username is mapped to username\@MYDOMAIN.COM\@MYDOMAIN.COM@MYDOMAIN.COM in kerberos
by Maciej Piechotka
On one computer (Arch) I have misconfigured sssd and when I try to use PAM sssd tries to get ticket for username\@MYDOMAIN.COM\@MYDOMAIN.COM(a)MYDOMAIN.COM. On others (Gentoo) it works find.
(Tue Mar 7 16:10:03 2017) [[sssd[ldap_child[5845]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [MYHOSTNAME$(a)MYDOMAIN.COM]
(Tue Mar 7 16:10:03 2017) [[sssd[ldap_child[5845]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab]
(Tue Mar 7 16:10:03 2017) [[sssd[ldap_child[5845]]]] [ldap_child_get_tgt_sync] (0x0100): Will canonicalize principals
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [child_sig_handler] (0x0100): child [5845] finished successfully.
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: MYHOSTNAME$
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 3268 of server 'DC1.mydomain.com' as 'working'
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'DC1.mydomain.com' as 'working'
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=username(a)mydomain.com,cn=users,cn=mydomain.com,cn=sysdb] has set [ts_cache] attrs.
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sdap_ad_tokengroups_get_posix_members] (0x0080): Domain not found for SID S-1-5-32-545
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=username(a)mydomain.com,cn=users,cn=mydomain.com,cn=sysdb] has set [ts_cache] attrs.
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [username(a)mydomain.com]
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): domain: mydomain.com
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): user: username(a)mydomain.com
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): service: sshd
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): rhost: <RHOST>
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 5844
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_print_data] (0x0100): logon name: username(a)mydomain.com
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [dp_pam_handler] (0x0100): Got request with the following data
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): domain: mydomain.com
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): user: username(a)mydomain.com
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): service: sshd
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): tty: ssh
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): ruser:
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): rhost: <RHOST>
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): authtok type: 1
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): newauthtok type: 0
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): priv: 1
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): cli_pid: 5844
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [pam_print_data] (0x0100): logon name: not set
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [krb5_auth_send] (0x0100): Home directory for user [username(a)mydomain.com] not known.
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server dc3.mydomain.com: [<DC3IP>] TTL 3600
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [unpack_buffer] (0x0100): cmd [241] uid [1019289252] gid [400513] validate [true] enterprise principal [true] offline [false] UPN [username\@MYDOMAIN.COM(a)MYDOMAIN.COM]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1019289252_XXXXXX] old_ccname: [KEYRING:persistent:200389252] keytab: [/etc/krb5.keytab]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [check_use_fast] (0x0100): Not using FAST.
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [switch_creds] (0x0200): Switch user to [1019289252][400513].
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [switch_creds] (0x0200): Switch user to [0][0].
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [become_user] (0x0200): Trying to become user [1019289252][400513].
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [set_lifetime_options] (0x0100): Renewable lifetime is set to [7d]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [set_lifetime_options] (0x0100): Lifetime is set to [3d]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [get_and_save_tgt] (0x0020): 1302: [-1765328378][Client 'username\@MYDOMAIN.COM\@MYDOMAIN.COM(a)MYDOMAIN.COM' not found in Kerberos database]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [map_krb5_error] (0x0020): 1371: [-1765328378][Client 'username\@MYDOMAIN.COM\@MYDOMAIN.COM(a)MYDOMAIN.COM' not found in Kerberos database]
(Tue Mar 7 16:10:03 2017) [[sssd[krb5_child[5846]]]] [k5c_send_data] (0x0200): Received error code 1432158209
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [child_sig_handler] (0x0100): child [5846] finished successfully.
(Tue Mar 7 16:10:03 2017) [sssd[be[mydomain.com]]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_dp_process_reply] (0x0200): received: [4 (System error)][mydomain.com]
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]: System error.
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [filter_responses] (0x0100): [pam_response_filter] not available, not fatal.
(Tue Mar 7 16:10:03 2017) [sssd[pam]] [pam_reply] (0x0200): blen: 27
(Tue Mar 7 16:10:05 2017) [sssd[pam]] [client_recv] (0x0200): Client disconnected!
(Tue Mar 7 16:10:08 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
Logging over ssh with GSSAPI works.
7 years, 1 month
el6 1.15.1 diff from 1.14.2 cannot use 2FA
by Mario Rossi
Hi,
I pulled the unofficial 1.15.1 el6 sssd and installed it today on a host
where RSA securid is used ( RSA + openldap) . I am trying to log in to
the server and I am getting ( please note pam_unix fails but that's fine
as we use ldap ) :
Mar 9 09:17:38 barni sshd[7597]: error: PAM: Authentication failure for
abcd from X.Y.86.223
Mar 9 09:17:38 barni sshd[7597]: Connection closed by X.Y.86.223 port
40924 [preauth]
Mar 9 09:18:04 barni sshd[8012]: pam_sss(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.Y.86.223 user=abcd
Mar 9 09:18:04 barni sshd[8012]: pam_sss(*sshd:auth*): received for
user abcd: *7 (Authentication failure)*
Mar 9 09:18:04 barni sshd[8012]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=X.Y.86.223 user=abcd
I have reverted to 1.14.2 and it magically works :) Is there any
functionality changed from 1.15.1 to 1.14.2 before I start enabling
debugging and go through the logs ? The only service needing 2FA is sshd
so I use a separate system-auth-ac file. With 1.15.1 I get propted for
2FA each time so it does not go to LDAP password:
*1.14.2:*
[gvasiliu@localhost Downloads]$ ssh -q barni
Enter SecureKey:
*Password: *
*1.15.1:*
[gvasiliu@localhost Downloads]$ ssh -q barni
Enter SecureKey:
Enter SecureKey:
https://fedorahosted.org/sssd/wiki/Releases/Notes-1.15.0
https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_15_1.html#
Could this be related to https://pagure.io/SSSD/sssd/issue/2984 ?
root(a)barni[*/etc/pam.d*]# cat *sshd*
#%PAM-1.0
auth required pam_securid.so reserve
auth include system-auth-ac_new
account required pam_nologin.so
account include system-auth-ac_new
password include system-auth-ac_new
session optional pam_keyinit.so force revoke
session include system-auth-ac_new
session required pam_loginuid.so
root(a)barni[*/etc/pam.d*]# cat *system-auth-ac_new*
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth sufficient pam_sss.so
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so
#account required pam_access.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password sufficient pam_sss.so use_authtok
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok
try_first_pass use_authtok
password required pam_deny.so
session optional pam_sss.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session required pam_unix.so
Thank you
7 years, 1 month
Windows ACL's not set through samba
by Martin Scott
Hi,
I have a debian 9 (stretch) samba domain member. I am using sssd rather than winbind and also managing samba with ctdb as this will eventually run in a clustered environment. I have inherited the configuration for this that has only been previously tested with public shares. I am not a sysadmin, I am primarily a java developer and the task of making this work has fallen to me.
