ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder
HI!
Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with
StartTLS or LDAPS using client certs?
In a project they have certs in all systems anyway (because of using puppet)
and I'd like to let the sssd instances on all the systems authenticate to the
LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid
having to set/configure passwords for each system's sssd.
Ciao, Michael.
8 years, 2 months
SSSD + SSH Invalid Credentials
by Kevin Sullivan
I am pretty sure that invalid credentials means that I am typing in the
incorrect password, but I promise I am not. I am having an issue where I
cannot ssh as a user that is stored in LDAP. I can however use that same
user and password to perform a successful ldapsearch and ldapmodify. I am
guessing that I have something configured incorrectly. After a day of
searching in vain, I have decided to ask people that know better than I do.
I see a couple key parts:
1) In the /var/log/sssd/sssd_pam.log -- You can see that pam_reply is
called with a result of 6, which I believe is invalid credentials.
2) In the /var/log/sssd/sssd_default.log -- You can see that things seem to
be going well until the we get the message 'Bind result: Invalid
credentials(49)'. The simple bind doesn't work. How is this different from
ldapsearch?
Any thoughts or ideas?
Thanks,
Kevin
Note: I had to severely truncate some of my logs so I could get this email
under the 40K size limit. I can send more log information upon request.
/etc/password-auth:
auth required pam_env.so debug
auth [success=done new_authtok_reqd=done auth_err=die
perm_denied=die default=ignore] pam_sss.so forward_pass
auth sufficient pam_unix.so nullok use_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so debug
/etc/sssd/sssd.conf:
[domain/default]
debug_level = 9
ldap_id_use_start_tls = False
cache_credentials = False
ldap_search_base = dc=example,dc=com
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_group_member = member
chpass_provider = ldap
ldap_uri = ldaps://test-server/
ldap_tls_cacert = /etc/openldap/certs/cacert.pem
[sssd]
debug_level = 9
services = pam
config_file_version = 2
domains = default
/etc/openldap/slapd.conf:
TLSCertificateFile /etc/openldap/certs/server.pem
TLSCertificateKeyFile /etc/openldap/certs/server.pem
TLSCACertificateFile /etc/openldap/certs/cacert.pem
TLSVerifyClient allow
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
# enable users modifying their own passwords.
access to dn.exact=""
by * read
access to attrs=userPassword
by self write
by anonymous auth
by * break
access to dn.subtree="dc=example,dc=com"
by dn.exact="uid=jharden,ou=Users,dc=example,dc=com" manage
by self write
by anonymous read
by * none
#######################################################################
# database definitions
#######################################################################
database bdb
suffix "dc=example,dc=com"
checkpoint 1024 15
/var/log/sssd/sssd_default.log:
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_set_port_status]
(0x0100): Marking port 636 of server 'test-server' as 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [set_server_common_status]
(0x0100): Marking server 'test-server' as 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_connect_done]
(0x4000): notify connected to op #1
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_send]
(0x4000): Retrieving info for initgroups call
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_next_base]
(0x0400): Searching for users with base [dc=example,dc=com]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_generic_ext_step]
(0x0400): calling ldap_search_ext with
[(&(uid=jharden)(objectclass=posixAccount))][dc=example,dc=com].
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_generic_ext_step]
(0x2000): ldap_search_ext called, msgid = 2
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_connect_done]
(0x4000): caching successful connection after 1 notifies
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x16e7840], connected[1], ops[0x1791ec0],
ldap[0x16e60a0]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x16e7840], connected[1], ops[0x1791ec0],
ldap[0x16e60a0]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_parse_entry] (0x4000):
OriginalDN: [uid=jharden,ou=Users,dc=example,dc=com].
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x16e7840], connected[1], ops[0x1791ec0],
ldap[0x16e60a0]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_generic_ext_done]
(0x0400): Search result: Success(0), no errmsg set
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_user]
(0x4000): Receiving info for the user
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): start ldb
transaction (nesting: 0)
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_user]
(0x4000): Storing the user
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x4000):
Save user
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x2000):
Adding originalDN [uid=jharden,ou=Users,dc=example,dc=com] to attributes of
[jharden].
