System Error 4 with CentOS 7.1 IPA clients attempting password authentication
by Ken Miller
Hello,
I suspect this is a result of outdated software; however, the
"Trouble-shooting" guide (URL
https://fedorahosted.org/sssd/wiki/Troubleshooting ) requested I post
occurrences of "System Error 4" encountered to this list...
My IPA Server is RHEL65 running ipa-server-3.0.0-37.el6.x86_64
in a lab environment. Other RHEL65 clients haven't demonstrated this
problem, but CentOS71 clients running
ipa-client-4.1.0-18.el7.centos.3.x86_64 fail to accept password
authentication and report messages similar to the following in
/var/log/secure :
Aug 24 10:34:49 testhost sshd[17787]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=testhost.example.com
user=testuser1 Aug 24 10:34:49 testhost sshd[17787]: pam_sss(sshd:auth):
authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=
testhost.example.com user=testuser1 Aug 24 10:34:49 testhost sshd[17787]:
pam_sss(sshd:account): Access denied for user testuser1: 4 (System error)
Aug 24 10:34:49 testhost sshd[17787]: Failed password for testuser1 from
10.10.1.232 port 39617 ssh2 Aug 24 10:34:49 testhost sshd[17787]: fatal:
Access denied for user testuser1 by PAM account configuration [preauth]
Help much appreciated in tracking down/fixing the root cause.
Thanks in advance,
== k+ ==
8 years, 7 months
id command not returning group names. only sid is returned.
by Abhijit Tikekar
Hi,
This is regarding the AD group name resolution in SSSD.
We are using SSSD between CentOS and Microsoft AD. Integration works fine
and users are able to authenticate without any issues. For SSSD
installation, we were just using the Base repo and using yum to install the
latest version available.
Lately we noticed that after user login, the "id" command returns only the
SID's and not the corresponding group name. I checked the installation and
made sure no step was missed. This is causing issues when users use "sudo"
(We have added specific group names under sudoers and the match fails
because no group names were returned.. only SID's)
Previously this used to work fine(Version 1.11.6). but the version
currently being installed via yum is V 1.12.4.
I could not find any reference to such behavior online with respect to V
1.12.4-47 and hence posting here.Has anyone experience similar issues with
this version?
Please advise.
Thanks,
~ Abhi
8 years, 7 months
Access denied by HBAC Rules
by Baird, Josh
Hi,
I have a situation where an IPA/sssd client is not allowing an AD trusted user to login, even though HBAC rules allow the user:
(Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [hbac_attrs_to_rule] (0x1000): Processing rule [allow_eitunixadmins] (Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [hbac_user_attrs_to_rule] (0x1000): Processing users for rule [allow_eitunixadmins] (Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [sysdb_search_users] (0x2000): Search users with filter: (&(objectclass=user)(originalDN=cn=eitunixadmins,cn=groups,cn=accounts,dc=unix,dc=follett,dc=com))
(Thu Aug 20 15:15:50 2015) [sssd[be[unix.domain.com]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules
jbaird@impr-d1-dc01:~$ ipa hbactest
User name: jbaird(a)na.follett.lan
Target host: imqa-d1-cl05.corp.domain.com
Service: ssh
--------------------
Access granted: True
--------------------
Matched rules: allow_eitunixadmins
How would I go about troubleshooting this? Both client and server are running the newest RHEL 7.1.z packages.
Thanks,
Josh
8 years, 8 months
Fetching Hosts Entries from OpenLDAP Database
by Rajnesh Kumar Siwal
Hi ,
We need to fetch the hosts entries from the OpenLDAP Database.
We can use the nslcd, that worlks fine to fetch the hosts entries from the
OpenLDAP.
How do we configure sssd to fetch the same hosts entries from the LDAP
database ?
I am not able to figure out hos to set hosts base variable in sssd.conf
like :
base hosts ou=hosts,dc=example,dc=com
--
Thanks,
Rajnesh Kumar Siwal
8 years, 8 months
ad_site syntax
by Ondrej Valousek
Hi folks,
Just testing the ad_site option in sssd.conf - how is this supposed to work? Which syntax is it taking? Long DNS path or just site name?
For me, it does not seem to work at all - sssd happily connect to DCs outside of the specified site.
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
8 years, 8 months
autofs will not find auto.master in LDAP
by Brendan Kearney
i have a fedora 20 install on a desktop that is working and autofs will
read the auto.master from ldap and i can mount the shares specified in
auto.shares listed.
i have a fedora 20 install on a laptop that will not work and cannot
read the auto.master from ldap.
i have done everything i can think of to make the 2 as "apples to
apples" identical as i can, but still cannot get autofs to read the
auto.master from ldap.