I need the domain admins or at least the domain administrator to be able to alter ownership of shares from windows and set ACL's on shares and subfolders.
My first attempts where on debian 8 and I could not administer the shares from windows or assign ACL's. If I changed the ownership on the samba domain member to 'administrator@smb.local:domain admins(a)smb.local' I could appear to do some administration. I could set ownership and ACL's on the share and sub folders. However these appeared only in windows and the acl's were never set on the inux side.
Some reading lead me to believe that I needed to use libwbclient-sssd to make this work. Hence the move to debian 9.
In debian 9 I ran into the same issue when using the samba libwbclient. I can set acl's from the command line on debian and windows does detect these, but setting the acl's from windows doesn't appear to work.
When I changed to use the libwbclient-sssd things got worse. I can't logon to the shares as the auth appears to be ntlmssp. If I used smbclient -k the auth is krb5 but logon still fails. Both these work with the samba libwbclient and the usernames and passwords are correct.
So I have multiple problems...
acl's cannot be set from windows onto the debian shares
libwbclient-sssd doesn't support ntlm and logon fails with krb5
My questions are
1. Is it possible for a domain administrator to set acl's from windows onto samba shares?
2. Has anyone a got a configuration with sssd where a domain administrator can set acl's from windows onto samba shares?
3. How can I force all clients to use krb5 rather than ntlm?
The full config I am using is listed below
debian_version = 9.0
apt-get install ctdb
apt-get install samba
apt-get install sssd
apt-get install libwbclient-sssd
apt-get install smbclient
apt-get install libkrb5-dev
apt-get install libkrb5-3
apt-get install libsasl2-modules-gssapi-mit
#########################################################
cat /etc/samba/smb.conf
[global]
workgroup = SMB
server string = SMB Gateway
map to guest = bad uid
clustering = yes
server max protocol = SMB2_10
#================== ACL support =====================
store dos attributes = Yes
dos filemode = Yes
vfs objects = acl_xattr
#================== Added to try and prevent ntlm auth =====================
client lanman auth = no
lanman auth = no
ntlm auth = no
client NTLMv2 auth = no
#================== Performance Options =====================
socket options = TCP_NODELAY
max xmit = 262144
deadtime = 15
smb2 max read = 8388608
smb2 max trans = 8388608
smb2 max write = 8388608
dbwrap_tdb_mutexes:* = yes
min receivefile size = 131072
aio read size = 16384
aio write size = 16384
write cache size = 262144
#==================== Logging Options =================
log file = /var/log/samba/log.%m
max log size = 50
log level = 10
#========= Standalone / Domain Server Options =========
security = ads
#================ Domain Members Options ==============
realm = SMB.local
kerberos method = system keytab
#================ fix file issues ==============
dos filemode = yes
unix extensions = no
#================ No printers ==================
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
#======================= Shares =======================
[share2]
path = /var/testshares/share2
writeable = True
#########################################################
cat /etc/krb5.conf
[libdefaults]
default_realm = SMB.LOCAL
#########################################################
cat /etc/nsswitch.conf
passwd: compat sss
group: compat sss
shadow: compat sss
gshadow: files
hosts: files dns sss
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
#########################################################
cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
domains = SMB.local
services = nss, pam
debug_level = 9
[nss]
debug_level = 9
[pam]
debug_level = 9
[domain/SMB.local]
debug_level = 9
default_shell = /bin/bash
krb5_realm = SMB.LOCAL
id_provider = ad
access_provider = ad
cache_credentials = true
use_fully_qualified_names = true
krb5_store_password_if_offline = true
ad_gpo_access_control = disabled
#########################################################
cat /etc/sysconfig/ctdb
# Options to ctdbd, read by ctdbd_wrapper(1)
#
# See ctdbd.conf(5) for more information about CTDB configuration variables.
# Shared recovery lock file to avoid split brain. No default.
#
# Do NOT run CTDB without a recovery lock file unless you know exactly
# what you are doing.
CTDB_RECOVERY_LOCK=/tmp/ctdb.lock
# List of nodes in the cluster. Default is below.
CTDB_NODES=/etc/ctdb/nodes
# List of public addresses for providing NAS services. No default.
CTDB_PUBLIC_ADDRESSES=/etc/ctdb/public_addresses
# What services should CTDB manage? Default is none.
CTDB_MANAGES_SAMBA=yes
# CTDB_MANAGES_WINBIND=yes
# CTDB_MANAGES_NFS=yes
# Raise the file descriptor limit for CTDB?
ulimit -n 10000
# Default is to use the log file below instead of syslog.
CTDB_LOGFILE=/var/log/log.ctdb
CTDB_SYSLOG=no
# Default log level is ERR. NOTICE is a little more verbose.
CTDB_DEBUGLEVEL=NOTICE
# Set some CTDB tunable variables during CTDB startup?
# CTDB_SET_TraverseTimeout=60
CTDB_SERVICE_SMB=smbd
#########################################################
cat /etc/ctdb/nodes
127.0.0.1
#########################################################
ctdb public_addresses is empty
#########################################################
testparm -s
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[share]"
Loaded services file OK.
