netgroups alternative?
by Ondrej Valousek
Hi List,
Quick question (maybe not the right one for this list). Is there any alternative for netgroups in Linux?
I mean netgroups are tightly bound to NIS which is insecure piece of crap so I wonder if there is any new alternative which should (can) be
used in any new deployment.
Thanks!
Ondrej
11 years, 5 months
SSSD 1.8.0-32 and AD with RHEL6
by James Chambers
Hello,
I was told by a user in linuxquestions.org to try this list for help.
So we've been trying to get SSSD working with AD on RHEL 6 for about a week
now. we've been trying to following
http://www.redhat.com/resourcelibrary/reference-architectures/integrating...
As 1.8.0-32 is part of the latest install of RHEL 6, that's the version we
need to use.
We can get configuration number 6.4 kerboros/ldap working just fine and SSH
with that, but we want option 6.3 SSSD/kerboros/ldap for the caching
features.
When 6.3 option is enabled, we can do a ldapsearch just fine with
ldapsearch -Y GSSAPI -N "(sAMAccountName=username)"
It's when we try to SSH on the server is when we are unable to get it to
work. We do ssh -vvvv username@servername and get a permission denied when
we do the password
In /var/log/messages we get:
GSSAPI Error: Unspecified GSS failure. Minor code may prove more
information (Matching credential not found)
In /var/log/secure, we get:
Invalid user username from ipaddress
input_userauth_request: invalid user username
pam_unix(sshd:auth): check pass; user unknown
pam_unix(sshd:auth: authentication failure; logname= uid=0 euid=0 tty=ssh
ruser= rhost=servername
pam_succeed_if(sshd:auth): error retriving information about user username
Failed password for invalid user username from ipaddress port portid SSH2
Here is the /var/sssd/sssd.conf file:
[sssd]
services = nss, pam
config_file_version = 2
debug_level = 9
domains = default
[nss]
[pam]
[domain/default]
debug_level = 9
enumerate = false
id_provider = ldap
chpass_provider = krb5
case_sensitive = false
ldap_uri = ldap://ldapservername.domain.domain.domain
ldap_search_base = dc=domain,dc=domain,dc=domain
ldap_user_search_base = dc=domain,dc=domain,dc=domain
ldap_group_search_base = dc=domain,dc=domain,dc=domain
ldap_id_use_start_tls = true
ldap_schema = rfc2307bis
ldap_sasl_mech = GSSAPI
ldap_force_upper_case_realm = true
ldap_krb5_keytab = /etc/krb5.keytab
ldap_sasl_authid = host/servername.domain.domain.domain(a)DOMAIN.DOMAIN.DOMAIN
auth_provider = krb5
cache_credentials = true
krb5_realm = DOMAIN.DOMAIN.DOMAIN
krb5_server = ldapservername.DOMAIN.DOMAIN.DOMAIN
krb5_ccachedir = /tmp
krb5_auth_timeout = 15
ldap_user_object_class = user
ldap_user_modify_timestamp = whenChanged
ldap_user_home_directory = unixHomeDirectory
ldap_user_princical = userPrincipalName
ldap_user_name = sAMAccountName
ldap_user_shell = loginShell
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_group_object_class = group
ldap_group_modify_timestamp = whenChanged
ldap_group_name = sAMAccountName
ldap_group_gid_number = gidNumber
krb5_kpasswd = ldapservername.domain.domain.domain
access_provider = ldap
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_disable_referrals = true
[sudo]
[autofs]
[ssh]
I've tried changing around access_provider to simple or permit and it
didn't work. I tried added ladp_access_filter to allow my id and tried
objectClass=user and it didn't work. I modified the sssd.conf file based on
another one I found at zews.org/rhel6-active-directory
Here is the password_auth file:
auth required pam_env.so
auth sufficient pam.unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry_3 type=
password sufficient pam_unix.so shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
use_uid
session required pam_unix.so
session optional pam_sss.so
nsswitch.conf has the following:
passwd: files sss
shadow: files sss
group: files sss
ldap_child.log gives me the following:
[unpack_buffer] (0x1000): total buffer size 94
[unpack_buffer] (0x1000): realm_str size: 15
[unpack_buffer] (0x1000): got realm_str: DOMAIN.DOMAIN.DOMAIN
[unpack_buffer] (0x1000): princ_str size: 47
[unpack_buffer] (0x1000): got princ_str:
host/server.domain.domain.domain(a)DOMAIN.DOMAIN.DOMAIN
[unpack_buffer] (0x1000): keytab_name size = 16
[unpack_buffer] (0x1000): got keytab_name: /etc/krb5.keytab
[unpack_buffer] (0x1000): lifetime: 86400
[ldap_child_get_tgt_sync] (0x0100): Principal name is:
[host/server.domain.domain.domain(a)DOMAIN.DOMAIN.DOMAIN]
That's it. The AD side sees that we are doing the query and doesn't see
anything on their end in terms of errors and such.