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x1000):
Original memberOf is not available for [jharden].
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_attrs_add_ldap_attr]
(0x2000): Adding original mod-Timestamp [20140320231721Z] to attributes of
[jharden].
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_save_user] (0x0400):
Storing info for user jharden
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_user]
(0x4000): Process user's groups
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_initgr_common_store]
(0x2000): Updating memberships for jharden
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): start ldb
transaction (nesting: 1)
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): commit ldb
transaction (nesting: 1)
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): commit ldb
transaction (nesting: 0)
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_get_initgr_done]
(0x4000): Initgroups done
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_connect_step]
(0x4000): reusing cached connection
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_destroy]
(0x4000): releasing operation connection
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_id_op_done] (0x4000):
releasing operation connection
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]]
[acctinfo_initgroups_callback] (0x0080): NSS Service not conected
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [acctinfo_callback]
(0x0100): Request processed. Returned 0,0,Success
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x16e7840], connected[1], ops[(nil)], ldap[0x16e60a0]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000):
dbus conn: 16DEE20
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000):
Dispatching.
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sbus_message_handler]
(0x4000): Received SBUS method [pamHandler]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler] (0x0100):
Got request with the following data
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
command: PAM_AUTHENTICATE
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
domain: default
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
user: jharden
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
service: sshd
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
tty: ssh
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
ruser:
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
rhost: test-server
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
authtok type: 1
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
authtok size: 13
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
newauthtok type: 0
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
newauthtok size: 0
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
priv: 1
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [pam_print_data] (0x0100):
cli_pid: 24982
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'LDAP'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [get_server_status]
(0x1000): Status of server 'test-server' is 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [get_port_status] (0x1000):
Port status of port 636 for server 'test-server' is 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]]
[fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 10
seconds
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [get_server_status]
(0x1000): Status of server 'test-server' is 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_resolve_server_process]
(0x1000): Saving the first resolved server
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_resolve_server_process]
(0x0200): Found address for server test-server: [127.0.0.1] TTL 7200
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [auth_resolve_done]
(0x2000): [ldaps://test-server/] is a secure channel. No need to run
START_TLS
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sss_ldap_init_send]
(0x4000): Using file descriptor [20] for LDAP connection.
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sss_ldap_init_send]
(0x0400): Setting 6 seconds timeout for connecting
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldaps://test-server:636/??base] with fd [20].
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [fo_set_port_status]
(0x0100): Marking port 636 of server 'test-server' as 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [set_server_common_status]
(0x0100): Marking server 'test-server' as 'working'
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed
event "ltdb_callback": 0x17c0950
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed
event "ltdb_timeout": 0x17c0a70
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Destroying
timer event 0x17c0a70 "ltdb_timeout"
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): Ending timer
event 0x17c0950 "ltdb_callback"
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]]
[find_password_expiration_attributes] (0x4000): No password policy
requested.
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_send] (0x0100):
Executing simple bind as: uid=jharden,ou=Users,dc=example,dc=com
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_send] (0x2000):
ldap simple bind sent, msgid = 1
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_result]
(0x2000): Trace: sh[0x16e4410], connected[1], ops[0x1794440],
ldap[0x1791f40]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_BIND]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_done] (0x1000):
Server returned no controls.
*(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [simple_bind_done]
(0x0400): Bind result: Invalid credentials(49), no errmsg set*
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [sdap_handle_release]
(0x2000): Trace: sh[0x16e4410], connected[1], ops[(nil)], ldap[0x1791f40],
destructor_lock[0], release_memory[0]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [remove_connection_callback]
(0x4000): Successfully removed connection callback.
