UID/GID Mapping Incorrect
by Andrew Wygle
Hello,
Thanks to the help of this list I successfully got SSSD to
authenticate against a Windows Server 2008 R2 Active Directory domain
controller. SSH logins work. I am, however, having a problem with UID and
GID mappings. I have set the following mappings in sssd.conf:
ldap_user_uid_number = uidNumber
ldap_user_gid_number =
gidNumber
ldap_group_gid_number = gidNumber
I know these are the
defaults, but I specified them explicitly just in case. I see the same
behavior with them unset, which makes sense.
When I go to look up a
user's information, either with getent or by logging in as them and running
id, I see that their UIDs and GIDs are set to ridiculously large values.
Take Bob as an example. I expect him to have UID 1001 and GID 1003, because
that's what's specified in Active Directory and when I run ldapsearch
that's what I see as the uidNumber and gidNumber properties. However, I get
the following result from getent passwd bob:
bob:*:863601112:863600513:Bobby Wallingford:/home/bob:/bin/bash
This is
internally consistent - if I do getent group on Bob's primary group, it
returns the same GID as the one Bob is set to. However, I don't see the
same behavior on a Mac that is joined to our domain - there, id bob returns
1001 as his UID and 1003 as his GID. The only thing in the logs that looks
much like an error is a line that looks like:
[sssd[be[domain.com]]]
[sdap_save_group] (0x1000): Mapping user [bob] objectSID to unix ID
(replace user with group and bob with the group name when searching for
groups). This doesn't exactly seem correct, but also doesn't seem like it
would produce the error I'm seeing.
I didn't see any obvious pattern to
the bits either (endianness error, inverted somehow, some kind of weird
sign error, etc).
Any help will be appreciated.
Thanks,
~Andrew Wygle
11 years, 3 months
NSS not communicating with SSSD?
by Andrew Wygle
Hello,
I am trying to use sssd to authenticate against an Active
Directory server. As far as I can tell (verified using Wireshark when sssd
tries to enumerate the domain), LDAP binds are working just fine over SASL,
and Kerberos is more-or-less happy, but whenever I do getent -s sss passwd,
nothing is returned. Wireshark shows no attempts to communicate with, well,
anything. There are no reports in the sssd_domain log or sssd_nss log. When
I attempt to log in via ssh using a username that doesn't exist locally, I
see the following in /var/log/secure:
sshd[1381]: Invalid user bob from
127.0.0.1
sshd[1382]: input_userauth_request: invalid user bob
sshd[1381]:
pam_unix(sshd:auth): check pass; user unknown
sshd[1381]:
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
ruser= rhost=client.domain.net
sshd[1381]: pam_succeed_if(sshd:auth): error
retrieving information about user bob
sshd[1381]: Failed password for
invalid user bob from 127.0.0.1 port 56849 ssh2
sshd[1382]: Connection
closed by 127.0.0.1
I also see a Kerberos AS-REQ for krbtgt/DOMAIN.NET
(which is odd because the cache contains krbtgt/DOMAIN.NET(a)DOMAIN.NET and
ldap/dc.domain.net(a)DOMAIN.NET already), which is rejected with a KRB-ERR
claiming principal not found.
Finally, I occasionally (not sure exactly
when, but it seems to be when I try to log in with users that DO exist
locally) see the following in /var/log/secure:
pam_sss(sshd:session):
Request to sssd failed. Connection refused
sssd IS running.
This is all
running on a Centos 6.3 machine using sssd 1.9.3, built from source. The
1.8.0 that ships with Centos was installed originally but has since been
removed. All other packages are Centos latest, so probably at least a year
out of date.
Are there any suggestions for debugging? It almost seems
like nss is not even bothing to ask sssd for credentials, or like sssd is
rejecting said requests silently, or that dbus is failing to send the
messages, or.. something. Though I do see pings for both nss and pam in the
sssd logs, so the dbus explanation seems unlikely.
Thank you for your
time.
11 years, 3 months
[PATCHES] sss_userdel and sss_groupdel remove entries from fastcache
by Michal Židek
Patch 1: (sssd_nss part) In functions nss_cmd_getXXnam, if working with
a local domain and no results were found in sysdb, the entries are
invalidated in memory cache too.
Patch 2: (tools part) Tools sss_userdel and sss_groupdel send
SSS_NSS_GETXXNAM requests after the entry was removed from sysdb. With
the first patch, this invalidates the entry in memory cache.
Patches are in attachment.
Thanks
Michal
11 years, 3 months
override homedir
by François Dagorn
Hello all,
I'm currently wondering if it is possible to override the
the user's home directory with a customized value of the one found
in LDAP attribute i.e. something like this :
override_homedir = %d{the current value of the homedirectory found in LDAP}
Any help would be appreciated.
cheers.
--
François Dagorn
Université de Rennes
France
11 years, 3 months