At a loss right now on what configuration we are doing wrong that works
with option 6.3. We have a working key tab for kerboros. We know we can see
AD with ldapsearch. We just can't get it to work with SSSD and SSH.
11 years, 5 months
sssd 1.9.2 & autofs & AD does not work
by Ondrej Valousek
Hi,
I am using sssd 1.9.2 with AD provider and I would like to use it for autofs support, too.
Unfortunately 'autofs_provider = ad' is not working at all. I tried 'autofs_provider = ldap', it tries to search for maps, but eventually it
fails as well:
(Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_autofs_handler] (0x0200): Requested refresh for: auto.master
(Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_get_automntmap_next_base] (0x0400): Searching for automount maps with base [CN=dublin,xxx]
(Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(nisMapName=auto.master)(objectclass=nisMap))][CN=dublin,xxx].
(Fri Nov 9 08:33:31 2012) [sssd[be[default]]] [sdap_autofs_setautomntent_done] (0x0040): sdap_get_automntmap_recv failed [5]: Input/output
error
Is this configuration supported please?
Thanks,
Ondrej
11 years, 5 months
Re: [SSSD-users] startup problem/port status 0
by Longina Przybyszewska
Hi again,
Thanks a lot for guiding me so far :)
I have got sssd-1.9.2 package from Timo, Ubuntu sssd package maintainer for Ubuntu Quantal.
SSSD is configured against AD as auth/id - provider
sssd.conf
[sssd]
debug_level = 0x1310
config_file_version = 2
services = nss, pam
domains = nat.c.sdu.dk
[nss]
filter_groups = root
filter_users = root
[pam]
[domain/nat.c.sdu.dk]
debug_level = 0x1310
enumerate = False
min_id = 1000
max_id = 20000
auth_provider = ad
id_provider = ad
access_provider = ad
chpass_provider = ad
ad_server = nat.c.sdu.dk
ad_hostname = testina4$.nat.c.sdu.dk
ad_domain = nat.c.sdu.dk
From log:
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [be_resolve_server_process] (0x1000): Saving the first resolved server
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [be_resolve_server_process] (0x0200): Found address for server nat.c.sdu.dk: [10.144.5.18] TTL 455
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: testina4$
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_set_port_status] (0x0100): Marking port 0 of server 'nat.c.sdu.dk' as 'not working
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_server_status] (0x1000): Status of server 'nat.c.sdu.dk' is 'name resolved'
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [get_port_status] (0x1000): Port status of port 0 for server 'nat.c.sdu.dk' is 'not working'
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 1,11,Offline
(Tue Nov 6 13:42:35 2012) [sssd[be[nat.c.sdu.dk]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.NAT.C.SDU.DK], [2][No such file or directory
-----
The error "port status of port 0 .." is not working - jumps out.