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler_callback]
(0x0100): Backend returned: (0, 6, <NULL>) [Success]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler_callback]
(0x0100): Sending result [6][default]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [be_pam_handler_callback]
(0x0100): Sent result [6][default]
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [ldb] (0x4000): start ldb
transaction (nesting: 0)
(Thu Mar 20 23:25:04 2014) [sssd[be[default]]] [cleanup_users] (0x4000):
Cache expiration is set to 0 days
/var/log/sssd/sssd_pam.log:
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_check_user_search] (0x0400):
Returning info for user [jharden@default]
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_initgr_cache_set] (0x2000):
[jharden] added to PAM initgroup cache
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending
request with the following data:
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): command:
PAM_AUTHENTICATE
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): domain:
default
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): user:
jharden
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): service:
sshd
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser:
not set
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost:
test-server
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok
type: 1
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok
size: 13
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok size: 0
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid:
24982
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_add_timeout] (0x2000):
0x2357220
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_dom_forwarder] (0x0100):
pam_dp_send_req returned 0
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x41b300:3:jharden@default]
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0x2357220
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
23568B0
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [sbus_dispatch] (0x4000):
Dispatching.
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_dp_process_reply] (0x0100):
received: [6][default]
*(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply
called with result [6].*
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [pam_reply] (0x0100): blen: 24
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x2358760][19]
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x2358760][19]
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [client_recv] (0x0200): Client
disconnected!
(Thu Mar 20 23:25:04 2014) [sssd[pam]] [client_destructor] (0x2000):
Terminated client [0x2358760][19]
(Thu Mar 20 23:25:09 2014) [sssd[pam]] [pam_initgr_cache_remove] (0x2000):
[jharden] removed from PAM initgroup cache
9 years, 2 months
SSSD + PAM configuration
by Kevin Sullivan
After trying for several days, I want to ask if this is even possible:
I am running CentOS 6.4 and I have sssd-1.9.2-82 installed. I would like to
log into my machine by querying an OpenLDAP server running else where. The
big difference that I have from the normal sssd setup, is I only want to
use the local Unix accounts (/etc/passwd and /etc/shadow) if my LDAP server
is offline.
So how do I do this? Should I be able to do all of this through pam? Either
way, the issue I am seeing with sssd is the return value of pam when sssd
can't connect to my ldap server. It always returns 'user_unknown' instead
of 'authinfo_unavail' as I would expect. Am I configuring something
incorrectly?
/etc/pam.d/password-auth:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth [success=done new_authtok_reqd=done authinfo_unavail=ignore
default=die] pam_sss.so forward_pass
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
/etc/sssd/sssd.conf:
[domain/default]
debug_level = 9
ldap_search_base = dc=example,dc=com
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_access_filter = memberOf=cn=group,ou=Roles,dc=example,dc=com
ldap_group_member = memberUid
ldap_group_search_base = ou=Roles,dc=example,dc=com
chpass_provider = ldap
ldap_uri = ldap://test-server/
[sssd]
debug_level = 9
services = pam
config_file_version = 2
domains = default
[nss]
debug_level = 9
[pam]
debug_level = 9
[sudo]
debug_level = 9
[autofs]
debug_level = 9
[ssh]
debug_level = 9
[pac]
debug_level = 9
/var/log/sssd/sssd_default.log:
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_message_handler]
(0x4000): Received SBUS method [getAccountInfo]
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [be_get_account_info]
(0x0100): Got request for [3][1][name=user]
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed
event "ltdb_callback": 0x196b8f0
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed
event "ltdb_timeout": 0x196c2b0
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Destroying
timer event 0x196c2b0 "ltdb_timeout"
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Ending timer
event 0x196b8f0 "ltdb_callback"
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [acctinfo_callback]
(0x0100): Request processed. Returned 1,11,Offline
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000):
dbus conn: 1964B00
(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_dispatch] (0x4000):
Dispatching.
/var/log/sssd/sssd_pam.log:
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [accept_fd_handler] (0x0400): Client
connected to privileged pipe!
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x6cc030][19]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200):
Received client version [3].
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200):
Offered version [3].