Server role: ROLE_DOMAIN_MEMBER
# Global parameters
[global]
realm = SMB.LOCAL
server string = SMB Gateway
workgroup = SMB
log file = /var/log/samba/log.%m
max log size = 50
clustering = Yes
disable spoolss = Yes
load printers = No
printcap name = /dev/null
max xmit = 262144
min receivefile size = 131072
server max protocol = SMB2
unix extensions = No
client NTLMv2 auth = No
kerberos method = system keytab
map to guest = Bad Uid
security = ADS
deadtime = 15
dbwrap_tdb_mutexes:* = yes
idmap config * : backend = tdb
store dos attributes = Yes
dos filemode = Yes
printing = bsd
aio read size = 16384
aio write size = 16384
write cache size = 262144
vfs objects = acl_xattr
[share]
path = /var/testshares/share3
read only = No
#########################################################
domain successfully joined with
net ads join -Uadministrator%password
dns successfully registered with
net ads dns register stretch.smb.local 192.168.1.156 -Uadministrator%password
getent passed administrator(a)SMB.local
administrator@SMB.local:*:778800500:778800513:Administrator:/:/bin/bash
7 years, 1 month
Samba issue using sssd and AD authentication
by John Beranek
Hi all,
I've been having this issue with my configuration for ages, and I've
just been working around the problem rather than fixing it.
I have a CentOS 6.8 server running sssd 1.13.3 and Samba 3.6.23.
The server is joined to an AD domain, I've tried using both adcli and
"net ads", it doesn't seem to matter which one I use.
Initially both normal authentication and access to the server via
Samba works with AD users, but after a certain period of time (it
seems to be in the region of a month or two), Samba access to the
server stops working.
Running smbclient on the server shows the problem as well as normal
access from a Windows workstation, and smbclient says:
$ smbclient //myserver/johnb
Enter johnb's password:
session setup failed: NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
My workaround has been to rejoin the server to the domain, which
clears the issue.
Any idea what could be causing this?
Obfuscated config files:
/etc/samba/smb.conf:
[global]
workgroup = AD
password server = dc1.example.com dc2.example.com *
realm = EXAMPLE.COM
security = ads
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
idmap config * : backend = tdb
idmap config * : range = 10000 - 19999
/etc/sssd/sssd.conf:
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = AD
[domain/AD]
# Base configuration
cache_credentials = True
#debug_level = 9
#debug_level = 0x97e0
#debug_level = 0xfff0
debug_level = 4
dyndns_update = false
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
refresh_expired_interval = 4050
# AD specific options
ad_enable_dns_sites = true
ad_server = _srv_,dc1.example.com,dc2.example.com
ad_backup_server = example.com
ad_domain = example.com
# ID mapping
ldap_id_mapping = false
# Sudo
ldap_sudo_search_base = ou=sudoers,dc=example,dc=com
John
--
John Beranek To generalise is to be an idiot.
http://redux.org.uk/ -- William Blake
7 years, 1 month
Disabling SMBv1 on DC breaks authentication from clients
by Brenden Morgenthaler
We have multiple linux servers configured with SSSD/realmd for authentication to Active Directory. The systems are configured without winbind so using Kerberos to authenticate to the domain. Once SMBv1 was disabled on the domain controller none of the machines could authenticate users. Any idea on why this would happen when we should be configured for kerberos authentication?
**** /etc/sssd/sssd.conf ****
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
shell_fallback = /bin/bash
fallback_homedir = /home/%u
[pam]
reconnection_retries = 3
[sssd]
domains = internal.example.domain
config_file_version = 2
services = nss, pam, ifp
[domain/internal.example.domain]
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
dyndns_update = False
ad_domain = internal.example.domain
krb5_realm = INTERNAL.EXAMPLE.DOMAIN
realmd_tags = manages-system joined-with-adcli
cache_credentials = False
krb5_store_password_if_offline = False
ldap_id_mapping = True
use_fully_qualified_names = False
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
entry_cache_timeout = 0
ad_enable_gc = False
**** /etc/krb5.conf ****
[libdefaults]
default_realm = INTERNAL.EXAMPLE.DOMAIN
**** realm list ****
% sudo realm list
internal.example.domain
type: kerberos
realm-name: INTERNAL.EXAMPLE.DOMAIN
domain-name: internal.example.domain
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: sssd-tools
required-package: sssd
required-package: libnss-sss
required-package: libpam-sss
required-package: adcli
required-package: samba-common-bin
login-formats: %U
login-policy: allow-realm-logins
--
Brenden
7 years, 1 month
Setting ACLs through Samba from Windows?
by Omen Wild
A small group of us have been trying to get our Ubuntu servers fully
integrated into AD with sssd and Samba. We have slowly chipped away at
the issues. We believe we are left with one major issue: Windows cannot
set ACLs through Samba. The Windows permission dialog seems to work, but
when you click Apply they vanish, and getfacl on Ubuntu shows they were
not applied.
The host is Ubuntu 16.04.2, up to date as of today, so sssd
1.13.4-1ubuntu1.1 and Samba 2:4.3.11+dfsg-0ubuntu0.16.04.3.
Our AD is set up with OU.AD3.UCDAVIS.EDU as a child domain in the same
forest as the parent domain, AD3.UCDAVIS.EDU, with users in
AD3.UCDAVIS.EDU and computers and groups in OU.AD3.UCDAVIS.EDU.
The sssd part seems to be setup correctly. We can login via SSH and auth
correctly with Samba. Windows honors the ACLs that are set on the Ubuntu
side, but setting ACLs on Windows fails to actually apply. The Samba
config is attached.
[storage] is on ZFS with:
root@phys-adtest:~# zfs get all storage | grep acl
storage aclinherit restricted local
storage acltype posixacl local
And [storage2] is on ext4 with the user_xattr mount option added.
The behavior, where ACLs vanish after clicking Apply in Windows is the
same with both of them.
I had previously found a thread with the issue on a Samba mailing list
indicating it "must be a sssd issue because it works with winbind", but
can't find the thread now.
Anyone have any clues as to what may be going wrong or what config
options I should check? I can post debug logs if it would help.
Thanks,
Omen
--
Omen Wild
Systems Administrator
Metro Cluster
7 years, 1 month
Re: [Freeipa-interest] Announcing SSSD 1.15.1
by Dave Sirrine
Big win for many: Local files and fallback... I've socialized. Thank you!
Regards,
David Sirrine
Principal Technical Account Manager, Public Sector
Strategic Customer Engagement
804-343-6037 (Office)
804-212-7510 (Cell)
On Mon, Mar 6, 2017 at 2:13 PM, Ellen Newlands <enewland(a)redhat.com> wrote:
> Congratulations! Very solid work here.
>
> On Sat, Mar 4, 2017 at 1:50 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
>
>> SSSD 1.15.1
>> ===========
>>
>> The SSSD team is proud to announce the release of version 1.15.1 of the
>> System Security Services Daemon.
