrate the text to pagure: https://fedorahosted.org/sssd/wiki We are working on migrating the wiki, but because we need to prioritize this work together with development, it might take a bit of time. Please report any issues you see with the new tracking system.

2 1

AD failover and Kerberos
by michael＠hurts.ca 02 Mar '17

02 Mar '17

Hi, I'm in an environment with several AD sites, each with a DC. When remote sites' DCs are unreachable because of a VPN outage, I'm not able to complete password authentication with sudo. Does sssd_krb5_locator_plugin.so work with sssd-ad? Do I need to put anything in krb5.conf to activate it? I can see ldap_child is trying to connect on port 88 to all the wrong DCs when I enter a password in sudo. In the logs I see "[krb5_auth_done] (0x0100): Backend is marked offline, retry later!". I'm using sss_ssh_authorizedkeys to log in, so password authentication isn't involved until I sudo. To get this far I had to set dns_resolver_timeout = 30 under [domain/mydomain] in sssd.conf. Before that, AD site discovery was failing; it would look up the DCs, time out after 6 seconds connecting to one of the remote DCs by LDAP, and mark the domain as offline. I also had to set ad_gpo_access_control = disabled; gpo_child was trying to connect to the wrong DCs on port 88. Thanks, Mike

5 9

SSSD does not show group members using "getent group"
by Douglas Duckworth 02 Mar '17

02 Mar '17

Hello I am expericing the issue described in this article https://access.redhat.com/solutions/49876 though we already have ldap_group_member = uniqueMember defined in sssd.conf. User's primary group membership is shown by using getent user though getent group does not show group members. I though I was finished tuning sssd.conf though this became an issue yesterday. Members of this listserv have been extremely helpful and so I owe much of my progress to this great community. Anyway, I think the problem's with my schema. In LDAP I see: dn: ou=webgroups,base objectClass: organizationalUnit ou: webgroups dn: cn=groups,ou=webgroups,base objectClass: top objectClass: groupOfUniqueNames cn: blah uniqueMember: uid=blah This makes me think we're using rfc2307 though below this entry I see: dn: cn=gaussrun,ou=Group,base objectClass: posixGroup objectClass: top cn: blah gidNumber: gid memberUid: blah How can SSSD work with both memberUid and uniqueMember as well as different object classes for groups? I obviously inherited this LDAP server which we are replacing soon. Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2017