sssd simple access provider questions
by aaron wang
Hi all,
For simple access provider, is there a way to configure it to deny every
user from the domain(LDAP) by using some combinations of simple_allow_* and
simple_deny_* ?
I'm developing a base sssd configuration for the users to modify, right now
the default is:
simple_allow_group = (empty string here)
This will allow everyone to login, but I want to keep the default config to
deny every user from LDAP considering security.
Thanks,
Aaron
8 years, 4 months
How do I disable SRV lookup?
by Ondrej Valousek
Hi list,
How do I completely disable SRV lookups? This functionality is corrupted in SSSD so I wanted to disable it completely by defining ad servers explicitely:
ad_server = myserver1, myserver2
ldap_uri = ldap://myserver1, ldap://myserver2
subdomains_provider = none
ldap_use_tokengroups = False
ad_domain = TEST.COM
However, in logs I can still see the SRV plugin in action trying to populate AD servers automatically.
Is it possible somehow?
Many thanks,
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
8 years, 4 months
sssd with krb5 auth and local ids
by Alexander 'Leo' Bergolth
Hi!
I am trying to configure sssd-1.12.2-58.el7 with auth_provider=krb5 but
ids from the local /etc/passwd and group files.
According to
https://fedorahosted.org/sssd/wiki/DesignDocs/KerberosPrincipalMappingToP...
... I configured sssd to use id_provider=proxy with proxy_lib_name=files
and auth_provider=krb5.
However, krb5 srv discovery dosn't work with this setup. If I don't
specify a krb5_server, sssd complains about:
-------------------- 8< --------------------
(Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [resolve_srv_send] (0x0200):
The status of SRV lookup is neutral
(Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [resolve_srv_send] (0x0040):
No SRV lookup plugin is set
(Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [be_resolve_server_done]
(0x1000): Server resolution failed: 14
(Tue Dec 1 18:34:54 2015) [sssd[be[WU]]] [be_mark_offline] (0x2000):
Going offline!
-------------------- 8< --------------------
Do you have any hints?
Cheers,
--leo
P.S.: Full log output and config is available at
http://leo.kloburg.at/tmp/sssd-krb5-proxy/
--
e-mail ::: Leo.Bergolth (at) wu.ac.at
fax ::: +43-1-31336-906050
location ::: IT-Services | Vienna University of Economics | Austria
8 years, 4 months
Kerberos ticket renewal with AD
by Andy Airey
Hello,
I've been trying to get this working for several weeks now, but the
kerberos tickets keep expiring after 7 days.
They just expired again today. I think I have set up everything correctly,
but it still doesn't seem to work.
I hope someone on this list can point me in the right direction.
Below is some more information.
The machine is joined to an Active Directory realm with net ads join -k.
[root@hostname ~] cat /etc/krb5.conf
> [logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
>
>
> [libdefaults]
> default_realm = EXAMPLE.COM
> dns_lookup_realm = true
> dns_lookup_kdc = true
> ticket_lifetime = 24h
> renew_lifetime = 7d
> forwardable = true
>
> [realms]
> # Define only if DNS lookups are not working
> # example.com = {
> # kdc = DC01
> # admin_server = DC01.example.com
> # }
>
> # EXAMPLE.COM = {
> # kdc = DC01.example.com
> # kdc = DC02.example.com
> # kdc = DC03.example.com
> # kdc = DC04.example.com
> # }
>
> [domain_realm]
> # Define only if DNS lookups are not working
> # .brain.com = EXAMPLE.COM
> # example.com = EXAMPLE.COM
>
[root@hostname ~] cat /etc/samba/smb.conf
> #removed commented lines
> [global]
> security = ads
> passdb backend = tdbsam
> realm = EXAMPLE.COM
>
> password server = dc01.example.com dc02.example.com
> kerberos method = secrets and keytab
> client signing = yes
> client use spnego = yes
>
> load printers = yes
> cups options = raw
>
> [homes]
> comment = Home Directories
> browseable = no
> writable = yes
>
> [printers]
> comment = All Printers
> path = /var/spool/samba
> browseable = no
> guest ok = no
> writable = no
> printable = yes
>
[root@hostname ~] cat /etc/sssd/sssd.conf
> [sssd]
> domains = example.com
> config_file_version = 2
> services = nss, pam, pac, sudo, autofs
> debug_level = 6
>
> [nss]
> debug_level = 3
>
> [pam]
> debug_level = 3
>
> [sudo]
> debug_level = 3
>
> [autofs]
> debug_level = 3
>
> [domain/example.com]
> debug_level = 6
>
> ad_domain = example.com
> ad_hostname = hostname.example.com
> krb5_realm = EXAMPLE.COM
> cache_credentials = True
> id_provider = ad
> auth_provider = krb5
> krb5_store_password_if_offline = True
> default_shell = /bin/bash
> ldap_id_mapping = False
> use_fully_qualified_names = False
> fallback_homedir = /home/users/%u
> access_provider = ad
>
> # LDAP settings
>
> ldap_schema = rfc2307bis
> # Unless you know you need referrals, turn them off
> ldap_referrals = false
> # Uncomment if you need offline logins
> # cache_credentials = true
> enumerate = false
>
> ldap_sasl_mech = GSSAPI
>
> ldap_user_search_base = ou=Brain2HQ,dc=brain2,dc=com
> ldap_user_object_class = user
>
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_principal = userPrincipalName
>
> ldap_group_search_base = ou=Groups,dc=brain2,dc=com
> ldap_group_object_class = group
>
> ldap_access_order = expire
> ldap_account_expire_policy = ad
> ldap_force_upper_case_realm = true
