Re: SSSD, Password Policy, Service Accounts
by Douglas Duckworth
Lukas
You're the best.
So I removed the existing account used for binds and added it back with
this entry:
pwdPolicySubentry: cn=CustomBindAccountPolicy,ou=Policies,DN
The custom policy:
dn: cn=CustomBindAccountPolicy,ou=Policies,DN
objectClass: pwdPolicy
objectClass: person
objectClass: top
cn: passwordDefault
sn: passwordDefault
pwdAttribute: userPassword
pwdMinAge: 0
pwdMaxAge: 0
pwdLockout: FALSE
Moreover, I am now using the following settings in /etc/sysconfig/ldap:
SLAPD_LDAP=yes <-- previously disabled so no Start TLS via TCP 389 was
allowed.
SLAPD_LDAPI=yes
SLAPD_LDAPS=yes
sssd.conf:
ldap_uri = ldap://provider
ldap_backup_uri = ldap://consumer
ldap_default_bind_dn = uid=woohoo,ou=topsecret,DN
ldap_default_authtok_type = password
ldap_default_authtok = toolongtocrack
ldap_search_base = DN
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer
client sssd log:
(Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [simple_bind_send] (0x0100):
Executing simple bind as: uid=woohoo,ou=topsecret,DN
(Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100):
Marking port 389 of server 'provider' as 'working'
(Tue Dec 13 12:20:39 2016) [sssd[be[LDAP]]] [set_server_common_status]
(0x0100): Marking server 'provider' as 'working'
provider /var/log/ldap:
Dec 13 12:25:58 suntzu slapd[2614]: => bdb_entry_get: found entry:
"uid=woohoo,ou=topsecret,DN"
Dec 13 12:25:58 suntzu slapd[2614]: => bdb_entry_get: found entry:
""cn=custombindaccountpolicy,ou=policies,DN"
Dec 13 12:25:58 suntzu slapd[2614]: => access_allowed: auth access to
"uid=woohoo,ou=topsecret,DN" "userPassword" requested
Dec 13 12:25:58 suntzu slapd[2614]: => acl_mask: access to entry
""uid=woohoo,ou=topsecret,DN, attr "userPassword" requested
Dec 13 12:25:58 suntzu slapd[2614]: conn=1004 op=1 BIND
dn="uid=woohoo,ou=topsecret,DN" mech=SIMPLE ssf=0
I then did several ldapsearches with the account used for binding. The
account's not locked out even though I supplied the wrong password each
time.
I have halted both LDAP servers and it seems sssd cache with both autofs
and my user / group attributes are working! However, I would like to be
notified interactively that the LDAP servers are down. Can I have PAM let
the user know upon login that the SSSD cache happens to be "active?"
Thanks,
Douglas Duckworth, MSc, LFCS
HPC System Administrator
Scientific Computing Unit
Physiology and Biophysics
Weill Cornell Medicine
E: doug(a)med.cornell.edu
O: 212-746-6305
F: 212-746-8690
On Mon, Dec 12, 2016 at 4:18 PM, Lukas Slebodnik <lslebodn(a)redhat.com>
wrote:
> On (12/12/16 15:38), Douglas Duckworth wrote:
> >Hello
> >
> >I am nearly finished building new LDAP cluster using SSSD for clients.
> >
> >I have a password policy set which will lock out accounts upon bind
> failure:
> >
> >dn: ou=Policies,dc=blah
> >ou: Policies
> >objectClass: organizationalUnit
> >
> >dn: cn=passwordDefault,ou=Policies,dc=blah
> >objectClass: pwdPolicy
> >objectClass: person
> >objectClass: top
> >cn: passwordDefault
> >sn: passwordDefault
> >pwdAttribute: userPassword
> >pwdCheckQuality: 0
> >pwdMinAge: 0
> >pwdMaxAge: 365
> >pwdMinLength: 15
> >pwdInHistory: 5
> >pwdMaxFailure: 3
> >pwdFailureCountInterval: 0
> >pwdLockout: TRUE
> >pwdLockoutDuration: 0
> >pwdAllowUserChange: TRUE
> >pwdExpireWarning: 320
> >pwdGraceAuthNLimit: 0
> >pwdMustChange: TRUE
> >pwdSafeModify: FALSE
> >
> >I am using an account for binding with LDAP since my OpenLDAP ACLs
> disallow
> >anon binds. My concern about this is that if a malicious user was to
> start
> >attempting binds with the bind account, then they could lock out this
> >important user thus bring down SSSD binding for all of my clients. I do
> >not want.
> >
> >sssd.conf:
> >
> >ldap_uri = ldaps://provider
> >ldap_backup_uri = ldaps://consumer
> >ldap_default_bind_dn = uid=user,ou=sysadmin,dc=blah
> >ldap_default_authtok_type = password
> >ldap_default_authtok = longpass
> >ldap_search_base = dc=blah
> >ldap_tls_reqcert = demand
> >ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer
> >
> >This should probably be sent to another list though anyone know if its
> >possible to exempt a single user from the above password policy so
> >that pwdLockout would not apply?
> >
> I assume that other users are in different tree and not in
> ou=sysadmin,dc=blah.
> They would need to guess default bind DN because only root can raed
> sssd.conf
> otherwisee sssd would not start.
>
> And if you are really worry about password policy for bind account then
> you can use custom policy for this account.
>
> dn: uid=user,ou=sysadmin,dc=blah
> objectClass: account
> objectClass: posixAccount
> cn: user
> uidNumber: 12345
> gidNumber: 12345
> userPassword: {SSHA}aaaaaaaaaaaaaaaaaaaaaaaaaa
> objectClass: pwdPolicy
> pwdAttribute: userPassword
> pwdPolicySubentry: cn=customBindAccoundPolicy,ou=policies,$DS_BASE_DN
>
> I didn't test that.
>
> BTW you needn't use ldaps in ldap_uri because sssd would use start_tls
> anyway
> for bind and there are known issues with ldaps and failover.
>
> LS
>
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>
7 years, 3 months
Unable to login with SSH
by E. Clapton
I'm trying to connect my server to a LDAP server. I get a correct answer after using
*id* and *ldapsearch* commands. However, i still not able to login with SSH.
I can see on sssd_LDAP.log file that the server has received the request to login with the
user (myuser), but the request was rejected.
tail -f /var/log/sssd/sssd_LDAP.log
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request
for [0x1001][FAST BE_REQ_USER][1][name=omri_w]
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to
resolve service 'LDAP'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [get_server_status] (0x0100): Hostname
resolution expired, resetting the server status of 'ldap21v.walla.co.il'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking
server 'ldap21v.walla.co.il' as 'name not resolved'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_files_send] (0x0100):
Trying to resolve A record of 'ldap21v.walla.co.il' in files
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking
server 'ldap21v.walla.co.il' as 'resolving name'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_files_send] (0x0100):
Trying to resolve AAAA record of 'ldap21v.walla.co.il' in files
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_next] (0x0200): No more
address families to retry
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [resolv_gethostbyname_dns_query] (0x0100):
Trying to resolve A record of 'ldap21v.walla.co.il' in DNS
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking
server 'ldap21v.walla.co.il' as 'name resolved'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_resolve_server_process] (0x0200): Found
address for server ldap21v.walla.co.il: [192.168.50.21] TTL 600
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_get_server_opts_from_rootdse] (0x0020):
ldap_rootdse_last_usn configured but not found in rootdse!
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout
is 900
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port
389 of server 'ldap21v.walla.co.il' as 'working'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking
server 'ldap21v.walla.co.il' as 'working'
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success (Success)
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request
for [0x1003][FAST BE_REQ_INITGROUPS][1][name=myuser]
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_initgr_nested_send] (0x0100): User entry
lacks original memberof ?
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success (Success)
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_get_account_info] (0x0200): Got request
for [0x3][BE_REQ_INITGROUPS][1][name=myuser]
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [sdap_initgr_nested_send] (0x0100): User entry
lacks original memberof ?
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success (Success)
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with
the following data
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command:
SSS_PAM_AUTHENTICATE
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: myuser
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser:
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost:
192.118.68.5
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 2208
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not
set
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend
returned: (0, 7, <NULL>) [Success (Authentication failure)]
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending
result [7][LDAP]
(Mon Dec 5 12:39:48 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent
result [7][LDAP]
Does anyone know what is the issue?
7 years, 3 months
SSSD, Password Policy, Service Accounts
by Douglas Duckworth
Hello
I am nearly finished building new LDAP cluster using SSSD for clients.