>>
>> This is the first release that is available from SSSD's new home
>> at https://pagure.io/SSSD/sssd The tarball can be downloaded from
>> https://releases.pagure.org/SSSD/sssd/
>> RPM packages will be made available for Fedora shortly.
>>
>> Feedback
>> --------
>> Please provide comments, bugs and other feedback via the sssd-devel or
>> sssd-users mailing lists:
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>>
>> Highlights
>> ----------
>> * Several issues related to starting the SSSD services on-demand via
>> socket activation were fixed. In particular, it is no longer possible
>> to have a service started both by sssd and socket-activated. Another
>> bug which might have caused the responder to start before SSSD started
>> and cause issues especially on system startup was fixed.
>> * A new 'files' provider was added. This provider mirrors the contents
>> of '/etc/passwd' and '/etc/shadow' into the SSSD database. The purpose
>> of this new provider is to make it possible to use SSSD's interfaces,
>> such as the D-Bus interface for local users and enable leveraging the
>> in-memory fast cache for local users as well, as a replacement for
>> `nscd`.
>> In future, we intend to extend the D-Bus interface to also provide
>> setting
>> and retrieving additional custom attributes for the files users.
>> * SSSD now autogenerates a fallback configuration that enables the
>> files domain if no SSSD configuration exists. This allows distributions
>> to enable the 'sssd' service when the SSSD package is installed. Please
>> note that SSSD must be build with the configuration option
>> '--enable-files-domain' for this functionality to be enabled.
>> * Support for public-key authentication with Kerberos (PKINIT) was
>> added. This support will enable users who authenticate with a Smart
>> Card
>> to obtain a Kerberos ticket during authentication.
>>
>> Packaging Changes
>> -----------------
>> * The new files provider comes as a new shared library 'libsss_files.so'
>> and a new manual page
>> * A new helper binary called 'sssd_check_socket_activated_responders'
>> was added. This binary is used in the 'ExecStartPre' directive to check
>> if the service that corresponds to socket about to be started was also
>> started explicitly and abort the socket startup if it was.
>>
>> Documentation Changes
>> ---------------------
>> * A new PAM module option 'prompt_always' was added. This option is
>> related to fixing https://pagure.io/SSSD/sssd/issue/2984 which
>> changed the behaviour of the PAM module so that 'pam_sss' always
>> uses an auth token that was on stack. The new 'prompt_always' option
>> makes it possible to restore the previous behaviour.
>>
>> Tickets Fixed
>> -------------
>> * https://pagure.io/SSSD/sssd/issue/3112 - When sssd.conf is missing,
>> create one with id_provider=files
>> * https://pagure.io/SSSD/sssd/issue/3220 - Improve successful Dynamic
>> DNS update log messages
>> * https://pagure.io/SSSD/sssd/issue/3227 - sssd doesn't update PTR
>> records if A/PTR zones are configured as non-secure and secure
>> * https://pagure.io/SSSD/sssd/issue/3230 - Use the same logic for
>> matching GC results in initgroups and user lookups
>> * https://pagure.io/SSSD/sssd/issue/3260 - handle default_domain_suffix
>> for ssh requests with default_domain_suffix
>> * https://pagure.io/SSSD/sssd/issue/3262 - Implement a files provider
>> to mirror the contents of /etc/passwd and /etc/groups
>> * https://pagure.io/SSSD/sssd/issue/3270 - [RFE] Add PKINIT support to
>> SSSD Kerberos proivder
>> * https://pagure.io/SSSD/sssd/issue/3298 - Socket activation of SSSD
>> doesn't work and leads to chaos
>> * https://pagure.io/SSSD/sssd/issue/3299 - SSSD does not start if using
>> only the local provider and services line is empty
>> * https://pagure.io/SSSD/sssd/issue/3300 - Avoid running two instances
>> of the same service
>> * https://pagure.io/SSSD/sssd/issue/3309 - Coverity warns about an
>> unused value in IPA sudo code
>> * https://pagure.io/SSSD/sssd/issue/3313 - cache_req should use an
>> negative cache entry for UPN based lookups
>> * https://pagure.io/SSSD/sssd/issue/2984 - Don't prompt for password if
>> there is already one on the stack
>> * https://pagure.io/SSSD/sssd/issue/1126 - Reuse cache_req() in
>> responder code
>>
>> Detailed Changelog
>> ------------------
>> * Fabiano Fidêncio (11):
>>
>> * IFP: Update ifp_iface_generated.c
>> * MONITOR: Wrap up sending sd_notify "ready" into a new function
>> * MONITOR: Don't timeout if using local provider + socket-activated
>> responders
>> * MONITOR: Don't return an error in case we fail to register a service
>> * SYSTEMD: Add "After=sssd.service" to the responders' sockets units
>> * SYSTEMD: Avoid starting a responder socket in case SSSD is not
>> started
>> * SYSTEMD: Don't mix up responders' socket and monitor activation
>> * SYSTEMD: Force responders to refuse manual start
>> * CACHE_REQ: Add cache_req_data_set_bypass_cache()
>> * PAM: Use cache_req to perform initgroups lookups
>> * TESTS: Adapt pam-srv-tests to deal with cache_req related changes
>>
>> * Jakub Hrozek (42):
>>
>> * Updating the version to track the 1.15.1 release
>> * AD: Use ad_domain to match forest root domain, not the configured
>> domain from sssd.conf
>> * SUDO: Only store lowercased attribute value once
>> * NEGCACHE: Add API to reset all users and groups
>> * NSS: Add sbus interface to clear memory cache
>> * UTIL: Add a new domain state called DOM_INCONSISTENT
>> * RESPONDER: Add a responder sbus interface to set domain state
>> * RESPONDER: A sbus interface to reset negatively cached users and
>> groups
>> * DP: Add internal DP interface to set domain state
>> * DP: Add internal interface to reset negative cache from DP
>> * DP: Add internal interface to invalidate memory cache from DP
>> * RESPONDER: Use the NEED_CHECK_DOMAIN macro
>> * RESPONDER: Include the files provider in NEEDS_CHECK_PROVIDER
>> * RESPONDER: Contact inconsistent domains
>> * UTIL: Add a generic inotify module
>> * CONFDB: Re-enable the files provider
>> * FILES: Add the files provider
>> * CONFDB: Make pwfield configurable per-domain
>> * CONFDB: The files domain defaults to "x" as pwfield
>> * MAN: Document the pwfield configuration option
>> * TESTS: move helper fixtures to back up and restore a file to a
>> utility module
>> * TESTS: add a helper module with shared NSS constants
>> * TESTS: Add a module to call nss_sss's getpw* from tests
>> * TESTS: Add a module to call nss_sss's getgr* from tests
>> * TESTS: Add files provider integration tests
>> * MONITOR: Remove checks for sssd.conf changes
>> * MONITOR: Use the common inotify code to watch resolv.conf
>> * MAN: Add documentation for the files provider
>> * EXAMPLES: Do not point to id_provider=local
>> * SBUS: Document how to free the result of sbus_create_message
>> * FILES: Fix reallocation logic
>> * TESTS: Remove unused import
>> * DOC: Deprecate README, add README.md
>> * MONITOR: Enable an implicit files domain if one is not configured
>> * TESTS: Enable the files domain for all integration tests
>> * TESTS: Test the files domain autoconfiguration
>> * CONFDB: Refactor reading the config file
>> * CONFDB: If no configuration file is provided, create a fallback
>> configuration
>> * UTIL: Store UPN suffixes when creating a new subdomain
>> * SYSDB: When searching for UPNs, search either the whole DB or only
>> the given domain
>> * CACHE_REQ: Only search the given domain when looking up entries by
>> UPN
>> * Updating translations for the 1.15.1 release
>>
>> * Justin Stephenson (5):
>>
>> * FAILOVER: Improve port status log messages
>> * SUDO: Add skip_entry boolean to sudo conversions
>> * TESTS: Add to IPA DN test
>> * DYNDNS: Update PTR record after non-fatal error
>> * DYNDNS: Correct debug log message of realm
>>
>> * Lukas Slebodnik (13):
>>
>> * BUILD: Fix linking of test_wbc_calls
>> * Suppres implicit-fallthrough from gcc 7
>> * pam_sss: Suppress warning format-truncation
>> * TOOLS: Fix warning format-truncation
>> * sssctl: Fix warning may be used uninitialized
>> * ldap_child: Fix use after free
>> * SYSTEMD: Update journald drop-in file
>> * Partially revert "CONFIG: Use default config when none provided"
>> * BUILD: Fix linking of test_sdap_initgr
>> * intg: Fix python3 issues
>> * FILES: Remove unnecessary check
>> * Update link to commit template
>> * Use pagure links as a reference to upstream
>>
>> * Pavel Březina (17):
>>
>> * SBUS: remove unused symbols
>> * SBUS: use sss_ptr_hash for opath table
>> * SBUS: use sss_ptr_hash for nodes table
>> * SBUS: use sss_ptr_hash for signals table
>> * ssh: fix number of output certificates
>> * ssh: do not create again fq name
>> * sss_parse_inp_send: provide default_domain as parameter
>> * cache_req: add ability to not use default domain suffix
>> * cache_req: search user by name with attrs
>> * cache_req: add api to create ldb_result from message
>> * cache_req: move dp request to plugin
>> * cache_req: add host by name search
>> * ssh: rewrite ssh responder to use cache_req
>> * ssh: fix typo
>> * cache_req: always go to dp first when looking up host
>> * NSS: Rename the interface to invalidate memory cache initgroup
>> records for consistency
>> * CONFDB: The files provider always enumerates
>>
>> * Petr Čech (5):
>>
>> * LDAP: Better logging message
>> * SYSDB: Removing of sysdb_try_to_find_expected_dn()
>> * TEST: create_multidom_test_ctx() extending
>> * TESTS: Tests for sdap_search_initgr_user_in_batch
>> * IPA_SUDO: Unused value fix
>>
>> * Sumit Bose (17):
>>
>> * sdap_extend_map: make sure memory can be freed
>> * check_duplicate: check name member before using it
>> * pam_sss: check conversation callback
>> * PAM: store user object in the preq context
>> * PAM: fix memory leak in pam_sss
>> * PAM: use sentinel error code in PAM tests
>> * utils: new error codes
>> * LDAP/proxy: tell frontend that Smartcard auth is not supported
>> * authtok: enhance support for Smartcard auth blobs
>> * PAM: forward Smartcard credentials to backends
>> * p11: return name of PKCS#11 module and key id to pam_sss
>> * pam: enhance Smartcard authentication token
>> * KRB5: allow pkinit pre-authentication
>> * authtok: fix tests on big-endian
>> * pam: use authtok from PAM stack if available
>> * cache_req: use own namespace for UPNs
>> * PAM: Improve debugging on smartcard creds forward
>>
>> _______________________________________________
>> Freeipa-interest mailing list
>> Freeipa-interest(a)redhat.com
>> https://www.redhat.com/mailman/listinfo/freeipa-interest
>
>
>
> _______________________________________________
> Freeipa-interest mailing list
> Freeipa-interest(a)redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-interest
>
7 years, 1 month
Re: account not authenticating in child domain
by Gilbert, Sonia
Update:
Uninstalled and re-installed all realmd components. Performed a realm join to parent domain. Authentication to parent domain is restored but authentication to subdomain is still not working.
Even though sssd is trying to authenticate to the correct domain controller it fails. I suspect it is because sssd does not know about principal in child domain and keytab does not have entries for child domain host.
What do I need to do to point sssd to the master kdc in child domain and authenticate users? Do we need to create a computer object for the server in child domain?
When you kinit to child domain (a.abc.com) - it fails "Response was not form master KDC" - it does go to the secondary domain controller in the child domain.
See output of KRB5_TRACE=/dev/stdout below.
Other configs and logs below:
Secure.log
Krb5.log
Output of realm list
Output of klist -k
Sssd.conf
Krb5.conf
Output of pam.d system-auth
[root@server01 log]# KRB5_TRACE=/dev/stdout kinit -V username(a)a.abc.com
Using default cache: /tmp/krb5cc_0
Using principal: username(a)a.abc.com
[21234] 1488228264.116970: Getting initial credentials for username(a)a.abc.com
[21234] 1488228264.117539: Sending request (209 bytes) to a.abc.com
[21234] 1488228264.246215: Resolving hostname sdc01.a.abc.com.
[21234] 1488228264.313399: Sending initial UDP request to dgram x.x.166.251:88
[21234] 1488228264.383772: Received answer (219 bytes) from dgram x.x.166.251:88
[21234] 1488228264.448453: Response was not from master KDC
[21234] 1488228264.448519: Received error from KDC: -1765328359/Additional pre-authentication required
[21234] 1488228264.448584: Processing preauth types: 16, 15, 19, 2
[21234] 1488228264.448622: Selected etype info: etype aes256-cts, salt "a.abc.comusername", params ""
Password for username(a)a.abc.com:
[21234] 1488228274.851028: AS key obtained for encrypted timestamp: aes256-cts/D574
[21234] 1488228274.851105: Encrypted timestamp (for 1488228256.665529): plain 301AA011180F32303137303232373230343431365AA10502030A27B9,
encrypted 6818747034DA70128C9E22CF1A56A1815E14509E91693BB286BB899BBAE65F321141405718086D119447EB82A34498D0E16EA8E2F5FF71CA
[21234] 1488228274.851138: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[21234] 1488228274.851170: Produced preauth for next request: 2
[21234] 1488228274.851208: Sending request (289 bytes) to a.abc.com
[21234] 1488228274.982261: Resolving hostname infsdcpci02.a.abc.com.
[21234] 1488228275.48986: Sending initial UDP request to dgram x.x.166.252:88
[21234] 1488228275.118201: Received answer (186 bytes) from dgram x.x.166.252:88
[21234] 1488228275.182721: Response was not from master KDC
[21234] 1488228275.182772: Received error from KDC: -1765328360/Preauthentication failed
[21234] 1488228275.182830: Preauth tryagain input types: 16, 15, 19, 2
[21234] 1488228275.182862: Retrying AS request with master KDC
[21234] 1488228275.182889: Getting initial credentials for username(a)a.abc.com
[21234] 1488228275.182963: Sending request (209 bytes) to a.abc.com (master)
kinit: Preauthentication failed while getting initial credentials
#########################################################################
secure.log - because we are using authlite for two-factor authentication, system-auth points to the auth.py script (note that it uses the same script for parent domain and successfully authenticates using two factor)
Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: Traceback (most recent call last):
Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: File "/usr/lib64/security/auth.py", line 163, in pam_sm_authenticate
Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: update_password(pamh)
Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: File "/usr/lib64/security/auth.py", line 152, in update_password
Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: pwd.getpwnam(domain + sep + res['OTP'])
Feb 27 17:45:30 server01 /usr/lib64/security/auth.py[30366]: KeyError: getpwnam(): name not found: a.abc.com
\jufgkdildfnkjvceveehvtfnckjleingtneevlgugrdhngrccjuirirnhckltihb
Feb 27 17:45:34 server01 cw[30366]: pam_sss(conwrks:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
user=username(a)a.abc.com
Feb 27 17:45:34 server01 cw[30366]: pam_sss(conwrks:auth): received for user username(a)a.abc.com: 4 (System error)
#####################################################################################
Krb5.log (In ther krb5.log, sssd authenticates to the parent domain "Attempting kinit for realm [ABC.COM" and gets "KDC policy rejects" error.
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [main] (0x0400): krb5_child started.
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x1000): total buffer size: [145]
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x0100): cmd [241] uid [1915601461] gid [1915601461] validate
[true] enterprise principal [true] offline [false] UPN [username(a)a.abc.com]
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x2000): No old ccache
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1915601461_XXXXXX] old_ccname:
[not set] keytab: [/etc/krb5.keytab]
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [check_use_fast] (0x0100): Not using FAST.
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [become_user] (0x0200): Trying to become user [1915601461][1915601461].
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [main] (0x2000): Running as [1915601461][1915601461].
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [k5c_setup] (0x2000): Running as [1915601461][1915601461].
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from
environment.
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from
environment.
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [main] (0x0400): Will perform online auth
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [tgt_req_child] (0x1000): Attempting to get a TGT
(Mon Feb 27 14:45:33 2017) [[sssd[krb5_child[29102]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [ABC.COM]
(Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [get_and_save_tgt] (0x0020): 1234: [-1765328372][KDC policy rejects request]
(Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [map_krb5_error] (0x0020): 1303: [-1765328372][KDC policy rejects request]
(Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [k5c_send_data] (0x0200): Received error code 1432158209
(Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [pack_response_packet] (0x2000): response packet size: [4]
(Mon Feb 27 14:45:34 2017) [[sssd[krb5_child[29102]]]] [main] (0x0400): krb5_child completed successfully
[root@server01 etc]# realm list -all (shouldn't this output show both realms?)
abc.com
type: kerberos
realm-name: ABC.COM
domain-name: abc.com
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common
login-formats: %U
login-policy: allow-permitted-logins
permitted-logins:
permitted-groups: Remote Access Users(a)abc.com, Remote Access Users(a)a.abc.com
######################################################
[root@PHXRASPCI01 pam.d]# klist -k (keytab only has entries for parent domain)
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
2 host/server01.abc.com(a)ABC.COM
2 host/server01.abc.com(a)ABC.COM
2 host/server01.abc.com(a)ABC.COM
2 host/server01.abc.com(a)ABC.COM
2 host/server01.abc.com(a)ABC.COM
2 host/server01(a)ABC.COM
2 host/server01(a)ABC.COM
2 host/server01(a)ABC.COM
2 host/server01(a)ABC.COM
2 host/server01(a)ABC.COM
2 SERVER01$(a)ABC.COM
2 SERVER01$(a)ABC.COM
2 SERVER01$(a)ABC.COM
2 SERVER01$(a)ABC.COM
2 SERVER01$(a)ABC.COM
[root@SERVER01 pam.d]#
#############################################################
[root@server01 etc]# more /etc/sssd/sssd.conf
[sssd]
domains = abc.com
config_file_version = 2
services = nss, pam
[domain/abc.com]
ad_domain = abc.com
krb5_realm = ABC.COM
ad_server = dc01.abc.com,dc02.abc.com,_srv_
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = simple
debug_level = 8
simple_allow_groups = TDI Remote Access Users(a)abc.com, TDI Remote Access Users(a)a.abc.com
########################################################
[root@server01 etc]# more /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
# forwardable = true
rdns = false
default_realm = ABC.COM
# default_ccache_name = KEYRING:persistent:%{uid}
# kdc_timesync = 1
[realms]
ABC.COM = {
kdc = dc01.abc.com
kdc = dc02.abc.com
admin_server = dc01.abc.com
}
[domain_realm]
.abc.com = ABC.COM
abc.com = ABC.COM
##################################################
system-auth
[root@server01 pam.d]# more system-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so
auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth optional pam_python.so /usr/lib64/security/auth.py
auth sufficient pam_sss.so use_first_pass forward_pass
#auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
[
Sonia Gilbert, -Engineer II, Information Protection & Compliance Team
3375 Koapaka Street, 3rd Floor, Honolulu, HI 96819 | P: 808.564.7503
Sonia.Gilbert(a)HawaiianAir.com<mailto:Sonia.Gilbert@HawaiianAir.com>
[HA Email Signature Logo]
7 years, 1 month
Announcing SSSD 1.15.1
by Jakub Hrozek
SSSD 1.15.1
===========
The SSSD team is proud to announce the release of version 1.15.1 of the
System Security Services Daemon.
