ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder
HI!
Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with
StartTLS or LDAPS using client certs?
In a project they have certs in all systems anyway (because of using puppet)
and I'd like to let the sssd instances on all the systems authenticate to the
LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid
having to set/configure passwords for each system's sssd.
Ciao, Michael.
8 years, 8 months
RFC: dropping upstream support of RHEL5 starting with 1.10
by Jakub Hrozek
Hi,
many new features rely on library APIs and features that are only available
in recent versions of SSSD dependencies. As a result, the code often needs
#ifdefs and special branches in order to at least compile or run on RHEL5.
So far we've been doing nightly builds also for RHEL5 and fixing issues
as we were finding them. But recently we are considering dropping support
for RHEL5 -- it is causing some engineering effort and at the same time
the audience is probably very limited. If you are running super-stable
enterprise distribution, chances are you are not all that interested in
the latest and possibly very unstable SSSD version.
The proposal would be to keep building and supporting the 1.9.x branch
for RHEL5 and switch to using RHEL6 as the oldest supported release
starting from the 1.10 upstream version. Of course we would still accept
patches from any potential contributors.
Any objections against the plan?
10 years, 7 months
SSSD, Linux Mint 14 and Samba 4 AD Server
by Rowland Penny
Hello, I am trying to use sssd instead of winbind against a samba 4 AD
server. After looking around the internet, I have got to the point where
I can get a domain users info with 'getent passwd <domainuser>' and 'id
<domainuser>'. I can also create a directory and chmod it
<domainuser>:users, what I cannot do is login into the computer through
ssh or the login GUI on the computer. This is on Linux Mint 14 using
sssd 1.9.1.
Does anybody have any idea why sssd seems to work but fails in a very
important way.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
10 years, 8 months
sss_ssh_authorizedkeys returns "Error looking up public keys"
by Mathieu Lemoine
Hello,
I have sssd 1.9.4 (from
https://launchpad.net/~nicholas-hatch/+archive/auth/+packages) configured
on an OpenLDAP server.
getent passwd, getent group, authentication and cache is working great.
My issue now lies with the SSH public key.
My user has the ldapPublicKey objectClass, and the key is in the
sshPublicKey attribute.
sss_ssh_authorizedkeys is still returning "Error looking up public keys".
An inquiry on the #sssd chan directed me to this mailing-list and more
precisely to jcholast, I tried to check out the commits, but nothing seems
to get out of it...
If any of you had informations regarding that, it'd be greatly appreciated.,
Mathieu.
10 years, 8 months
Re: [SSSD-users] RHEL5-builds of sssd 1.9.4
by Michael Ströder
On Thu, 28 Mar 2013 10:16:27 -0400 Stephen Gallagher <sgallagh(a)redhat.com>
wrote
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu 28 Mar 2013 10:15:10 AM EDT, Michael Ströder wrote:
> > On Thu, 28 Mar 2013 10:05:35 -0400 Stephen Gallagher
> > <sgallagh(a)redhat.com> wrote
> >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> >>
> >> On Thu 28 Mar 2013 10:01:43 AM EDT, Michael Ströder wrote:
> >>> Ok, now I'm stuck with this output of OpenLDAP lib checks when
> >>> running 1.9.4's configure:
> >>>
> >>> checking for LDAPDerefRes... no configure: error: The OpenLDAP
> >>> version found does not contain the required type LDAPDerefRes
> >>>
> >>> I guess this is because the OpenLDAP 2.3.43 libs that come
> >>> with RHEL5 does not contain support for the experimental deref
> >>> LDAP control.
> >>>
> >>> Since I don't need it my question is: Any chance to disable
> >>> this when running configure?
> >>
> >> RHEL 5.6 and later have an openldap24-libs-devel package that you
> >> can build against.
> >
> > This does not seam to be in the standard 5.6 repo. In which repo
> > can I find that?
> >
>
> Sorry, I was incorrect. It's in 5.7, not 5.6.