[root@laptop ~]# automount -fd -vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
Starting automounter version 5.0.7-42.fc20, master map auto.master
using kernel protocol version 5.02
lookup_nss_read_master: reading master sss auto.master
parse_init: parse(sun): init gathered global options: (null)
spawn_mount: mtab link detected, passing -n to mount
spawn_umount: mtab link detected, passing -n to mount
setautomntent: lookup(sss): setautomntent: No such file or directory
lookup_nss_read_master: auto.master not found, replacing '.' with '_'
parse_init: parse(sun): init gathered global options: (null)
spawn_mount: mtab link detected, passing -n to mount
spawn_umount: mtab link detected, passing -n to mount
setautomntent: lookup(sss): setautomntent: No such file or directory
no mounts in table
^Cautofs stopped
i believe i am hung up by the setautomntent: no such file or directory
line. the configs are pretty much copied from the working desktop. any
help is appreciated.
*sssd.conf**:*
[sssd]
domains = bpk2.com
services = nss, pam, sudo, autofs
config_file_version = 2
#debug_level = 4
[nss]
filter_groups = root
filter_users = root
[pam]
[sudo]
[autofs]
[domain/bpk2.com]
#debug_level = 4
id_provider = ldap
ldap_schema = rfc2307bis
ldap_uri = _srv_,ldap://ldap1.bpk2.com,ldap://ldap2.bpk2.com
ldap_search_base = dc=bpk2,dc=com
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/laptop.bpk2.com
ldap_sasl_realm = BPK2.COM
auth_provider = krb5
krb5_server = _srv_,kerberos.bpk2.com
krb5_realm = BPK2.COM
krb5_renewable_lifetime = 7d
krb5_lifetime = 24h
krb5_renew_interval = 1h
krb5_store_password_if_offline = true
cache_credentials = true
sudo_provider = ldap
ldap_sudo_search_base = ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com
autofs_provider = ldap
ldap_autofs_search_base = cn=autofs,ou=Daemons,dc=bpk2,dc=com
ldap_autofs_map_object_class = automountMap
ldap_autofs_entry_object_class = automount
ldap_autofs_map_name = automountMapName
ldap_autofs_entry_key = automountKey
ldap_autofs_entry_value = automountInformation
#min_id = 1000
#max_id = 2000
enumerate = false
*autofs_ldap_auth.conf**:*
<?xml version="1.0" ?>
<!--
This files contains a single entry with multiple attributes tied to it.
See autofs_ldap_auth.conf(5) for more information.
-->
<autofs_ldap_sasl_conf
usetls="no"
tlsrequired="no"
authrequired="yes"
authtype="GSSAPI"
clientprinc="host/laptop.bpk2.com(a)BPK2.COM"
/>
*/etc/sysconfig/autofs |grep -v \^\#**:*
TIMEOUT=300
BROWSE_MODE="no"
MOUNT_NFS_DEFAULT_PROTOCOL=4
LDAP_URI="ldap:///dc=bpk2,dc=com"
SEARCH_BASE="cn=autofs,ou=Daemons,dc=bpk2,dc=com"
MAP_OBJECT_CLASS="automountMap"
ENTRY_OBJECT_CLASS="automount"
MAP_ATTRIBUTE="automountMapName"
ENTRY_ATTRIBUTE="automountKey"
VALUE_ATTRIBUTE="automountInformation"
AUTH_CONF_FILE="/etc/autofs_ldap_auth.conf"
USE_MISC_DEVICE="yes"
8 years, 8 months
SSSD seriously broken in RHEL 6.7 again?
by Ondrej Valousek
Hi list,
Is sssd broken again in 6.7?
It was working fine for me as of 1.11.7 - but that was not official version. Now I upgraded to the latest one (1.12.4-47) hoping I'll be on the official fixed version, and it is even worse.
I am experiencing frequent messages like:
(Wed Aug 12 17:20:55 2015) [sssd[be[default]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Wed Aug 12 17:20:55 2015) [sssd[be[default]]] [ad_subdomains_root_conn_done] (0x0080): No AD server is available, cannot get the subdomain list while offline
(Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [fo_resolve_service_timeout] (0x0080): Service resolving timeout reached
(Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
(Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [be_ptask_enable] (0x0080): Task [Check if online (periodic)]: already enabled
(Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks.
(Wed Aug 12 17:21:01 2015) [sssd[be[default]]] [ad_subdomains_root_conn_done] (0x0080): No AD server is available, cannot get the subdomain list
After cleaning cache, sssd refuses to list all groups for user, etc.
Is sssd going to be stable at some stage? This is really disappointing :(
Thanks,
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
8 years, 8 months
sss_cache fails sometimes
by Ondrej Valousek
Hi folks,
I have just found out that when I try to use sss_cache against some item which is in negative cache (i.e. not found) it does not work.
