Thanks Jakub.
Starting here with a fresh listing of what is setup ldapsearches and log
files to try and ssh.
I believe the issue in the logs is still the ldap searching pulling back
zero results and thereby needing the ssd.conf needing to be tweaked.
So, this is what we have now: sssd.conf
*NOTE: I don't have memberof attribute setup in LDAP - do I need to have
this?
Figuring that we are now using 'simple_allow_groups' instead.
...
[root@test-machine sssd]# cat sssd.conf
[domain/default]
ldap_id_use_start_tls = True
cache_credentials = True
ldap_search_base = dc=something,dc=net
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri =
ldaps://ldap01.something.net
ldap_tls_cacertdir = /etc/openldap/certs
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = LDAP
[nss]
filter_users = root
filter_groups = root
[pam]
[sudo]
[domain/LDAP]
access_provider = ldap
auth_provider = ldap
chpass_provider = ldap
id_provider = ldap
sudo_provider = ldap
debug_level = 7
cache_credentials = true
enumerate = false
#ldap_access_filter =
memberOf=cn=allowedusers,ou=Groups,dc=something,dc=net
#ldap_access_filter = cn=allowedusers,ou=Groups,dc=something,dc=net
#ldap_access_filter = ou=Employees,ou=People,dc=something,dc=net
access_provider = simple
simple_allow_groups = allowedusers
ldap_search_base = dc=something,dc=net
ldap_sudo_search_base = ou=sudoers,dc=something,dc=net
ldap_tls_cacert = /etc/openldap/certs/ldap01cert.pem
ldap_tls_reqcert = allow
ldap_uri =
ldaps://ldap01.something.net
=======================
*NOTE: In LDAP, I ran 3 searches. What I noticed is the user
"password::" has 2 colons??? I changed the encrypted password here to
asterisks.
[root@ldap01 openldap]# ldapsearch -H
ldaps://ldap01.something.net -x -W
-D 'cn=Manager,dc=something,dc=net' -b "ou=Groups,dc=something,dc=net"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <ou=Groups,dc=something,dc=net> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# Groups,
something.net
dn: ou=Groups,dc=something,dc=net
objectClass: top
objectClass: organizationalUnit
ou: Groups
# allowedusers, Groups,
something.net
dn: cn=allowedusers,ou=Groups,dc=something,dc=net
cn: allowedusers
objectClass: posixGroup
objectClass: top
gidNumber: 1500
memberUid: testone
-------------------------
[root@ldap01 openldap]# ldapsearch -H
ldaps://ldap01.something.net -x -W
-D 'cn=Manager,dc=something,dc=net' -b
"cn=testone,ou=employees,ou=people,dc=something,dc=net"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=testone,ou=employees,ou=people,dc=something,dc=net> with
scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# testone, Employees, People,
something.net
dn: cn=testone,ou=Employees,ou=People,dc=something,dc=net
uidNumber: 1000
loginShell: /bin/sh
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
gidNumber: 1500
userPassword:: *********
givenName: test
homeDirectory: /home/users/testone
sn: one
uid: testone
cn: testone
----------------
[root@ldap01 openldap]# ldapsearch -H
ldaps://ldap01.something.net -x -W
-D 'cn=Manager,dc=something,dc=net' -b "ou=sudoers,dc=something,dc=net"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <ou=sudoers,dc=something,dc=net> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# sudoers,
something.net
dn: ou=sudoers,dc=something,dc=net
ou: sudoers
objectClass: organizationalUnit
objectClass: top
# testone, sudoers,
something.net
dn: cn=testone,ou=sudoers,dc=something,dc=net
objectClass: sudoRole
objectClass: top
sudoCommand: ALL
sudoHost: ALL
sudoRunAs: ALL
sudoRunAsGroup: ALL
sudoRunAsUser: ALL
cn: testone
sudoUser: testone
====================================================
Runnning the ssh cmd:
[root@test-machine sssd]# ssh -vvv testone(a)test-machine.something.net
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /root/.ssh/config
debug1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to
test-machine.something.net [54.215.207.210] port
22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug3: Not a RSA1 key file /root/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug3: Wrote 792 bytes for a total of 813
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit:
diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib(a)openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit:
diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc(a)lysator.liu.se
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160(a)openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib(a)openssh.com
debug2: kex_parse_kexinit: none,zlib(a)openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug3: Wrote 24 bytes for a total of 837
debug2: dh_gen_key: priv key bits set: 129/256
debug2: bits set: 475/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: Wrote 144 bytes for a total of 981
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 2
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 2
debug1: Host 'test-machine.something.net' is known and matches the RSA
host key.
debug1: Found key in /root/.ssh/known_hosts:2
debug2: bits set: 519/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: Wrote 16 bytes for a total of 997
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug3: Wrote 48 bytes for a total of 1045
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/identity ((nil))
debug2: key: /root/.ssh/id_rsa ((nil))
debug2: key: /root/.ssh/id_dsa ((nil))
debug3: Wrote 64 bytes for a total of 1109
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug3: no such identity: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 640 bytes for a total of 1749
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
testone(a)test-machine.something.net's password:
debug3: packet_send2: adding 48 (len 61 padlen 19 extra_pad 64)
debug2: we sent a password packet, wait for reply
debug3: Wrote 144 bytes for a total of 1893
debug1: Authentications that can continue: publickey,password
Permission denied, please try again.