Testina4 is my linux host, joined to the AD by msktutils application - but maybe it hasn't get enough permissions granted to make a query in domain???
root@testina4:/etc/sssd# klist -e -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
13 testina4$(a)NAT.C.SDU.DK (arcfour-hmac)
13 testina4$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96)
13 testina4$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96)
14 testina4$(a)NAT.C.SDU.DK (arcfour-hmac)
14 testina4$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96)
14 testina4$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96)
14 host/testina4(a)NAT.C.SDU.DK (arcfour-hmac)
14 host/testina4(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96)
14 host/testina4(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96)
9 testina4$(a)NAT.C.SDU.DK (arcfour-hmac)
9 testina4$(a)NAT.C.SDU.DK (aes128-cts-hmac-sha1-96)
9 testina4$(a)NAT.C.SDU.DK (aes256-cts-hmac-sha1-96)
I can get object data for 'testina4' and AD 'imadatestuser' from command line run from 'testina4' (after I run kinit as AD adminuser) :
ldapsearch -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI -b 'ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=computer)(name=testina4))'
# extended LDIF
#
# LDAPv3
# base <ou=Linux computers,ou=ADResources,dc=nat,dc=c,dc=sdu,dc=dk> with scope subtree
# filter: (&(objectClass=computer)(name=testina4))
# requesting: ALL
# with pagedResults control: size=1000
#
# testina4, Linux computers, ADResources, nat.c.sdu.dk
dn: CN=testina4,OU=Linux computers,OU=ADResources,DC=nat,DC=c,DC=sdu,DC=dk
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: testina4
distinguishedName: CN=testina4,OU=Linux computers,OU=ADResources,DC=nat,DC=c,D
C=sdu,DC=dk
instanceType: 4
whenCreated: 20121019130319.0Z
whenChanged: 20121105144001.0Z
uSNCreated: 158837247
uSNChanged: 161473679
name: testina4
objectGUID:: os+KTql470WRz9dZ/6U3Tw==
userAccountControl: 4096
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 129959868084813523
lastLogoff: 0
lastLogon: 129966788793794911
localPolicyFlags: 0
pwdLastSet: 129959870279509463
primaryGroupID: 515
objectSid:: AQUAAAAAAAUVAAAANYoCGg16WjOCi6YoRy4AAA==
accountExpires: 9223372036854775807
logonCount: 42
sAMAccountName: testina4$
sAMAccountType: 805306369
dNSHostName: testina4.nat.c.sdu.dk
servicePrincipalName: host/testina4
objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=c,DC=sdu,DC=dk
isCriticalSystemObject: FALSE
dSCorePropagationData: 16010101000000.0Z
lastLogonTimestamp: 129966000010645525
msDS-SupportedEncryptionTypes: 28
# search result
search: 2
result: 0 Success
control: 1.2.840.113556.1.4.319 false MIQAAAAFAgEABAA=
pagedresults: cookie=
# numResponses: 2
# numEntries: 1
alongina@testina4:~$ ldapsearch -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI -b 'ou=ADusers,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=person)(sAMAccountName=imadatestuser))'
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired)
alongina@testina4:~$ kinit
Password for alongina(a)NAT.C.SDU.DK:
alongina@testina4:~$ ldapsearch -E pr=1000/noprompt -H ldap://nat.c.sdu.dk -Y GSSAPI -b 'ou=ADusers,dc=nat,dc=c,dc=sdu,dc=dk' '(&(objectClass=person)(sAMAccountName=imadatestuser))'
SASL/GSSAPI authentication started
SASL username: alongina(a)NAT.C.SDU.DK
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <ou=ADusers,dc=nat,dc=c,dc=sdu,dc=dk> with scope subtree
# filter: (&(objectClass=person)(sAMAccountName=imadatestuser))
# requesting: ALL
# with pagedResults control: size=1000
#
# IMADAtest Testesen, Odense, Institut for Matematik og Datalogi, ADUsers, na
t.c.sdu.dk