Is this expected behavior?
I would expect negative cache is cleared, sssd attempts to go online and get current result.
Thanks,
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
8 years, 8 months
Load individual group members when ignore_group_members = true
by Tim Biedert
Hi,
I’m using SSSD in Ubuntu 15.04 to connect to my university’s Active Directory.
Using ignore_group_members = true speeds things up significantly, that’s great.
Now I was wondering: Is there a possibility to make the SSSD load and cache the group members of individual given groups, such that getent group name works again only for certain groups of interest?
Thank you very much!
Best,
Tim
8 years, 8 months
SSSD-1.12.5 and group membership problem
by Longina Przybyszewska
Hi,
I have an issue with SSSD-1.12.5 with resolving group membership.
Only Posix primary group is displayed for users accounts.
Group is visible on the system but not displayed from 'id' or 'groups' commands.
getent group 30000005
data-adm-lnx-nfs0a-rw-id-00001:*:30000005:
getent group data-adm-lnx-nfs0a-rw-id-00001
data-adm-lnx-nfs0a-rw-id-00001:*:30000005:
id user1
uid=xxxxxxx(user1) gid=30000000(lnx-primary) groups=30000000(lnx-primary)
Group object has Posix gid and is setup as universal group in realm A.C.DOM.ORG:
...
gidNumber = 30000005
memberUid: user1, user2
....
I have AD as id_,access_auth_provider.
Users have got Posix attributes in AD.
Computer and group objects are from the same realm: A.C.DOM.ORG.
User objects are in all realms: N.C.DOM.ORG, A.C.DOM.ORG, C.DOM.ORG
With my setup I can achieve:
- login with short names across realm
- access kerberized nfs homedir
Is there a way to resolve correctly group's membership with this setup??
My sssd.conf :
[nss]
debug_level = 9
filter_groups = root
filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
[sssd]
debug_level = 6
domains = n.c.dom.org,a.c.dom.org,c.dom.org
config_file_version = 2
services = nss,pam,ssh
[pam]
pam_verbosity = 3
debug_level = 9
[domain/n.c.dom.org]
debug_level = 9
dyndns_update = false
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ad_domain = n.c.dom.org
krb5_realm = N.C.DOM.ORG
#cache_credentials = True
default_shell = /bin/bash
use_fully_qualified_names = False
ldap_id_mapping = False
subdomains_provider = none
ad_gpo_access_control = disabled
[domain/a.c.dom.org]
debug_level = 9
dyndns_update = false
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ad_domain = a.c.dom.org
krb5_realm = A.C.DOM.ORG
default_shell = /bin/bash
use_fully_qualified_names = False
ldap_id_mapping = False
subdomains_provider = none
ad_gpo_access_control = disabled
[domain/c.dom.org]
debug_level = 9
dyndns_update = true
dyndns_update_ptr = false
ad_hostname = adm-lnx101.a.c.dom.org
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ad_domain = c.dom.org
krb5_realm = C.DOM.ORG
default_shell = /bin/bash
use_fully_qualified_names = False
ldap_id_mapping = False
subdomains_provider = none
ad_gpo_access_control = disabled
Best,
longina
[nss]
debug_level = 9
filter_groups = root
filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
#override_home_directory = /home/%u
[sssd]
debug_level = 6
domains = nat.c.sdu.dk,adm.c.sdu.dk,c.sdu.dk
#default_domain_suffix = c.sdu.dk
config_file_version = 2
services = nss,pam
[pam]
pam_verbosity = 3
debug_level = 9
[domain/LOCAL]
description = local machine accounts
id_provider = local
enumerate = true
min_id = 101
max_id = 1100
[domain/nat.c.sdu.dk]
debug_level = 9
dyndns_update = false
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ad_domain = nat.c.sdu.dk
krb5_realm = NAT.C.SDU.DK
#cache_credentials = True
#krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = False
ldap_id_mapping = False
subdomains_provider = none
[domain/adm.c.sdu.dk]
debug_level = 9
dyndns_update = false
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ad_domain = adm.c.sdu.dk
krb5_realm = ADM.C.SDU.DK
#cache_credentials = True
#krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = False
ldap_id_mapping = False
subdomains_provider = none
[domain/c.sdu.dk]
debug_level = 9
dyndns_update_ptr = false
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad
ad_domain = c.sdu.dk
krb5_realm = C.SDU.DK
#cache_credentials = True
#krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = False
ldap_id_mapping = False
subdomains_provider = none
dyndns_update = true
ad_hostname = test-lnx03.a.c.dom.org
The topology of
Mange hilsner
Longina
8 years, 8 months