On 20 Mar 2018, at 09:16, Sumit Bose <sbose(a)redhat.com> wrote:
On Mon, Mar 19, 2018 at 04:45:12PM -0700, Richard Sharpe wrote:
> Hi folks,
>
> It seems that once we are joined to a domain, ssh logins with local
> accounts no longer work. When we unjoin from the domain, they start
> working again.
>
> When not joined to a domain our sssd.conf file looks like this:
>
> [sssd]
> services = nss, pac
> domains =
> config_file_version = 2
>
> When joined to a domain, our sssd.conf file looks like this:
>
> [sssd]
> services = nss, pac
> domains = win.ad.test
> config_file_version = 2
>
> [domain/win.ad.test]
> ad_domain = win.ad.test
> krb5_realm = WIN.AD.TEST
> realmd_tags = manages-system joined-with-samba
> cache_credentials = True
> id_provider = ad
> default_shell = /bin/bash
> ldap_sasl_authid = PD00050568C6FE8$
> ldap_id_mapping = False
> use_fully_qualified_names = True
> fallback_homedir = /home/%u@%d
> access_provider = ad
> ad_hostname = PD00050568C6FE8.win.ad.test
> dyndns_update = False
> ldap_schema = rfc2307bis
> -------------------------------
>
> Does anyone have any ideas on how to allow local ssh logins when
> joined to a domain?
How does your PAM configuration (e.g. /etc/pam.d/sshd and all included
files) look like?
btw note that the sssd.conf doesn’t list pam in the services line, so pam_sss.so should
just return whatever return code we use for when the deamon is not running..
bye,
Sumit
>
> --
> Regards,
> Richard Sharpe
> (何以解憂?唯有杜康。--曹操)
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
_______________________________________________
sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org