This is the first release that is available from SSSD's new home
at https://pagure.io/SSSD/sssd The tarball can be downloaded from
https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
--------
Please provide comments, bugs and other feedback via the sssd-devel or
sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
* Several issues related to starting the SSSD services on-demand via
socket activation were fixed. In particular, it is no longer possible
to have a service started both by sssd and socket-activated. Another
bug which might have caused the responder to start before SSSD started
and cause issues especially on system startup was fixed.
* A new 'files' provider was added. This provider mirrors the contents
of '/etc/passwd' and '/etc/shadow' into the SSSD database. The purpose
of this new provider is to make it possible to use SSSD's interfaces,
such as the D-Bus interface for local users and enable leveraging the
in-memory fast cache for local users as well, as a replacement for `nscd`.
In future, we intend to extend the D-Bus interface to also provide setting
and retrieving additional custom attributes for the files users.
* SSSD now autogenerates a fallback configuration that enables the
files domain if no SSSD configuration exists. This allows distributions
to enable the 'sssd' service when the SSSD package is installed. Please
note that SSSD must be build with the configuration option
'--enable-files-domain' for this functionality to be enabled.
* Support for public-key authentication with Kerberos (PKINIT) was
added. This support will enable users who authenticate with a Smart Card
to obtain a Kerberos ticket during authentication.
Packaging Changes
-----------------
* The new files provider comes as a new shared library 'libsss_files.so'
and a new manual page
* A new helper binary called 'sssd_check_socket_activated_responders'
was added. This binary is used in the 'ExecStartPre' directive to check
if the service that corresponds to socket about to be started was also
started explicitly and abort the socket startup if it was.
Documentation Changes
---------------------
* A new PAM module option 'prompt_always' was added. This option is
related to fixing https://pagure.io/SSSD/sssd/issue/2984 which
changed the behaviour of the PAM module so that 'pam_sss' always
uses an auth token that was on stack. The new 'prompt_always' option
makes it possible to restore the previous behaviour.
Tickets Fixed
-------------
* https://pagure.io/SSSD/sssd/issue/3112 - When sssd.conf is missing, create one with id_provider=files
* https://pagure.io/SSSD/sssd/issue/3220 - Improve successful Dynamic DNS update log messages
* https://pagure.io/SSSD/sssd/issue/3227 - sssd doesn't update PTR records if A/PTR zones are configured as non-secure and secure
* https://pagure.io/SSSD/sssd/issue/3230 - Use the same logic for matching GC results in initgroups and user lookups
* https://pagure.io/SSSD/sssd/issue/3260 - handle default_domain_suffix for ssh requests with default_domain_suffix
* https://pagure.io/SSSD/sssd/issue/3262 - Implement a files provider to mirror the contents of /etc/passwd and /etc/groups
* https://pagure.io/SSSD/sssd/issue/3270 - [RFE] Add PKINIT support to SSSD Kerberos proivder
* https://pagure.io/SSSD/sssd/issue/3298 - Socket activation of SSSD doesn't work and leads to chaos
* https://pagure.io/SSSD/sssd/issue/3299 - SSSD does not start if using only the local provider and services line is empty
* https://pagure.io/SSSD/sssd/issue/3300 - Avoid running two instances of the same service
* https://pagure.io/SSSD/sssd/issue/3309 - Coverity warns about an unused value in IPA sudo code
* https://pagure.io/SSSD/sssd/issue/3313 - cache_req should use an negative cache entry for UPN based lookups
* https://pagure.io/SSSD/sssd/issue/2984 - Don't prompt for password if there is already one on the stack
* https://pagure.io/SSSD/sssd/issue/1126 - Reuse cache_req() in responder code
Detailed Changelog
------------------
* Fabiano Fidêncio (11):
* IFP: Update ifp_iface_generated.c
* MONITOR: Wrap up sending sd_notify "ready" into a new function
* MONITOR: Don't timeout if using local provider + socket-activated responders
* MONITOR: Don't return an error in case we fail to register a service
* SYSTEMD: Add "After=sssd.service" to the responders' sockets units
* SYSTEMD: Avoid starting a responder socket in case SSSD is not started
* SYSTEMD: Don't mix up responders' socket and monitor activation
* SYSTEMD: Force responders to refuse manual start
* CACHE_REQ: Add cache_req_data_set_bypass_cache()
* PAM: Use cache_req to perform initgroups lookups
* TESTS: Adapt pam-srv-tests to deal with cache_req related changes
* Jakub Hrozek (42):
* Updating the version to track the 1.15.1 release
* AD: Use ad_domain to match forest root domain, not the configured domain from sssd.conf
* SUDO: Only store lowercased attribute value once
* NEGCACHE: Add API to reset all users and groups
* NSS: Add sbus interface to clear memory cache
* UTIL: Add a new domain state called DOM_INCONSISTENT
* RESPONDER: Add a responder sbus interface to set domain state
* RESPONDER: A sbus interface to reset negatively cached users and groups
* DP: Add internal DP interface to set domain state
* DP: Add internal interface to reset negative cache from DP
* DP: Add internal interface to invalidate memory cache from DP
* RESPONDER: Use the NEED_CHECK_DOMAIN macro
* RESPONDER: Include the files provider in NEEDS_CHECK_PROVIDER
* RESPONDER: Contact inconsistent domains
* UTIL: Add a generic inotify module
* CONFDB: Re-enable the files provider
* FILES: Add the files provider
* CONFDB: Make pwfield configurable per-domain
* CONFDB: The files domain defaults to "x" as pwfield
* MAN: Document the pwfield configuration option
* TESTS: move helper fixtures to back up and restore a file to a utility module