===================================================
Log file: sssd_LDAP.log
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [be_get_account_info]
(0x0100): Got request for [4097][1][name=testone]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_search_user_next_base]
(0x0400): Searching for users with base [dc=something,dc=net]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x0400): calling ldap_search_ext with
[(&(uid=testone)(objectclass=posixAccount))][dc=something,dc=net].
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [objectClass]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [uid]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [userPassword]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [uidNumber]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [gidNumber]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [gecos]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [homeDirectory]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [loginShell]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [krbPrincipalName]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [cn]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [modifyTimestamp]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [modifyTimestamp]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowLastChange]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowMin]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowMax]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowWarning]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowInactive]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowExpire]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [shadowFlag]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [krbLastPwdChange]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [krbPasswordExpiration]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [pwdAttribute]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [authorizedService]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [accountExpires]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [userAccountControl]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [nsAccountLock]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [host]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [loginDisabled]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [loginExpirationTime]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [loginAllowedTimeMap]
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_generic_ext_done]
(0x0400): Search result: No such object(32), no errmsg set
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_search_user_process]
(0x0400): Search for users, returned 0 results.
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sdap_get_users_done]
(0x0040): Failed to retrieve users
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sysdb_search_user_by_name]
(0x0400): No such entry
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [sysdb_delete_user]
(0x0400): Error: 2 (No such file or directory)
(Thu Jul 31 15:09:40 2014) [sssd[be[LDAP]]] [acctinfo_callback]
(0x0100): Request processed. Returned 0,0,Success
=================================================
Log file: secure
Jul 31 15:09:40 test-machine sshd[29248]: Invalid user testone from
154.215.207.210
Jul 31 15:09:40 test-machine sshd[29249]: input_userauth_request:
invalid user testone
Jul 31 15:09:45 test-machine sshd[29248]: pam_unix(sshd:auth): check
pass; user unknown
Jul 31 15:09:45 test-machine sshd[29248]: pam_unix(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=154.215.207.210
Jul 31 15:09:45 test-machine sshd[29248]: pam_succeed_if(sshd:auth):
error retrieving information about user testone
Jul 31 15:09:47 test-machine sshd[29248]: Failed password for invalid
user testone from 154.215.207.210 port 37015 ssh2
Jul 31 15:09:49 test-machine sshd[29249]: Connection closed by
154.215.207.210
------ Original Message ------
From: "Jakub Hrozek" <jhrozek(a)redhat.com>
To: sssd-devel(a)lists.fedorahosted.org
Sent: 7/30/2014 11:03:46 AM
Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration
On Wed, Jul 30, 2014 at 02:44:03PM +0000, Sterling Sahaydak wrote:
> Thanks again Jakub for replying.
>
> Looking into the documentation I see: (I know you know this by heart)
>
>
>http://docs.fedoraproject.org/en-US/Fedora/15/html/Deployment_Guide/chap-SSSD_User_Guide-Setting_Up_SSSD.html
>
> *As you mentioned for the 'Simple Access Provider' - I would need to
>provide
> a list of 'simple_allow_users = ' and manually update this
>frequently, which
> is what I'm trying to avoid.
I was proposing simple_allow_groups, not simple_allow_users :-)
>
> So, looking into:
>
> 8.2.3.2.3.2. The LDAP Access Provider -
>
> The second access control solution uses the LDAP server itself as the
>access
> provider (access_provider=ldap) and the associated filter option
> (ldap_access_filter) to specify which users are granted access to the
> specified host. Note that these two options are codependent; if you
>use LDAP
> as your access provider then you must specify a value for the
> ldap_access_filter option, otherwise all users will be denied
>access...
>
> This is what I have:
>
> [domain/LDAP]
> access_provider = ldap
> auth_provider = ldap
> chpass_provider = ldap
> id_provider = ldap
> sudo_provider = ldap
> debug_level = 7
> cache_credentials = true
> enumerate = false
>
> ldap_access_filter =
>memberOf=cn=allowedusers,ou=Groups,dc=something,dc=net
This would work if your users have the memberof attribute. Do they?
> ldap_search_base = dc=something,dc=net
> ldap_sudo_search_base = ou=sudoers,dc=something,dc=net
>
>
> I have commented out:
> #ldap_user_search_base = ou=Employees,dc=something,dc=net
> #ldap_group_search_base = ou=Groups,dc=something,dc=net
>
> Do I need to add these 2 lines back in? (* you mention below:
> ldap_access_filter is that it's combined with the usual user lookup
>filter)
>
> Or change?
>
> ldap_access_filter =
> (&(ldap_access_filter_value)(objectclass=posixAccount)(cn=username))
>
>
> Thanks!!!
>
> ------ Original Message ------
> From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> To: sssd-devel(a)lists.fedorahosted.org
> Sent: 7/30/2014 5:05:37 AM
> Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration
>
> >On Tue, Jul 29, 2014 at 02:48:06PM +0000, Sterling Sahaydak wrote:
> >> When you configured sssd.conf with the access_provider, what
>exactly
> >> were you trying to achieve? What are the expectations on who
>should be
> >> able to log in to the machine?
> >
> >The point of the ldap_access_filter is that it's combined with the
>usual
> >user lookup filter:
> >(&(ldap_access_filter_value)(objectclass=posixAccount)(cn=username))
> >
> >If you insist on using the ldap_access_filter, there needs to be a
>link
> >from the user to whatever group you want to restrict access as. So
>far I
> >only see a link the other way in your setup, since you're using the
> >RFC2307 schema with memberuid: $username attributes.
> >
> >>
> >> *Trying to achieve those users who have sudoers role be allowed to
>ssh.
> >> In SudoRole I have 'All' allowed for sudoCommand.
> >>
> >> By having the cn=allowedusers in ou=Groups, I can add users from
> >> ou=Employees and assign the attribute: memberUid in allowedusers
>the
> >>list of
> >> users sudo rights.
> >
> >But still, sounds like you should be fine restricting access to
>members of
> >allowedusers with the simple access provider..
> >
> >>
> >> FYI - ldapsearch works in retrieving everything correctly as
>needed.
> >>
> >>
> >>
> >> ------ Original Message ------
> >> From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> >> To: sssd-devel(a)lists.fedorahosted.org
> >> Sent: 7/29/2014 10:37:46 AM
> >> Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration
> >>
> >> >On Tue, Jul 29, 2014 at 01:53:17PM +0000, Sterling Sahaydak
>wrote:
> >> >> Hi Jakub,
> >> >>
> >> >> I'm not sure if simple access is what I need.
> >> >>
> >> >> I have setup in LDAP:
> >> >>
> >> >> cn=allowedusers, ou=Groups
> >> >> - using attribute: memberUid - and adding the users uid here.
> >> >
> >> >OK
> >> >
> >> >>
> >> >> ou=Employees, ou=People
> >> >> - in Employees have users with objectClass: inetOrgPerson,
> >>posixAccount
> >> >
> >> >OK
> >> >
> >> >>
> >> >> ou=sudoers
> >> >> - here have objectClass: sudoRole and creating cn= <username
>from
> >> >>Employees>
> >> >> and sudoUser = <username>
> >> >
> >> >sudo has nothing to do with access control.
> >> >
> >> >>
> >> >> and also have a LDAP Proxy to Active Directory:
> >> >> (*Note: for now, I'm commenting this section out and not
>connecting,
> >> >>but
> >> >> need to consider this to activate later)
> >> >> - using this setup in slapd.conf:
> >> >> database ldap
> >> >> suffix "ou=Users,ou=adgroup,dc=ad,dc=something,dc=net"
> >> >> uri
ldap://ad1.something.net/
> >> >> rebind-as-user
> >> >> idassert-bind bindmethod=simple
>
>
>>>>binddn="cn=bindingacctname,ou=users,ou=adgroup,dc=ad,dc=something,dc=net"
> >> >> credentials="<password>"
> >> >> mode=none
> >> >> idassert-authzFrom "*"
> >> >> chase-referrals yes
> >> >> subordinate
> >> >>
> >> >> So, not sure if simple binding would be correct thing to do???
> >> >
> >> >Again, not directly connected to access control.
> >> >
> >> >When you configured sssd.conf with the access_provider, what
>exactly
> >> >were you trying to achieve? What are the expectations on who
>should be
> >> >able to log in to the machine?
> >> >_______________________________________________
> >> >sssd-devel mailing list
> >> >sssd-devel(a)lists.fedorahosted.org
> >> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >>
> >> _______________________________________________
> >> sssd-devel mailing list
> >> sssd-devel(a)lists.fedorahosted.org
> >>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel(a)lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel