pam / sssd / cronjobs
by Olivier
Hello everyone,
I have deployed sssd to authentify users when they log in my servers,
that works well : thanks!
However, since then user's cron jobs don't execute anymore.
I suspect that this is a pam issue :
# tail -f /var/log/cron
...
Oct 23 14:35:01 boxmax crond[30085]: Autorisation refused
Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: failed to open
PAM security session: Mauvais descripteur de fichier
Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: cannot set
security context
Here is the "boxmax" configuration :
# cat /etc/issue
Red Hat Enterprise Linux Server release 5.5 (Tikanga)
# cat /etc/pam.d/crond
#
# The PAM configuration file for the cron daemon
#
#
auth sufficient pam_env.so
auth required pam_rootok.so
auth include system-auth
account required pam_access.so
account include system-auth
session required pam_loginuid.so
session include system-auth
Here is an extract of my access.conf
# cat /etc/security/access.conf :
...
+:network:ALL
-:ALL:ALL
John is member of ldap posixgroup "network".
I know that this access rule and john's group are correctly set up
since if I remove this rule : "+:reseau:ALL" then john can't login
anymore (he properly does if I add the rule).
I also have tested with the new syntax in access.conf with no success:
+:(reseau):ALL
-:ALL:ALL
but it doesn't work neither.
If I try to add this line in access.conf :
+:john:ALL
-:ALL:ALL
Then it works : john's cron jobs are executed.
It sounds like pam.d/crond doesn't get the users groups ?
Could anyone help ?
Thanks;
For information, here is what my pam.d/ sshd system-auth looks like :
# cat /etc/pam.d/sshd
#%PAM-1.0
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
account required pam_access.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password sufficient pam_sss.so use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
session optional pam_ldap.so
11 years, 5 months
[PATCH 0/5] RFC: Fix various tevent_req style and naming issues
by Simo Sorce
While I was working on an unrelated patchset I couldn't help fixing some
of the code to properly use tevent_req style and naming conventions.
This was needed for me to be able to properly read the code, and it will
make it easier to do so in the future.
The krb5_auth.c changes are quite radical because that file was relaly
completely backwards, I have been careful to make sure I did not change
the actual program flow but I haven't tested it yet.
Please check the changes and let me know if you see anything egregiously
wrong. If you like it and have a chance to test the patchset before I get
to it, that is also welcome.
Simo.
Simo Sorce (5):
Fix tevent_req style for krb5_auth
Fix ipa_subdomain_id names and tevent_req style
Fix tevent_req style for get_netgroup in ipa_id
Streamline ipa_account_info handler
Use an entry type mask macro to filter entry types
src/providers/data_provider.h | 1 +
src/providers/ipa/ipa_id.c | 252 +++++++--------
src/providers/ipa/ipa_id.h | 10 +-
src/providers/ipa/ipa_subdomains_id.c | 75 ++---
src/providers/krb5/krb5_access.c | 6 +-
src/providers/krb5/krb5_auth.c | 556 ++++++++++++++++------------------
src/providers/krb5/krb5_auth.h | 2 +-
src/providers/krb5/krb5_wait_queue.c | 12 +-
src/providers/ldap/ldap_id.c | 2 +-
src/providers/proxy/proxy_id.c | 2 +-
10 files changed, 432 insertions(+), 486 deletions(-)
--
1.7.11.4
11 years, 6 months
Unable to change ldap user passwords as the root user
by David Jablonski
I am unable to change a ldap user account's password as the root user.
Unfortunately after a lot of google searching I haven't had any luck.
This is happening on Centos 5.8/6.3, Fedora 16/17 machines. Thank you
for any help.
Changing password for user xxx
Password reset by root is not supported.
passwd: Authentication token manipulation error
sssd.conf:
[sssd]
config_file_version = 2
# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3
# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam
domains = LOCAL,LDAP
[nss]
filter_groups = root,smolt,puppet,haclient,openvpn
filter_users = root,inoc,smolt,backup,puppet,vboxadd
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/LOCAL]
description = LOCAL Users domain
id_provider = local
enumerate = true
min_id = 100
max_id = 10000
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldaps://ldap.xxx.xxx
ldap_search_base = dc=xxx,dc=com
ldap_tls_reqcert = never
cache_credentials = true
enumerate = true
min_id = 100
ldap_enumeration_refresh_timeout=43200
system-auth-ac:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
# cascading account: UNIX -> SSS
# if UNIX succeeds we pass
# if SSS succeeds we pass
# else permit
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
--
David W. Jablonski | Systems Administrator | INOC | Madison, WI USA
O: +1-608-204-0202 | F: +1-608-663-4558 | djablonski(a)inoc.com | www.inoc.com
Service. Not Software.®
11 years, 6 months