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x6cc030][19]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x6cc030][19]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_cmd_authenticate] (0x0100):
entering pam_cmd_authenticate
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): name 'user' matched without domain, user is user
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_parse_name_for_domains]
(0x0200): using default domain [(null)]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): command:
PAM_AUTHENTICATE
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): domain:
not set
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): user: user
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): service:
sshd
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser:
not set
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost:
test-server
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok
type: 1
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok
size: 8
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok type: 0
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100):
newauthtok size: 0
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid:
10665
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_ncache_check_str] (0x2000):
Checking negative cache for [NCE/USER/default/user]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_issue_request] (0x0400):
Issuing request for [0x41b300:3:user@default]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_get_account_msg] (0x0400):
Creating request for [default][3][1][name=user]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x6cdf20
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_internal_get_send] (0x0400):
Entering request [0x41b300:3:user@default]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_remove_timeout] (0x2000):
0x6cdf20
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn:
6C8DE0
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sbus_dispatch] (0x4000):
Dispatching.
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got
reply from Data Provider - DP error code: 1 errno: 11 error message: Offline
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_check_user_dp_callback]
(0x0040): Unable to get information from Data Provider
Error: 1, 11, Offline
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_check_user_search] (0x0100):
Requesting info for [user@default]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x6d7360
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x6d7480
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Destroying timer
event 0x6d7480 "ltdb_timeout"
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [ldb] (0x4000): Ending timer event
0x6d7360 "ltdb_callback"
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_check_user_search] (0x0080): No
matching domain found for [user], fail!
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply
called with result [10].
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [pam_reply] (0x0100): blen: 8
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x41b300:3:user@default]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x6cc030][19]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [reset_idle_timer] (0x4000): Idle
timer re-set for client [0x6cc030][19]
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [client_recv] (0x0200): Client
disconnected!
(Tue Mar 18 19:09:52 2014) [sssd[pam]] [client_destructor] (0x2000):
Terminated client [0x6cc030][19]
I tried to provide only the portions of files that I found relevant. I can
provide more upon request.
Thanks,
Kevin
9 years, 2 months
Re: [SSSD-users] no permission -sssd-1.11.1 Trusty automount nfs4+krb
by Longina Przybyszewska
I get crazy.
I can login to the client with AD passwd but it seems that have no right credentials to access
automounted homedir . But I can access homedir on the server as owner of homedir.
Both, have the same sssd.conf, krb5.conf
My configuration allows for accessing nfs share on machine level but not on user level on the client at least..
On nfs4+krb client:
======================
Ssh longina@jedi
Could not chdir to home directory /home/longina: Permission denied
-bash: /home/longina/.bash_profile: Permission denied
longina@jedi:/$ cd /home/longina
-bash: cd: /home/longina: Permission denied
longina@jedi:/$
-----------------------------
root@jedi:~# less /proc/mounts
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
.......
.......
systemd /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,name=systemd 0 0
/etc/auto.home /home autofs rw,relatime,fd=12,pgrp=1934,timeout=300,minproto=5,maxproto=5,indirect 0 0
/etc/auto.msshare /Mshare autofs rw,relatime,fd=18,pgrp=1934,timeout=300,minproto=5,maxproto=5,indirect 0 0
gvfsd-fuse /run/user/111/gvfs fuse.gvfsd-fuse rw,nosuid,nodev,relatime,user_id=111,group_id=117 0 0
jota.nat.c.example.org:/nfs4/jota/longina /home/longina nfs4 rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_lock=none,addr=10.144.4.254 0 0
===============================
On nfs-krb5 server - no problem with accessing homedir for user 'longina':
root@jota:~# su - longina
longina@jota:/$ cd /nfs4/jota/longina
longina@jota:/nfs4/jota/longina$ mkdir created_by_longina_on_jota
longina@jota:/nfs4/jota/longina$ ls -l
total 12
drwxr-xr-x 2 longina domain users 4096 Mar 12 09:53 created_by_longina_on_jota
-rw-r--r-- 1 longina domain users 0 Mar 10 10:21 created_by_long_on_jota
drwxr-xr-x 2 longina domain users 4096 Feb 27 13:46 created_on_jota
cat /etc/exports:
....
