RHEL/CentOS 6 problems with missing supplemental groups for AD users
by John Beranek
Hi,
I've been investigating problems with the SSSD 1.11 versions supplied in
RHEL/CentOS 6.6 for a while now. I've followed:
https://access.redhat.com/solutions/1264443
https://fedorahosted.org/sssd/ticket/2472
and also created a case with Red Hat support. However, I'm still no closer
to solving the issue.
After updating servers to the SSSD in 6.6, intermittently (for particular
users but not on all servers, and not necessarily all the time) users don't
get their supplementary groups. e.g:
[root@rhel6-template sssd]# id matthewbe
uid=46721(matthewbe) gid=20513(domain users) groups=20513(domain users)
This is with the latest SSSD on a RHEL6.6 server, i.e.:
sssd-1.11.6-30.el6_6.3.x86_64
Our environment is Windows 2003 AD controllers, and users *without* POSIX
attributes in their AD records. So, snippets of sanitised sssd.conf:
[domain/AD]
debug_level = 9
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
ad_server = dc01.local,dc02.local
ad_backup_server = ad.local
ad_domain = ad.local
# ID mapping
min_id = 20000
ldap_idmap_range_min = 20000
#ldap_idmap_range_max = 220000
ldap_idmap_range_size = 200000
ldap_idmap_default_domain_sid = S-1-5-21-2365159532-2245169678-2931239768
ldap_schema = ad
ldap_id_mapping = true
override_homedir = /home/AD/%u
override_shell = /bin/bash
# access controls
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
# performance
ldap_referrals = false
I've tried a few config changes to fix the issue, but none has fixed it,
including:
ldap_use_tokengroups = False
ldap_group_objectsid = objectSID
ldap_user_objectsid = objectSID
ldap_deref_threshold = 0
ldap_schema = rfc2307bis
Given Red Hat support hasn't been able to fix our issue, what else can I do?
Cheers,
John
--
John Beranek To generalise is to be an idiot.
http://redux.org.uk/ -- William Blake
9 years
authentication against IPA with SSSD takes long (more than 5 seconds)
by Qing Chang
OS: CentoOS 7.1
IPA: 4.1.0-18
SSSD: 1.12.2-58
With IPA any clients running CentOS7.1 authentication for ssh and sudo
takes more than 5 seconds _after_ putting in password. If ssh to the IPA
server itself, it authenticates instantly.
Google did not provide much relevant information. Note that this is not a
slow ssh session to get to authentication prompt, it always gets to the
prompt without delay.
Also it is not related to NFS performance, it is equally slow if I login to
a NFS server (IPA client) locally or login to a server (also a IPA client)
that has autofs home.
IPA server is a fresh installation with just a couple of users. I had an
installation previously that has more than a thousand user accounts on
CentOS 6. Users did not have the slowness problem as with this new
installation.
Hope this list can provide some pointers.
Thanks in advance.
Qing Chang
9 years
sss_ssh_authorizedkeys: add a flag for ppolicy ?
by Olivier
Hi everyone,
I saw couple of discussion around in this list as well as others
about how to exploit ppolicy with ssh : here are some thought.
Currently, I am in a situation where I have inserted my users
public ssh keys in ldap (openssh-ldappubkey shema) and
instructed sshd to consult ldap for ssh public keys, adding in
ssh_config :
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
I also have authorized password authentication , in ssh_config:
PasswordAuthentication yes
My current policy is the following :
- All my users must have a password in ldap (that is used by
applications other than ssh)
- not all my users may have an ssh key (some never use ssh)
Everything works as I want.
I now want to introduce ppolicy overlay and would like to enforce
rules for password management even for users that mainly use
ssh keys.
Practically and basically : when a user with valid ssh key ask for
an ssh connexion, I would like ssh to behave exactly as if this user
had typed a correct "loging/password" and therefore check for
ppolicy situation before granting access.
aka :
- if the account is 'ppolicy desactivated', ssh would refuse to
provide the session
- if the password is "ppolicy oudated", then ssh would warn to
change it (and decrease 'pwdGraceAuthnLimit*'*?)