Ok, I've grabbed openldap24-libs-devel from more recent RHEL 5.8, applying the
above mentioned patch and after installing myriads of other -devel packages the
build fails:
libtool: link: gcc -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith
-Wcast-qual -Wcast-align -Wwrite-strings -Werror-implicit-function-declaration
-fno-strict-aliasing -std=gnu99 -g -O2 -D_FILE_OFFSET_BITS=64
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -o sss_ssh_authorizedkeys
src/sss_client/sss_ssh_authorizedkeys-common.o
src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_client.o
src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_authorizedkeys.o
/.libs/libsss_util.a -ltevent -ltalloc -lpopt -lldb -L/lib64 -ldbus-1 -lpcre
-lini_config -lcollection -ldhash -L/usr/lib64/openldap24 -llber -lldap -ltdb
-lglib-2.0 -lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4 -lpthread
-ldl
/usr/bin/ld: warning: libpath_utils.so.1, needed by
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so, not
found (try using -rpath or -rpath-link)
/usr/bin/ld: warning: libref_array.so.1, needed by
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so, not
found (try using -rpath or -rpath-link)
/usr/bin/ld: warning: libbasicobjects.so.0, needed by
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so, not
found (try using -rpath or -rpath-link)
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_alloc'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_replace'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_get_buf'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_reset'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_get_len'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_append'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_free'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_create'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_copy'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_add_cr'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_len'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_remove'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_getlen'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `make_normalized_absolute_path'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_destroy'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_insert'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_add_str'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_get'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `ref_array_swap'
/usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so:
undefined reference to `simplebuffer_add_raw'
collect2: ld returned 1 exit status
make[2]: *** [sss_ssh_authorizedkeys] Error 1
make[2]: Leaving directory `/home/mstroeder/sssd-1.9.4'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/mstroeder/sssd-1.9.4'
make: *** [all] Error 2
Ciao, Michael.
10 years, 8 months
RHEL5-builds of sssd 1.9.4
by Michael Ströder
HI!
Are there any ready-to-use RPMs of sssd 1.9.4 for RHEL5 or CentOS5?
Ciao, Michael.
10 years, 8 months
SSSD-AD mkhomedir not working
by Sutton, Harry (GSSE)
Okay, on my Fedora 18 laptop, I can login to my system as an Active
Directory user (sssd-ad), both via ssh from a remote system and locally
through one of the console (Ctrl-Alt-F2) screens. (I haven't succeeded
in getting the GDM login process to work yet.) But in both login cases,
I end up in / as my current directory; the home directory does not get
created.
The oddjobd daemon is running, and I have an entry for
pam_oddjob_mkhomedir in /etc/pam.d/system-auth, (and it shows as
'enabled' in the output of authconfig --test) but the directory isn't
created on login. I apologize if this question has been asked and
answered before, but I'm under some time pressure to complete a training
seminar here at HP for making RHEL / AD Integration work and I don't
have the time to sift through the list archives.
I can provide configuration files and debug log output on request, but
I've gone through most of it and haven't found an obvious cause for this
problem. Any suggestions would be greatly appreciated.
Regards,
/Harry Sutton, HP
10 years, 8 months
AuthorizedKeysCommand functionality part of upstream OpenSSH 6.2
by Jan Cholasta
Hi,
this is just a heads up that the AuthorizedKeysCommand functionality,
which is necessary for the user keys part of OpenSSH integration in SSSD
and was previously available in OpenSSH packages only in few Linux
distros (Fedora, RHEL, Madriva), is now part of upstream OpenSSH as of
version 6.2 (see <http://www.openssh.com/txt/release-6.2>). Once this
version is adopted by other Linux distros (and other OSes), SSSD OpenSSH
integration will fully work in them as well.
Honza
--
Jan Cholasta
10 years, 8 months
squeeze backport
by Angel Bosch
hi,
Is there any sssd package greater than 1.2 for debian squeeze ?
I need to mantain squeeze in some servers and I would like to install 1.8 on them.
àngel
--
10 years, 8 months