>
> # sudo settings
> sudo_provider = ldap
> ldap_sudo_search_base = ou=sudoers,dc=brain2,dc=com
>
> # autofs settings
> autofs_provider = ldap
> ldap_autofs_search_base=ou=automount,dc=brain2,dc=com
> ldap_autofs_map_object_class=nisMap
> ldap_autofs_entry_object_class=nisObject
> ldap_autofs_map_name=nisMapName
> ldap_autofs_entry_key=cn
> ldap_autofs_entry_value=nisMapEntry
>
> # shell settings
> allowed_shells = /bin/sh,/bin/bash,/bin/zsh,/bin/fish,/bin/ksh,
> vetoed_shells = /bin/csh,/bin/tcsh
> shell_fallback = /bin/bash
>
> # kerberos settings
>
> # Probably required with sssd 1.8.x and newer
> krb5_canonicalize = false
> krb5_renewable_lifetime = 1d
> krb5_renew_interval = 60s
> krb5_lifetime = 1h #normally set by KDC
>
Kerberos tickets and logs of today:
> [root@hostname ~] klist -f /var/lib/sss/db/ccache_example.com
> Ticket cache: FILE:/var/lib/sss/db/ccache_example.com
> Default principal: hostname$(a)example.com
>
> Valid starting Expires Service principal
> 11/30/15 13:16:40 11/30/15 23:16:44 krbtgt/example.com(a)example.com
> renew until 12/07/15 13:16:40, Flags: RIA
> 11/30/15 13:16:44 11/30/15 23:16:44 ldap/dc02.example.com@
> renew until 12/07/15 13:16:40, Flags: RAO
> 11/30/15 13:16:44 11/30/15 23:16:44 ldap/dc02.example.com(a)example.com
> renew until 12/07/15 13:16:40, Flags: RAO
> 11/30/15 13:16:44 11/30/15 23:16:44 DNS/dc01.example.com(a)example.com
> renew until 12/07/15 13:16:40, Flags: RAO
> [root@hostname ~] grep renew /var/log/sssd/sssd_example.com.log
> (Mon Nov 30 08:28:49 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 09:55:42 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0100): Successfully renewed TGT for user [John Doe].
> (Mon Nov 30 10:26:42 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0100): Successfully renewed TGT for user [John Doe].
> (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0020): krb5_auth request failed.
> (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0200): Giving back pam data.
> (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0020): krb5_auth request failed.
> (Mon Nov 30 11:36:44 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0200): Giving back pam data.
> (Mon Nov 30 11:38:07 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0020): krb5_auth request failed.
> (Mon Nov 30 11:38:07 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0200): Giving back pam data.
> (Mon Nov 30 11:38:13 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0020): krb5_auth request failed.
> (Mon Nov 30 11:38:13 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0200): Giving back pam data.
> (Mon Nov 30 11:47:35 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0020): Failed to renew TGT for user [John Doe].
> (Mon Nov 30 11:47:35 2015) [sssd[be[example.com]]] [renew_tgt_done]
> (0x0020): Failed to renew TGT for user [Lucy Doe].
> (Mon Nov 30 14:16:07 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 17:19:34 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 18:20:26 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 18:21:36 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 19:11:06 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 19:26:31 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Mon Nov 30 23:30:05 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 00:16:56 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 01:18:39 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 01:32:16 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 03:22:02 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 04:34:30 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 06:27:39 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 06:38:20 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 07:34:20 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 07:56:02 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 08:33:09 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
> (Tue Dec 1 10:40:41 2015) [sssd[be[example.com]]] [renew_handler]
> (0x0100): Offline, disable renew timer.
>
To be clear, it all works fine up to the point where the TGT ticket expires.
Kind Regards,
Andy
8 years, 4 months
sssd cache questions
by aaron wang
Hi all,
I was testing a few things about cache and here is my understandings,
please correct me if I'm wrong:
1) cache_credentials option
turn it on will allow offline authentication.
Testing 1:
turn cache_credentials on, all other timeout value remains default
change the password on ldap, try to authenticate again, and
immediately, it asked for the new password
From the test result, I'm assuming that if ldap server is online, this
credentials cache won't be used , correct ? So this cache here is only for
"high availability" but has nothing to do with "high performance". This
confused me a bit, as I always think cache is a mechanism for high
performance.
2) entry_cache_nowait_percentage and entry_cache_timeout options
Testing 2:
I set the timeout to 60 seconds, percentage remains default
I moved one user from group1 to group2 on ldap, but I did an "id
user" on client, still showing the old data.
So this cache is for user identities , and it's for "high performance".
Correct ?
And is there any materials which cover all the sssd caching stuff ?
Thanks,
Aaron
8 years, 4 months