... and so on.
I thought about two options/alternatives to do that :
* try to tune pam (may be there would be a way to tell pam to check
for user ppolicy fields once authentication has been done before
granting access ?)
* add some sort of flag (aka: --ppolicy) to sss_ssh_authorizedkeys
to instruct sss_ssh_authorizedkeys to check for user ppolicy (use
'ldap_default_bind_dn' as a binding user) and if there is an issue
return a "ppolicy error message" rather than the user ssh key ?
These are just some thoughts.
I'm currently exploring the first option (but I'm not a 'pam' expert and
I'm even not sure that the ssh authentication process goes through
pam if a valid key is found, even with 'UsePAM yes').
I would appreciate any guidance, advices or experiences from you
on that particular issue.
Thank you,
--
Olivier
9 years
ldb_modify_failed invalid attribute syntax
by Christopher Butt
Hi,
I'm trying to authenticate against an AD domain. The first domain I did this on was almost flawlessly easy, but this time, on a different domain I'm having problems. I've searched, but I've mostly got fixed bugs from old versions. Like this one: https://bugzilla.redhat.com/show_bug.cgi?id=886848 which suggests that case sensitivity might have been an issue. Is it still one?
My symptoms:
1) Some domain users aren't being recognised at all,
2) Some users are not getting the full groups list, eg just 'domain users'
3) Some users are connecting apparently fine with lots of AD groups visible from an 'id' or 'groups' command. So far it seems that the domain admins all work fine, but it's not clear if that's a coincidence or not.
I've set up SSDB using realmd as follows:
realm join -v internal.mydomain.com --user jn-monty --computer-ou=OU=Linux\ Servers,OU=Member\ Servers,DC=internal,DC=mydomain,DC=com
(jn-monty is a domain-admin in this case.)
[root@myserver admin]# sssd --version
1.12.2
[root@myserver admin]# cat /etc/sssd/sssd.conf
[sssd]
domains = internal.mydomain.com
config_file_version = 2
services = nss, pam, pac
[domain/internal.mydomain.com]
ad_domain = internal.mydomain.com
krb5_realm = INTERNAL.MYDOMAIN.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
debug_level = 5
auth_provider = ad
If I 'id' a missing user I get the following in the logs:
[root@myserver admin]# id bqt-pmimon(a)internal.mydomain.com
(Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=bqt-pmimon]
(Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Invalid attribute syntax]
(Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sysdb_set_entry_attr] (0x0040): Error: 22 (Invalid argument)
(Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sdap_save_user] (0x0020): Failed to save user [BQT-PMimon]
(Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring.
(Thu Mar 19 19:32:54 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
id: bqt-pmimon(a)internal.mydomain.com: no such user
If I 'id' a working user I get the following:
[root@myserver admin]# id bqt-imartin(a)internal.mydomain.com
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=bqt-imartin]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [child_sig_handler] (0x0100): child [14296] finished successfully.
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: myserver$
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'production-dc03v.internal.mydomain.com' as 'working'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'production-dc03v.internal.mydomain.com' as 'working'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1002][1][idnumber=680800513]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is neutral
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.internal.mydomain.com'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_get_account_info] (0x0200): Got request for [0x1003][1][name=bqt-imartin]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'production-dc03v.internal.mydomain.com' in files
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'production-dc03v.internal.mydomain.com' in files
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'production-dc03v.internal.mydomain.com' in DNS
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.Prodtown._sites.trainline.com'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.trainline.com'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'AD_GC' as 'resolved'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://production-dc03v.internal.mydomain.com'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://production-dc03v.internal.mydomain.com:3268'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [be_resolve_server_process] (0x0200): Found address for server production-dc03v.internal.mydomain.com: [10.244.121.197] TTL 3600
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://production-dc03v.internal.mydomain.com'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://production-dc03v.internal.mydomain.com'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [child_sig_handler] (0x0100): child [14297] finished successfully.
