Hello,
here is the detail :
# service sssd stop
# getent passwd guillard
guillard:x:1223:23:guillard:/home/guillard:/bin/tcsh
# getent passwd -s sss guillard
# service sssd start
Redirecting to /bin/systemctl start sssd.service
# getent passwd guillard
guillard:x:1223:23:guillard:/home/guillard:/bin/tcsh
# getent passwd -s sss guillard
guillard:*:1223:23:guillard:/home/guillard:/bin/tcsh
# hostname
loc.mydom.fr
other.mydom.fr $ ssh loc.mydom.fr
guillard(a)loc.mydom.fr's password: [both ldap and local passwords work]
Last login: Tue Feb 12 14:28:55 2013 from other.mydom.fr
loc.mydom.fr$ whoami
guillard
loc.mydom.fr$ sudo su
[sudo] password for guillard: [both ldap and local passwords work]
# cat /etc/sssd/sssd.conf
[domain/default]
ldap_id_use_start_tls = True
cache_credentials = True
krb5_realm = #
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ldap.mydom.fr
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_search_base = dc=mydom,dc=fr
[sssd]
services = nss, pam
config_file_version = 2
domains = default
[nss]
[pam]
[sudo]
[autofs]
[ssh]
# grep -v -e "^#" /etc/nsswitch.conf
passwd: files
shadow: files
group: files
initgroups: files
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files
publickey: nisplus
automount: files ldap
aliases: files nisplus
Best,
---
Olivier
2013/2/12 Jakub Hrozek <jhrozek(a)redhat.com>:
On Tue, Feb 12, 2013 at 11:04:47AM +0100, Olivier wrote:
> Hello,
>
> just to let you know that I just realized that user authentications
> on boxes where accepted based on their ldap login/passwd when
> sssd was running and sssd.conf pointing an ldap auth_provider.
>
> You will say : and so what ?
>
> The problem is that on that on these boxes /etc/nsswitch.conf was
> not configured to use "sss" nor "ldap".
>
> $ cat /etc/nsswitch.conf
> ...
> passwd: files
> shadow: files
> group: files
> ...
>
> Is this the expected behaviour ?
>
> As a result, both ldap and local password where working for users,
> both local and ldap groups considered in access.conf on that box,
> as well as access to commands that I didn't want through "sudo"
> under certain circomstances.
Are the local and ldap accounts overlapping? Was the client configured to
use sss in nsswitch.conf at some point so that there may be stalled
cache issues?
Does getent passwd -s sss ldapuser work?
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel