Only Stephen Gallagher would say something like:
SSSD *is* deny-by-default. See below for why I suspect that you're
actually not hitting SSSD for evaluation.
> Any help I can get at this point would be hugely appreciated. Let me know
> what you might need in terms of seeing configuration. I'll include the
> relevant sssd section here [for confidentiality purposes, I changed my
> client's domain name to my domain name, but everything else is accurate]:
>
> [
domain/fairlite.com]
> access_provider = ldap
> id_provider = ldap
> auth_provider = ldap
> chpass_provider = ldap
> ldap_schema = rfc2307
> ldap_uri =
ldap://oh11.fairlite.com
> ldap_search_base = dc=fairlite,dc=com
> ldap_tls_reqcert = demand
> ldap_tls_cacert = /etc/ssl/certs/oh11.fairlite.com-CA.crt
> cache_credentials = false
> enumerate = true
> ldap_access_filter = memberOf=cn=oh11,ou=Group,dc=fairlite,dc=com
> ldap_access_order = filter
>
> It's worth noting that I can't get memberOf to actually supply a memberuid
> field with ldapsearch. That said, even if memberOf is -totally- broken,
> I'd expect sssd to fail -all- logins, not let everyone in.
>
> Any help I can get...I'd be extremely grateful for it. I really need
> sssd's name differentiation. That's critical, and why I'm going with
sssd
> over direct ldap in the first place.
Ok, I need a little bit of extra information to sort this out. First of
all, can you show me what /var/log/secure (or SUSE's equivalent) shows
during a login?
My best guess is that you are missing pam_sss.so in the 'account' phase
of the PAM stack being executed at login (or it's configured to be
'optional'). Can you show me the /etc/pam.d/<service> file (and any
included files)?
Another possibility would be that (if this is sshd), you are missing
'use_pam yes' in sshd_config, which would mean that it would skip using
SSSD (and any other PAM module) for the account phase as well. If logins
are properly denied by a console login but allowed by SSH, this is a
likely potential culprit.
If none of that proves to be the issue, please set debug_level = 9 in
the [
domain/fairlite.com], restart SSSD, do a login and then send me
your /var/log/sssd/sssd_fairlite.com.log file (or wherever it is put on
SUSE) privately (sanitized of course).
/etc/ssh/sshd_config does contain "UsePAM yes"
/etc/pam.d/sshd:
auth requisite pam_nologin.so
auth include common-auth
account requisite pam_nologin.so
account include common-account
password include common-password
session required pam_loginuid.so
session include common-session
session optional pam_lastlog.so silent noupdate showfailed
/etc/pam.d/common-auth:
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
/etc/pam.d/common-account:
account sufficient pam_unix.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so
/etc/pam.d/common-password:
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
/etc/pam.d/common-session:
session required pam_limits.so
session required pam_unix.so
session sufficient pam_sss.so
session optional pam_gnome_keyring.so auto_start only_if=gdm,lxdm
/etc/sssd/sssd.conf domain definition:
[
domain/fairlite.com]
debug_level = 9
access_provider = ldap
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = rfc2307
ldap_uri =
ldap://oh11.fairlite.com
ldap_search_base = dc=fairlite,dc=com
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/oh11.fairlite.com-CA.crt
cache_credentials = false
enumerate = true
ldap_access_filter = memberOf=cn=oh11,ou=Group,dc=fairlite,dc=com
ldap_access_order = filter
Logging from /var/log/messages after logging in with user in question:
May 26 11:30:52 oh11 sshd[23246]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=shell1.somehost.com user=fairlite
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=13 SRCH
base="dc=fairlite,dc=com" scope=2 deref=0
filter="(&(uid=fairlite)(objectClass=posixAccount))"
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=13 SRCH attr=objectClass uid userPassword
uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp
modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive
shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute
authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled
loginExpirationTime loginAllowedTimeMap
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=13 SEARCH RESULT tag=101 err=0 nentries=1
text=
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=14 SRCH
base="dc=fairlite,dc=com" scope=2 deref=0
filter="(&(memberUid=fairlite)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))"
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=14 SRCH attr=objectClass cn userPassword
gidNumber memberuid modifyTimestamp modifyTimestamp
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=14 SEARCH RESULT tag=101 err=0 nentries=1
text=
May 26 11:30:52 oh11 slapd[10761]: conn=1103 fd=22 ACCEPT from IP=127.0.0.1:51811
(IP=0.0.0.0:389)
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=0 EXT oid=1.3.6.1.4.1.1466.20037
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=0 STARTTLS
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=0 RESULT oid= err=0 text=
May 26 11:30:52 oh11 slapd[10761]: conn=1103 fd=22 TLS established tls_ssf=256 ssf=256
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=1 BIND
dn="uid=fairlite,ou=People,dc=fairlite,dc=com" method=128
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=1 BIND
dn="uid=fairlite,ou=People,dc=fairlite,dc=com" mech=SIMPLE ssf=0
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=1 RESULT tag=97 err=0 text=
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=2 UNBIND
May 26 11:30:52 oh11 slapd[10761]: conn=1103 fd=22 closed
May 26 11:30:52 oh11 sshd[23246]: pam_sss(sshd:auth): authentication
success; logname= uid=0 euid=0 tty=ssh ruser=
rhost=shell1.somehost.com user=fairlite
May 26 11:30:52 oh11 sshd[23244]: Accepted keyboard-interactive/pam for fairlite from
192.107.41.17 port 43658 ssh2
May 26 11:30:52 oh11 sshd[23244]: pam_unix(sshd:session): session opened for user fairlite
by (uid=0)
One thing I've noticed is that in /var/log/sssd, the sssd_pam.log is still
zero bytes. And I'm not seeing extra tracing anywhere from sssd, no matter
what the debug level is set to. But you can see pam_sss is being hit and
succeeding on the third to last line of logging.
If you need anything else (and I'm sure you will), please don't hesitate to
ask, and I'll get it back to you ASAP.
Bests,
mark->