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: myserver$
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [fo_set_port_status] (0x0100): Marking port 3268 of server 'production-dc03v.internal.mydomain.com' as 'working'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [set_server_common_status] (0x0100): Marking server 'production-dc03v.internal.mydomain.com' as 'working'
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not remove member [bqt-imartin] from group [name=DLG-SC-vCenter Admin,cn=groups,cn=internal.mydomain.com,cn=sysdb]. Skipping
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute]
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [sysdb_update_members_ex] (0x0020): Could not remove member [bqt-imartin] from group [name=DLG-SC-Linux Admins,cn=groups,cn=internal.mydomain.com,cn=sysdb]. Skipping
(Thu Mar 19 20:12:55 2015) [sssd[be[internal.mydomain.com]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
uid=680803710(bqt-imartin(a)internal.mydomain.com) gid=680800513(domain users(a)internal.mydomain.com) groups=680800513(domain users(a)internal.mydomain.com)
[root@myserver admin]# id bqt-imartin(a)internal.mydomain.com
The information in this email (and any attachments) is confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you received this email in error please tell us by reply email (or telephone the sender) and delete all electronic copies on your system or other copies known to you. Trainline Investments Holdings Limited (Registered No.5776685), Trainline.com Limited (Registered No. 3846791) and Trainline International Limited (Registered No. 6881309) are all registered in England and Wales with registered office at 50 Farringdon Road, London, EC1M 3HE.
9 years
Not getting any ticket in ccache in CentOS 6.6
by Ola Nystrom
I have a problem with getting a krb-ticket when logging in to my CentOS 6.6
server.
Any idea on how to troubleshoot?
after login with AD-credentionals
> [ola@galaxy ~]$ klist
> klist: No credentials cache found while retrieving principal name
> [ola@galaxy ~]$ sssd --version
1.11.6
kerberos looks like it works, and the same config works on CentOS7.1
sssd -i -d9 log filtered with krb
http://pastebin.com/XywvGEmR
[ola@galaxy ~]$ kinit
Password for ola(a)ENSKEDE.LOCAL:
[ola@galaxy ~]$ klist
Ticket cache: KEYRING:persistent:11103
Default principal: ola(a)ENSKEDE.LOCAL
Valid starting Expires Service principal
04/14/15 19:11:12 04/15/15 05:11:15 krbtgt/ENSKEDE.LOCAL(a)ENSKEDE.LOCAL
renew until 04/21/15 19:11:12
my sssd.conf
[ola@galaxy ~]$ sudo cat /etc/sssd/sssd.conf
[sudo] password for ola:
[sssd]
domains = ENSKEDE.LOCAL
services = nss, pam, pac
config_file_version = 2
[domain/ENSKEDE.LOCAL]
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
cache_credentials = true
ldap_id_mapping = False
ldap_referrals = false
krb5_use_kdcinfo = false
krb5_store_password_if_offline = true
[ola@galaxy ~]$ cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = ENSKEDE.LOCAL
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
Any idea on how to troubleshoot?
--
Ola Nyström
“OSI model jokes work on so many levels”
— jorge_rbs
9 years
get ldap user by UPN with full name format
by Dimitar Dimitrov
Hello everyone.
I managed to configure ssh login for users by using pam_sss to our AD.
The users use their usePrincipalName to authenticate. The providers for
each of the domains are:
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
For the main domain this configuration works perfectly because the
sAMAccountName is the same as the name(the first part from the
user(a)domain.tld).
But when I tried to configure one of the other domains I stuck in a
following problem:
The sAMAccountName of the users is differ than the UPN. For example user
with UPN "test.linksync(a)linkoffice.fr" has a SAM "LINKSYNC".
When I try to get the user info for this by:
getent passwd test.linksync(a)linkoffice.fr
the authentication providers tries to get the user object from the LDAP
with the following filter:
[(&(userPrincipalName=test.linksync)(objectclass=user)(userPrincipalName=*)(objectSID=*))]
I thing that the problem here is with the id_provider. I tried to
configure the re_expression and full_name_format options but they did
not change anything in the request filter.