I have a password policy set which will lock out accounts upon bind failure:
dn: ou=Policies,dc=blah
ou: Policies
objectClass: organizationalUnit
dn: cn=passwordDefault,ou=Policies,dc=blah
objectClass: pwdPolicy
objectClass: person
objectClass: top
cn: passwordDefault
sn: passwordDefault
pwdAttribute: userPassword
pwdCheckQuality: 0
pwdMinAge: 0
pwdMaxAge: 365
pwdMinLength: 15
pwdInHistory: 5
pwdMaxFailure: 3
pwdFailureCountInterval: 0
pwdLockout: TRUE
pwdLockoutDuration: 0
pwdAllowUserChange: TRUE
pwdExpireWarning: 320
pwdGraceAuthNLimit: 0
pwdMustChange: TRUE
pwdSafeModify: FALSE
I am using an account for binding with LDAP since my OpenLDAP ACLs disallow
anon binds. My concern about this is that if a malicious user was to start
attempting binds with the bind account, then they could lock out this
important user thus bring down SSSD binding for all of my clients. I do
not want.
sssd.conf:
ldap_uri = ldaps://provider
ldap_backup_uri = ldaps://consumer
ldap_default_bind_dn = uid=user,ou=sysadmin,dc=blah
ldap_default_authtok_type = password
ldap_default_authtok = longpass
ldap_search_base = dc=blah
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/sha2bundle.cer
This should probably be sent to another list though anyone know if its
possible to exempt a single user from the above password policy so
that pwdLockout would not apply?
Thanks
Doug
Thanks,
Douglas Duckworth, MSc, LFCS
HPC System Administrator
Scientific Computing Unit
Physiology and Biophysics
Weill Cornell Medicine
E: doug(a)med.cornell.edu
O: 212-746-6305
F: 212-746-8690
7 years, 3 months
Sending sssd.log to syslog
by Ali, Saqib
Hello,
How do I configure SSSD to send sssd.log logs to syslog? I would like
to include the DEBUB SSSD logs as well. We would like to feed the sssd
logs to Splunk. Our systems are already configured to send syslog to
Splunk Security Module. So we would like to use that setup, instead of
the Splunk Forwarder.
Thanks,
Saqib
7 years, 3 months
Multiple mount autofs/sssd
by john lehardos
Hello,
I am looking for a solution to mount two different NFS exports on a same mountpoint in order to have this kind of configuration
server1:/path on /s/work
server2:/path on /s/work
/s/work :
- fileA_server1
- fileB_server1
- fileA_server2
- fileB_server2
The /s/work mountpoint is provided by autofs/sssd and the map is on an LDAP autofs OU.
I have tried many solutions, but I want to avoid the symlink to another mounted directory solution.
Can anyone help ?
thanks,
J
7 years, 3 months
ubuntu sssd initial setup pam(?) problem
by Johan Kragsterman
Hi!
As an LDAP newbie(but not a UNIX newbie) I try to setup a test environment.
I use OpenDJ from Forgerock, and sssd on Ubuntu 16.10. System info further down.
I think I got a working server setup, I got a test user "sven" that I can find with various methods like:
sudo ldapsearch -xv -h ldap -LLL -b "dc=hemma,dc=home" uid=sven
ldap_initialize( ldap://ldap )
filter: uid=sven
requesting: All userApplication attributes
dn: uid=sven,ou=People,dc=hemma,dc=home
objectClass: person
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: organizationalPerson
objectClass: top
gidNumber: 1003
uid: sven
sn: Persson
cn: SvenP
initials: SPE
description: This is the description for Sven Persson, test user
givenName: Sven
homeDirectory: /mnt/nfs/home/sven
uidNumber: 1003
or:
id sven
uid=1003(sven) gid=1003(sven) groups=1003(sven)
or:
getent passwd sven
sven:*:1003:1003:SvenP:/mnt/nfs/home/sven:
or:
getent group sven
sven:*:1003:sven
BUT!
NOT with getent shadow.
and:
I can't login, not on the workstation, nor with ssh or su user.
I got a strong feeling it is PAM...