dn: CN=IMADAtest Testesen,OU=Odense,OU=Institut for Matematik og Datalogi,OU=A
DUsers,DC=nat,DC=c,DC=sdu,DC=dk
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: IMADAtest Testesen
sn: Testesen
l: Odense M
title: Professor
postalCode: 5230
givenName: IMADAtest
distinguishedName: CN=IMADAtest Testesen,OU=Odense,OU=Institut for Matematik o
g Datalogi,OU=ADUsers,DC=nat,DC=c,DC=sdu,DC=dk
instanceType: 4
whenCreated: 20091005131413.0Z
whenChanged: 20121019141347.0Z
displayName: IMADAtest Testesen
uSNCreated: 20103944
memberOf:: Q049Y29tbW9uX3VzZXJzLE9VPUbDpmxsZXMsT1U9SW5zdGl0dXR0ZXIsT1U9QURHcm9
1cHMsREM9bmF0LERDPWMsREM9c2R1LERDPWRr
memberOf:: Q049bmF0LWxlY3R1cmVzLE9VPUbDpmxsZXMsT1U9SW5zdGl0dXR0ZXIsT1U9QURHcm9
1cHMsREM9bmF0LERDPWMsREM9c2R1LERDPWRr
memberOf: CN=Imada-terminal-users,OU=Institut for Matematik og Datalogi (IMADA
),OU=Institutter,OU=ADGroups,DC=nat,DC=c,DC=sdu,DC=dk
uSNChanged: 117297654
department: Institut for Matematik og Datalogi
name: IMADAtest Testesen
objectGUID:: xevmnsllekOUPs5dy6xBUw==
userAccountControl: 512
badPwdCount: 0
codePage: 0
countryCode: 0
homeDirectory: \\sdu-data0.c.sdu.dk\staff\imadatestuser
homeDrive: M:
badPasswordTime: 129951292226925867
lastLogoff: 0
lastLogon: 129951296097614099
logonHours:: ////////////////////////////
pwdLastSet: 129951295698649008
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAANYoCGg16WjOCi6YolSgAAA==
accountExpires: 0
logonCount: 1
sAMAccountName: imadatestuser
sAMAccountType: 805306368
userPrincipalName: imadatestuser(a)nat.c.sdu.dk
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=c,DC=sdu,DC=dk
dSCorePropagationData: 20121026084647.0Z
dSCorePropagationData: 20120525083005.0Z
dSCorePropagationData: 20120328164019.0Z
dSCorePropagationData: 20111214110440.0Z
dSCorePropagationData: 16010714223649.0Z
lastLogonTimestamp: 129951296097540185
unixHomeDirectory: /home/imadatestuser
# search result
search: 4
result: 0 Success
control: 1.2.840.113556.1.4.319 false MIQAAAAFAgEABAA=
pagedresults: cookie=
# numResponses: 2
# numEntries: 1
Longina
-----Original Message-----
From: Stephen Gallagher [mailto:sgallagh@redhat.com]
Sent: 26. oktober 2012 15:22
To: End-user discussions about the System Security Services Daemon
Cc: Longina Przybyszewska; Timo Aaltonen
Subject: Re: [SSSD-users] startup problem
On Fri 26 Oct 2012 09:15:16 AM EDT, Longina Przybyszewska wrote:
> I have compiled 1.9.2 version and installed in the /usr/local/
>
> This way the other programs cant' use the new libraries
>
> The preferable way would be installing in the same places as native package would do.
>
> The native version In Ubuntu-quantal is 1.9.1 so the worse case
> would be event. regular upgrade to 1.9.2 some day.
>
> What are the relevant install options to 'configure' ?
>
SSSD has some pieces that *must* be in the standard locations or it will not function properly. These are the nss_sss.so.2 NSS libraries and the pam_sss.so PAM library.
If you are not familiar with packaging, you might have better luck coordinating with Timo Aaltonen, the Ubuntu/Debian maintainer for SSSD.
I believe he keeps an Ubuntu PPA with the latest bits somewhere.
CCing him on the conversation.
11 years, 5 months
libsss_autofs & rhel-x86_64-server-optional-6 repo
by Ondrej Valousek
Hi,
Is there any reasoning why is the library libsss_autofs:
1. not installed automatically along with autofs (the lookup_sss.so module, an integral part of autofs, is not functioning without this library)
2. If there is a reason for it, then why is it put in the optional repo? I mean, both sssd and autofs are in the main stream repo so I do
not quite understand why is just this library in the optional repo.
Thanks!
Ondrej
11 years, 5 months