Is there а way to change the behavior with which the id_provider gets
the user object from the tree. For example I want to ask the ldap with
the format user@domain and not only name.
For example users logs with "test.linksync(a)linkoffice.fr" and the
request for the id should be
[(&(userPrincipalName=test.linksync(a)linkoffice.fr)(objectclass=user)(userPrincipalName=*)(objectSID=*))]
The problematic configuraion of the domain is the following:
[domain/linkoffice.fr]
debug_level = 10
cache_credentials = false
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
use_fully_qualified_names = true
ldap_access_filter = memberOf=CN=008 VDI
ACCESS,OU=Security,OU=Groups,OU=008,OU=Clients,DC=008dn,DC=domain,DC=tld
ldap_uri = ldap://008-010-01.008dn.domain.tld
ldap_sasl_mech = GSSAPI
ldap_id_mapping = true
ldap_schema = ad
ldap_referrals = False
ldap_search_base = dc=008dn,dc=domain,dc=tld
ldap_user_search_base = dc=008dn,dc=domain,dc=tld
ldap_user_object_class = user
ldap_group_search_base = dc=008dn,dc=domain,dc=tld
ldap_group_object_class = group
ldap_user_name = userPrincipalName
ldap_user_member_of = memberOf
ldap_access_order = filter
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = True
krb5_realm = DOMAIN.TLD
krb5_canonicalize = False
krb5_server = 007-010-01.domain.tld:88
krb5_kpasswd = 007-010-01.domain.tld:88
krb5_use_enterprise_principal = True
override_homedir = /home/%d-%u
override_shell = /bin/bash
Thanks in advance.
9 years
How do I view multiple users groups using sssd?
by Leo K
SETUP
OS = RHEL 6.4 Workstation
System is part of a LDAP domain and was originally configured to authenticate using nscd.
This is a NON-Windows / NON-Active Directory environment, straight up *NIX.
All recommended SSSD packages have been installed.
[root@sssd_system]# rpm -qa | grep sssd
sssd-client-1.11.6-30.el6_6.4.x86_64
sssd-common-1.11.6-30.el6_6.4.x86_64
sssd-common-pac-1.11.6-30.el6_6.4.x86_64
sssd-krb5-common-1.11.6-30.el6_6.4.x86_64
sssd-ldap-1.11.6-30.el6_6.4.x86_64
sssd-proxy-1.11.6-30.el6_6.4.x86_64
sssd-tools-1.11.6-30.el6_6.4.x86_64
Files which have been created/modified to switch over to SSSD:
/etc/nsswitch.conf
[root@sssd_system]# ls -ld /etc/nsswitch.conf
-rw-r--r-- 1 root root 560 Apr 9 12:07 /etc/nsswitch.conf
cat /etc/nsswitch.conf
passwd: files sss
shadow: files sss
group: files sss
ethers: files sss
services: files sss
netgroup: files sss
/etc/sssd/sssd.conf
[root@sssd_system]# ls -ld /etc/sssd/sssd.conf
-rw------- 1 root root 971 Apr 9 11:48 /etc/sssd/sssd.conf
cat /etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = rfc2307bis
ldap_uri = ldap://server1.domain.com,ldap://server2.domian.com,ldap://server3.domian...
ldap_search_base = dc=domain,dc=com
ldap_user_search_base = ou=People,dc=domain,dc=com
ldap_group_search_base = ou=Group,dc=domain,dc=com
ldap_group_member = uniqueMember
ldap_id_use_start_tls = False
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/certname.pem
debug_level = 9
[sssd]
domains = default
services = nss,pam,autofs
config_file_version = 2
sbus_timeout = 30
[nss]
filter_groups = root
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
[sudo]
[autofs]
[ssh]
NOTE: The authconfig
command was used to configure this system, so in theory, that means that
all the right files were touch with the correct information.