/nfs4/jota 10.80.8.0/24(rw,sync,no_subtree_check,sec=krb5p:krb5i:krb5)
....
Best
Longina
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Longina Przybyszewska
Sent: 10. marts 2014 12:59
To: 'dpal(a)redhat.com'; sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd
The krb5.conf is configured differently on both machines:
on server , is defined one realm, one domain.
On client, multidomain, multi realm.
User is from domain/realm known on both machines (NAT.C.EXAMPLE.COM)
Best
Longina
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Dmitri Pal
Sent: 7. marts 2014 16:32
To: sssd-users(a)lists.fedorahosted.org
Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd
On 03/07/2014 06:02 AM, Longina Przybyszewska wrote:
> Hi again,
> The pieces of the automount works almost... ;( My transition step
> towards getting automount on login with 'autofs' as sssd service, looks like that:
>
> -I can authenticate with sssd and AD as id/access/auth_provider
> - can login to machine from login GUI directly into local home
> directory /Lshare/long
> - here from, using cd /home/long activates automount; Directory is mounted, but user has no permissions
> to access it
> - sssd on client is configured without 'autofs' service (as I have no sign of automount nis-schema
> In AD, even if there is installed SFU) -nsswitch says :
> automount: files sss
If you are not using SSSD for delivering the maps then you do not need 'sss' here. But this is not the problem you are seeing.
>
> cat /proc/mounts:
>
> /etc/auto.home /home autofs
> rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec
> t 0 0 /etc/auto.nfs /nfs autofs
> rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect
> 0 0 /etc/auto.msshare /Mshare autofs
> rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec
> t 0 0 jota.a.domain.com:/nfs4/jota/long /home/long nfs4
> rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto
> =tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_
> lock=none,addr=10.144.4.254 0 0
>
> df -h shows ikke that mount.
>
> Both , client and server run the same version of sssd-1.11.1, and user 'long' is seen as a member of the same groups on both machines.
Does it have same UID/GID on both machines?
>
> If I run as root on client 'cd /home/long', homdir is mounted:
>
> cat /proc/mounts
> /etc/auto.home /home autofs
> rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec
> t 0 0 /etc/auto.nfs /nfs autofs
> rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect
> 0 0 /etc/auto.msshare /Mshare autofs
> rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirec
> t 0 0 jota.a.domain.com:/nfs4/jota/long /home/long nfs4
> rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto
> =tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_
> lock=none,addr=10.144.4.254 0 0
>
> df -h
> ...
> jota.a.domain.com:/nfs4/jota/long 1.8T 2.1G 1.7T 1% /home/long
> Any ideas ?
>
> Best
> longina
>
> Med venlig hilsen
>
> Longina Przybyszewska
> Systemprogrammør, IT-service
>
> Tlf. +45 6550 2359
> Mobil +45 6011 2359
> Email longina(a)sdu.dk
> Web http://www.sdu.dk/ansat/longina
> Adr. Campusvej 55, 5230 Odense M
>
> SYDDANSK UNIVERSITET
> _______________________________________________________________
> Campusvej 55 * 5230 * Odense M * Tlf. +45 6550 1000 * www.sdu.dk
>
>
>
> -----Original Message-----
> From: sssd-users-bounces(a)lists.fedorahosted.org
> [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of
> Longina Przybyszewska
> Sent: 27. februar 2014 16:56
> To: 'End-user discussions about the System Security Services Daemon'
> Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd
> problem
>
> Hi,
> Ubuntu Saucy nfs4+krb+sssd server
> Ubuntu Trusty client,sssd+autofs
>
> I can manually mount directory (nfs4+krb) as root on the client.
>
> Is it possible on client, use SSSD with autofs service, with automounter referring to the flat files , /etc/auto.master ,/etc/auto.home, not to ldap?