* TESTS: add a helper module with shared NSS constants
* TESTS: Add a module to call nss_sss's getpw* from tests
* TESTS: Add a module to call nss_sss's getgr* from tests
* TESTS: Add files provider integration tests
* MONITOR: Remove checks for sssd.conf changes
* MONITOR: Use the common inotify code to watch resolv.conf
* MAN: Add documentation for the files provider
* EXAMPLES: Do not point to id_provider=local
* SBUS: Document how to free the result of sbus_create_message
* FILES: Fix reallocation logic
* TESTS: Remove unused import
* DOC: Deprecate README, add README.md
* MONITOR: Enable an implicit files domain if one is not configured
* TESTS: Enable the files domain for all integration tests
* TESTS: Test the files domain autoconfiguration
* CONFDB: Refactor reading the config file
* CONFDB: If no configuration file is provided, create a fallback configuration
* UTIL: Store UPN suffixes when creating a new subdomain
* SYSDB: When searching for UPNs, search either the whole DB or only the given domain
* CACHE_REQ: Only search the given domain when looking up entries by UPN
* Updating translations for the 1.15.1 release
* Justin Stephenson (5):
* FAILOVER: Improve port status log messages
* SUDO: Add skip_entry boolean to sudo conversions
* TESTS: Add to IPA DN test
* DYNDNS: Update PTR record after non-fatal error
* DYNDNS: Correct debug log message of realm
* Lukas Slebodnik (13):
* BUILD: Fix linking of test_wbc_calls
* Suppres implicit-fallthrough from gcc 7
* pam_sss: Suppress warning format-truncation
* TOOLS: Fix warning format-truncation
* sssctl: Fix warning may be used uninitialized
* ldap_child: Fix use after free
* SYSTEMD: Update journald drop-in file
* Partially revert "CONFIG: Use default config when none provided"
* BUILD: Fix linking of test_sdap_initgr
* intg: Fix python3 issues
* FILES: Remove unnecessary check
* Update link to commit template
* Use pagure links as a reference to upstream
* Pavel Březina (17):
* SBUS: remove unused symbols
* SBUS: use sss_ptr_hash for opath table
* SBUS: use sss_ptr_hash for nodes table
* SBUS: use sss_ptr_hash for signals table
* ssh: fix number of output certificates
* ssh: do not create again fq name
* sss_parse_inp_send: provide default_domain as parameter
* cache_req: add ability to not use default domain suffix
* cache_req: search user by name with attrs
* cache_req: add api to create ldb_result from message
* cache_req: move dp request to plugin
* cache_req: add host by name search
* ssh: rewrite ssh responder to use cache_req
* ssh: fix typo
* cache_req: always go to dp first when looking up host
* NSS: Rename the interface to invalidate memory cache initgroup records for consistency
* CONFDB: The files provider always enumerates
* Petr Čech (5):
* LDAP: Better logging message
* SYSDB: Removing of sysdb_try_to_find_expected_dn()
* TEST: create_multidom_test_ctx() extending
* TESTS: Tests for sdap_search_initgr_user_in_batch
* IPA_SUDO: Unused value fix
* Sumit Bose (17):
* sdap_extend_map: make sure memory can be freed
* check_duplicate: check name member before using it
* pam_sss: check conversation callback
* PAM: store user object in the preq context
* PAM: fix memory leak in pam_sss
* PAM: use sentinel error code in PAM tests
* utils: new error codes
* LDAP/proxy: tell frontend that Smartcard auth is not supported
* authtok: enhance support for Smartcard auth blobs
* PAM: forward Smartcard credentials to backends
* p11: return name of PKCS#11 module and key id to pam_sss
* pam: enhance Smartcard authentication token
* KRB5: allow pkinit pre-authentication
* authtok: fix tests on big-endian
* pam: use authtok from PAM stack if available
* cache_req: use own namespace for UPNs
* PAM: Improve debugging on smartcard creds forward
7 years, 1 month
nsupdate/sss_ssh_authorized_keys not working until sssd.conf is touched
by Michael Smith
Hi all,
I've been using sssd with AD on Ubuntu 16.04 for several months (sssd
1.13.4). I've joined probably a few dozen VMs to a domain. More often than
not, /var/lib/sss/pipes/ssh is not created right away after joining, and
the dynamic DNS registration with nsupdate doesn't happen. There are no
errors in /var/log/sssd/*; sssd_ssh just doesn't run, and dyndns doesn't
happen either.
I can reboot or restart sssd as many times as I like and it won't fix it.
But as soon as I would bump up the debuglevel in /etc/sssd/sssd.conf and
"systemctl restart sssd", everything would work.
Eventually I figured out that it wasn't dependent on the debug level at all
- if I just touch /etc/sssd/sssd.conf to update the timestamp, and restart
sssd, that's enough to fix it.
The next time I join a machine I'll start with debuglevel set to 9. In the
meantime, is there anything that could explain this behaviour: the sshd
integration and dyndns registration don't work until (1) the domain is
joined and (2) sssd.conf's mtime is changed?
Thanks,
Mike
sssd.conf:
[domain/my.domain]
access_provider = ad
ad_domain = my.domain
ad_gpo_access_control = disabled
ad_hostname = myhostname.my.domain
cache_credentials = False
debug_level = 3
default_shell = /bin/bash
dns_resolver_timeout = 30
dyndns_refresh_interval = 28800
dyndns_update = True
dyndns_update_ptr = True
entry_cache_timeout = 120
fallback_homedir = /home/%u
id_provider = ad
krb5_realm = MY.DOMAIN
krb5_store_password_if_offline = False
ldap_access_filter =
(memberOf:1.2.840.113556.1.4.1941:=cn=somegroup,ou=Groups,ou=xxx,dc=my,dc=domain)
ldap_group_nesting_level = 2
ldap_id_mapping = True
ldap_schema = ad
ldap_user_ssh_public_key = sshPublicKey
memcache_timeout = 120
use_fully_qualified_names = False
[nss]
filter_users =
root,named,avahi,haldaemon,dbus,radiusd,news,nscd,centos,ubuntu
[ssh]
[sssd]
config_file_version = 2
domains = my.domain
services = nss,pam,ssh
7 years, 1 month