ISSUE [USERID@nscd_host]# groups USERID
USERID: USERGRP USERGRP2 USERGRP3 USERGRP4 USERGRP5
[USERID@nscd_host]# ssh USERID@sssd_system
Red Hat Enterprise Linux Workstation release 6.4 (Santiago)
Last login: Thu Apr 9 11:51:38 2015 from nscd_host
[USERID@sssd_system]# groups USERID
USERID: USERGRP
QUESTION
What am I missing?
I've been researching the dickens for a solution to what is likely a
simple configuration error, but haven't been able to pinpoint the exact
config file(s). I've also reference Red Hat's documentation on setting
up SSSD in their Deployment Guide and found several helpful guides posted out on the web.
And, I've also enabled debug level within sssd.conf file, but have not been able to find anything overtly meaningful within the logs /var/log/sssd/* log file(s) or /var/log/(message|secure) either.
Any assistance to what I might be missing would be greatly appreciated.
-LK
9 years
sssd - CentOS to Active Directory - no errmsg set and returning 0 results
by Sterling Sahaydak
***Thanks in advance for taking the time to help and respond! - greatly
appreciated!!!!
I've setup Active Directory Windows Server 2012 R2 and trying to get ssh
and sudo access working from CentOS 6.6 (Final) and using sssd 1.11.6
Note: NOT using Kerberos, samba, adcli,realmd, etc.
Using: sssd, pam, nsswitch
I'm using also OpenLDAP 2.4.39 and was able to get ssh and sudo working
against it, so familar with the process.
Now, switching the process to work with AD, I've installed the
sudo.schema, rule in AD and added a user,
***but the underlying issue is can't seem to get users to authenticate
nor retrieve group information.
ldap_search_ext called, msgid = 8
Search result: No such object(32), no errmsg set
Search for users, returned 0 results.
Failed to retrieve users
---------------------------------------------------
[root@ldap users]# cat /etc/*release
CentOS release 6.6 (Final)
[root@ldap users]# sssd --version
1.11.6
I setup a user in AD with the following configuration attributes:
For the User:
cn=abrown
displayName = Angela Brown
distinguishName = CN=abrown,OU=Users,OU=example,DC=ad,DC=example,DC=com
gidNunber = 1500
givenName = Angela
homeDirectory = /home/abrown
mail = abrown(a)example.com
objectCategory =
CN=Person,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com
objectClass = top,organizationPerson,person,user
objectGUID = F8 B2 23 2D AD B7 26 48 81 29 D0 DA 3D 00 DC B5
objectSid = 01 05 00 00 00 00 00 05 15 00 00 00 F9 F2 D8 AC AE FF 7F B8
FA EA AC 43 66 06 00 00
primaryGroupID = 513 = (GROUP_RID_USERS)
sAMAccountName = abrown
sAMAccountType = 805306368 = (NORMAL_USER_ACCOUNT)
sn = Brown
uid = abrown
userPrincipalName = abrown(a)example.com
For the Group:
cn = allowedusers
distinguishName =
CN=allowedusers,OU=Groups,OU=example,DC=ad,DC=example,DC=com
gidNumber = 1500
member = CN=abrown,OU=Users,OU=example,DC=ad,DC=example,DC=com
objectCategory =
CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com
objectClass = top; group
objectGUID = 45 47 DA 79 D7 9E 5E 4B 87 17 E4 7C 71 D0 2E 1F
objectSid = 01 05 00 00 00 00 00 05 15 00 00 00 F9 F2 D8 AC AE FF 7F B8
FA EA AC 43 3D 08 00 00
sAMAccountName = allowedusers
sAMAccountType = 268435456 = (GROUP_OBJECT)
------------------------------------------
THE ISSUE(S):
So, when I run the 'ls -l' command it's not displaying the name for the
user = 2000 and Group name = 1500.
When I do this connected to OpenLDAP it will display as abrown and
allowedusers, but not to AD as shown:
[root@ldap users]# ls -l
total 24
drwxr-xr-x. 2 2000 1500 4096 Apr 8 13:46 abrown
I had to manually add this: mkdir abrown
and then: chown 2000:1500 abrown
but if I: "getent passwd abrown" - nothing comes back!
Running sssd:
[root@ldap log]# /usr/sbin/sssd -i
.....
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [be_get_account_info]
(0x0100): Got request for [4097][1][idnumber=2000]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [be_req_set_domain]
(0x0400): Changing request domain from [LDAP] to [LDAP]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_id_op_connect_step]
(0x4000): reusing cached connection
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_search_user_next_base]
(0x0400): Searching for users with base
[ou=Users,ou=example,dc=ad,dc=example,dc=com]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x0400): calling ldap_search_ext with
[(&(uidNumber=2000)(objectclass=user)(sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))][ou=Users,ou=example,dc=ad,dc=example,dc=com].
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [objectClass]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [sAMAccountName]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [unixUserPassword]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [uidNumber]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [gidNumber]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [gecos]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [unixHomeDirectory]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [msSFU30LoginShell]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [userPrincipalName]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [displayName]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [memberOf]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [objectSid]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [primaryGroupID]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [whenChanged]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [uSNChanged]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [accountExpires]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x1000): Requesting attrs: [userAccountControl]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step]
(0x2000): ldap_search_ext called, msgid = 8
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_result]
(0x2000): Trace: sh[0x1cc4a30], connected[1], ops[0x1cc4990],
ldap[0x1cbda50]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_message]
(0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_done]
(0x0400): Search result: No such object(32), no errmsg set
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_search_user_process]
(0x0400): Search for users, returned 0 results.
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_get_users_done]
(0x0040): Failed to retrieve users
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_id_op_done] (0x4000):
releasing operation connection
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed
event "ltdb_callback": 0x1d80d70
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Added timed
event "ltdb_timeout": 0x1d81850
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Running
timer event 0x1d80d70 "ltdb_callback"
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Destroying
timer event 0x1d81850 "ltdb_timeout"
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [ldb] (0x4000): Ending timer
event 0x1d80d70 "ltdb_callback"
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sysdb_search_user_by_uid]
(0x0400): No such entry
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sysdb_delete_user]
(0x0400): Error: 2 (No such file or directory)
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [acctinfo_callback]
(0x0100): Request processed. Returned 0,0,Success
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_result]
(0x2000): Trace: sh[0x1cc4a30], connected[1], ops[(nil)],
ldap[0x1cbda50]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sdap_process_result]
(0x2000): Trace: ldap_result found nothing!
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000):
dbus conn: 0x1cbe2b0
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_dispatch] (0x4000):
Dispatching.
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_message_handler]
(0x4000): Received SBUS method [getAccountInfo]
(Wed Apr 8 15:07:43 2015) [sssd[be[LDAP]]] [sbus_get_sender_id_send]
(0x2000): Not a sysbus message, quit
....