>
>
> How can I check if autofs delivered with distribution supports sssd?
>
> Best
> longina
>
>
>
> -----Original Message-----
> From: sssd-users-bounces(a)lists.fedorahosted.org
> [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej
> Valousek
> Sent: 20. februar 2014 13:48
> To: End-user discussions about the System Security Services Daemon
> Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb
> problem)
>
> Created BZ:
> https://bugzilla.redhat.com/show_bug.cgi?id=1067423
>
> attached is a patch resolving the issue.
> Ondrej
> ________________________________________
> From: sssd-users-bounces(a)lists.fedorahosted.org
> [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Simo Sorce
> [simo(a)redhat.com]
> Sent: Wednesday, February 19, 2014 7:35 PM
> To: End-user discussions about the System Security Services Daemon
> Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb
> problem)
>
> On Wed, 2014-02-19 at 15:04 +0000, Ondrej Valousek wrote:
>> Hi Simo,
>>
>> I are you getting on about this with Steve?
> This is the current situation:
> <steved> simo: post a patch with what you want and lets talk about it....
>
> :-)
>
>> Would it be better to open a RFE for this? I would like to know where
>> we are standing - whether there is any chance that RHEL6 will be
>> fixed or it would only go to RHEL 7.
> An RFE for RHEL7 would be nice.
>
> Simo.
>
> --
> Simo Sorce * Red Hat, Inc * New York
>
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
9 years, 2 months
Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd
by Longina Przybyszewska
Hi again,
The pieces of the automount works almost... ;(
My transition step towards getting automount on login with 'autofs' as sssd service, looks like that:
-I can authenticate with sssd and AD as id/access/auth_provider
- can login to machine from login GUI directly into local home directory /Lshare/long
- here from, using cd /home/long activates automount; Directory is mounted, but user has no permissions
to access it
- sssd on client is configured without 'autofs' service (as I have no sign of automount nis-schema
In AD, even if there is installed SFU)
-nsswitch says :
automount: files sss
cat /proc/mounts:
/etc/auto.home /home autofs rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0
/etc/auto.nfs /nfs autofs rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0
/etc/auto.msshare /Mshare autofs rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0
jota.a.domain.com:/nfs4/jota/long /home/long nfs4 rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_lock=none,addr=10.144.4.254 0 0
df -h shows ikke that mount.
Both , client and server run the same version of sssd-1.11.1, and user 'long' is seen as a member of the same groups on both machines.
If I run as root on client 'cd /home/long', homdir is mounted:
cat /proc/mounts
/etc/auto.home /home autofs rw,relatime,fd=13,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0
/etc/auto.nfs /nfs autofs rw,relatime,fd=7,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0
/etc/auto.msshare /Mshare autofs rw,relatime,fd=19,pgrp=15088,timeout=300,minproto=5,maxproto=5,indirect 0 0
jota.a.domain.com:/nfs4/jota/long /home/long nfs4 rw,relatime,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=10.80.8.91,local_lock=none,addr=10.144.4.254 0 0
df -h
...
jota.a.domain.com:/nfs4/jota/long 1.8T 2.1G 1.7T 1% /home/long
Any ideas ?
Best
longina
Med venlig hilsen
Longina Przybyszewska
Systemprogrammør, IT-service
Tlf. +45 6550 2359
Mobil +45 6011 2359
Email longina(a)sdu.dk
Web http://www.sdu.dk/ansat/longina
Adr. Campusvej 55, 5230 Odense M
SYDDANSK UNIVERSITET
_______________________________________________________________
Campusvej 55 * 5230 * Odense M * Tlf. +45 6550 1000 * www.sdu.dk
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Longina Przybyszewska
Sent: 27. februar 2014 16:56
To: 'End-user discussions about the System Security Services Daemon'
Subject: Re: [SSSD-users] sssd-1.11.1 Trusty automount nfs4+krb+sssd problem
Hi,
Ubuntu Saucy nfs4+krb+sssd server
Ubuntu Trusty client,sssd+autofs
I can manually mount directory (nfs4+krb) as root on the client.
Is it possible on client, use SSSD with autofs service, with automounter referring to the flat files , /etc/auto.master ,/etc/auto.home, not to ldap?
How can I check if autofs delivered with distribution supports sssd?
Best
longina
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej Valousek
Sent: 20. februar 2014 13:48
To: End-user discussions about the System Security Services Daemon
Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem)
Created BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=1067423
attached is a patch resolving the issue.
Ondrej
________________________________________
From: sssd-users-bounces(a)lists.fedorahosted.org [sssd-users-bounces(a)lists.fedorahosted.org] on behalf of Simo Sorce [simo(a)redhat.com]
Sent: Wednesday, February 19, 2014 7:35 PM
To: End-user discussions about the System Security Services Daemon
Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem)
On Wed, 2014-02-19 at 15:04 +0000, Ondrej Valousek wrote:
> Hi Simo,
>
> I are you getting on about this with Steve?
This is the current situation:
<steved> simo: post a patch with what you want and lets talk about it....
:-)
> Would it be better to open a RFE for this? I would like to know where
> we are standing - whether there is any chance that RHEL6 will be fixed
> or it would only go to RHEL 7.
An RFE for RHEL7 would be nice.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
9 years, 2 months
Problem Authenticating with Sun DS 5.2
by Matt Mencel
I am running Centos 6.5 and installed the latest SSSD from the IPA repo, 1.11.90.
I've got it working to the point where I can run the 'id' command and it will return an LDAP user. When I try to authenticate using SSH however I just get "Permission denied". The SSSD log shows the bind is invalid, as if I'm using a bad password or bind DN.
(Tue Mar 4 15:20:29 2014) [sssd[be[LDAP]]] [simple_bind_done] (0x0400): Bind result: Invalid credentials(49), no errmsg set
On my LDAP server I see that it is returning err=49.
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=-1 msgId=-1 - fd=520 slot=520 LDAPS connection from 10.50.2.35 to 10.50.2.10
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=-1 msgId=-1 - SSL 128-bit RC4
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=0 msgId=1 - BIND dn="uid=ACCOUNT,ou=People,dc=here,dc=com" method=128 version=3
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=0 msgId=1 - RESULT err=49 tag=97 nentries=0 etime=0
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=1 msgId=2 - UNBIND
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=1 msgId=-1 - closing - U1
[04/Mar/2014:15:22:52 -0600] conn=2287156 op=-1 msgId=-1 - closed.
I've tested over and over and I know I'm using the correct password. Tried multiple accounts all with their correct passwords and get the same result.
I'm not using TLS, just LDAPS on port 636. Could it be that SSSD is using RC4 encryption and our LDAP server doesn't support RC4? Just not sure where else to go with this.
This is my SSSD config.
[domain/LDAP]
auth_provider = ldap
cache_credentials = True
chpass_provider = ldap
entry_cache_timeout = 600
enumerate = false
id_provider = ldap
ldap_id_use_start_tls = False
ldap_schema = rfc2307bis
ldap_search_base = dc=here,dc=com
ldap_user_search_base = ou=people,dc=here,dc=com
ldap_user_object_class = myObjClass
ldap_user_name = uid
ldap_group_seach_base = ou=groups,dc=here,dc=com
ldap_group_object_class = groupofuniquenames
ldap_page_size = 100
ldap_uri = ldaps://ldap.here.com:636
debug_level = 9
ldap_default_bind_dn = cn=BINDUSER,ou=applications,dc=here,dc=com
ldap_default_authtok = XXXXXXXX
ldap_network_timeout = 3
ldap_tls_cacertdir = /etc/openclad/cacert
ldap_tls_reqcert = never
ldap_access_filter = (department=My Department)
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
filter_users = root,named,avahi,haldaemon,dbus,radiusd,news,nscd
[pam]
9 years, 2 months