-------------------------------
If I take the filter from within the debug of:
(&(gidNumber=1500)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0)))
and perform a ldapsearch, it pulls back the correct results:
[root@ldap ~]# ldapsearch -D
"cn=adaccess,ou=adaccts,ou=example,dc=ad,dc=example,dc=com" -w 'password
here' -b "DC=ad,DC=example,DC=com" -h adservername.example.com
'(&(gidNumber=1500)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0))))'
# extended LDIF
#
# LDAPv3
# base <DC=ad,DC=example,DC=com> with scope subtree
# filter:
(&(gidNumber=1500)(objectClass=group)(name=*)(&(gidNumber=*)(!(gidNumber=0))))
# requesting: ALL
#
# allowedusers, Groups, example, ad.example.com
dn: CN=allowedusers,OU=Groups,OU=example,DC=ad,DC=example,DC=com
objectClass: top
objectClass: group
cn: allowedusers
member: CN=abrown,OU=Users,OU=example,DC=ad,DC=example,DC=com
distinguishedName:
CN=allowedusers,OU=Groups,OU=example,DC=ad,DC=example,DC=
com
instanceType: 4
whenCreated: 20150408174301.0Z
whenChanged: 20150408174359.0Z
uSNCreated: 81925
uSNChanged: 81931
name: allowedusers
objectGUID:: RUfaedeeXkuHF+R8cdAuHw==
objectSid:: AQUAAAAAAAUVAAAA+fLYrK7/f7j66qxDPQgAAA==
sAMAccountName: allowedusers
sAMAccountType: 268435456
groupType: -2147483646
objectCategory:
CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=com
dSCorePropagationData: 16010101000000.0Z
gidNumber: 1500
# search reference
ref:
ldap://DomainDnsZones.ad.example.com/DC=DomainDnsZones,DC=ad,DC=example
,DC=com
# search reference
ref:
ldap://ForestDnsZones.ad.example.com/DC=ForestDnsZones,DC=ad,DC=example
,DC=com
# search reference
ref: ldap://ad.example.com/CN=Configuration,DC=ad,DC=example,DC=com
# search result
search: 2
result: 0 Success
# numResponses: 5
# numEntries: 1
# numReferences: 3
--------------------------------------
Setup of sssd.conf
[root@ldap sssd]# cat sssd.conf
[domain/default]
ldap_id_use_start_tls = True
cache_credentials = True
ldap_search_base = dc=example,dc=com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://ldap.va.example.com
ldap_tls_cacertdir = /etc/pki/tls/certs
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = LDAP
[nss]
filter_users = root
filter_groups = root
[pam]
[sudo]
[domain/LDAP]
access_provider = ldap
auth_provider = ldap
chpass_provider = ldap
id_provider = ldap
sudo_provider = ldap
debug_level = 9
cache_credentials = true
enumerate = false
ldap_uri = ldaps://ldapservername.example.com
ldap_default_bind_dn = CN=Manager,DC=example,DC=com
ldap_default_authtok_type = password
ldap_default_authtok = passwordhere
ldap_access_filter = ou=users,ou=example,dc=ad,dc=example,dc=com
ldap_search_base = dc=example,dc=com
ldap_schema = ad
ldap_user_principal = userPrincipalName
ldap_user_fullname = displayName
ldap_user_name = sAMAccountName
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_principal = userPrincipalName
ldap_user_objectsid = objectSid
ldap_group_object_class = group
ldap_group_objectsid = objectGUID
ldap_sudo_search_base = ou=sudoers,dc=ad,dc=example,dc=com
ldap_user_search_base = ou=Users,ou=example,dc=ad,dc=example,dc=com
ldap_group_search_base = ou=Groups,ou=example,dc=ad,dc=example,dc=com
ldap_tls_cacert = /etc/pki/tls/certs/certnamehere.crt
9 years
automount Problem
by Günther J. Niederwimmer
Hello,
On my system centos 7 my automount is not working.
IPA 4.1 sssd 1.12
I have this Error ?
automount[1899]: lookup_read_map: lookup(sss): getautomntent_r: No such file or
directory
have I to configure more in sssd ?
Now I have this from ipa
autofs_provider = ipa
ipa_automount_location = default
--
mit freundlichen Grüßen / best Regards,
Günther J. Niederwimmer
9 years
default filters for group search
by rone
>From sssd.conf:
ldap_group_search_base = ou=Accounts_Group,dc=corp,dc=example,dc=com
>From sssd_LDAP.log:
(Thu Apr 2 17:32:32 2015) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(&(cn=admin)(objectclass=group)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))(gidNumber=*))][ou=Accounts_Group,dc=corp,dc=example,dc=com]
The hitch here is that our groups (in our Active Directory schema)
don't have a gidNumber element, so this returns nothing. Is it
possible to change the default filter so that it doesn't go looking
for gidNumber=*?
thanks
rone
--
Inanitas inanitatum et omnia inanitas <rone(a)ennui.org>
9 years