Here are some lines from /var/log/auth.log when I tried su user:
Dec 6 11:29:34 GX620 su[2069]: pam_unix(su:auth): authentication failure; logname=bo uid=1000 euid=0 tty=/dev/pts/1 ruser=bo rhost= user=sven
Dec 6 11:29:34 GX620 su[2069]: pam_sss(su:auth): authentication failure; logname=bo uid=1000 euid=0 tty=/dev/pts/1 ruser=bo rhost= user=sven
Dec 6 11:29:34 GX620 su[2069]: pam_sss(su:auth): received for user sven: 6 (Permission denied)
Dec 6 11:29:34 GX620 su[2069]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Dec 6 11:29:34 GX620 su[2069]: pam_ldap: reconnecting to LDAP server...
Dec 6 11:29:34 GX620 su[2069]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Dec 6 11:29:36 GX620 su[2069]: pam_authenticate: Authentication failure
Dec 6 11:29:36 GX620 su[2069]: FAILED su for sven by bo
System information:
System: Ubuntu 16.10
sssd version: 1.13.4
LDAP server OpenDJ 3.0
sssd.conf:
~$ sudo cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss,pam
domain = HEMMA.HOME
[nss]
filter_users = root
filter_groups = root
[pam]
[domain/HEMMA.HOME]
autofs_provider = ldap
ldap_schema = rfc2307bis
ldap_search_base = dc=hemma,dc=home
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_tls_reqcert = never
ldap_uri = ldap://ldap:389
ldap_id_use_start_tls = False
cache_credentials = True
enumerate = True
PAM:
~$ cat /etc/pam.d/common-session
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.
# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional pam_umask.so
# and here are more per-package modules (the "Additional" block)
session required pam_unix.so
session optional pam_sss.so
session optional pam_ldap.so
session optional pam_systemd.so
session optional pam_cgfs.so -c freezer,memory,name=systemd
# end of pam-auth-update config
When I google around, there are not much good information about sssd in ubuntu. I see a suggestion of using /etc/auth-client-config/profile.d/sss, it seems to be instead of nsswitch and pam. Someone know something about that? Haven't tried it yet, await some feedback from this list first.
Best regards from/Med vänliga hälsningar från
Johan Kragsterman
Capvert
7 years, 3 months
Re: n-way multi master and mirror mode
by Brendan Kearney
On 12/05/2016 11:36 AM, brendan kearney wrote:
> will do so later today. seems pretty consistent, so I should have
> logs for the sssd mailing list
>
> On Dec 5, 2016 11:12 AM, "Jakub Hrozek" <jakub.hrozek(a)posteo.se
> <mailto:jakub.hrozek@posteo.se>> wrote:
>
> On Sun, Dec 04, 2016 at 11:03:25PM +0000, Howard Chu wrote:
> > Brendan Kearney wrote:
> > > On 12/04/2016 04:49 PM, Quanah Gibson-Mount wrote:
> > > > Again, Mirror Mode is a concept, not a setting. The setting
> you refer to,
> > > > is, as I previously noted, misnamed. Either your servers
> are configured to
> > > > do multimaster replication, or they aren't.
> >
> > Mirrormode - the concept - is irrelevant here. All of the
> official docs show
> > the mirrormode setting being used in N-Way multimaster.
> >
> > > yes, i seem to be in the trap about the mirror mode misnomer.
> though
> > > ambiguous, your statements indicate that mirror mode the
> setting is required
> > > for n-way multi master replication.
> >
> > That is what the Admin Guide already says.
> > >
> > > i agree most of my traffic is reads. i have 7 examples of
> connections with
> > > deferred operations. they are all SRCH's (i.e. reads). I
> seem to misrember
> > > the source of the deferred connections. bind-dyndb-ldap does
> not show in my
> > > logs. sssd access is what 6 of 7 examples show. below is one
> sample.
> >
> > This is just due to sssd being very poorly written. It spews out
> a bunch of
> > LDAP requests without waiting for replies. It then abandons N-1
> of the
> > requests as soon as it reads the first reply. And then it
> reissues the
> > remaining requests, over and over. Instead it should just wait a
> little
> > longer for all the replies, instead of abandoning and
> resubmitting the same
> > requests and wasting redundant work.
>
> This is not how sssd is supposed to work, judging by the searches and
> the searches being for all the same modifyTimestamp values, it looks
> like a bug in sssd.
>
> If you can reproduce this on-demand, could you please correlate logs
> from the [domain] section and the [sudo] section of sssd.conf (the
> higher the debug_level, the better, but at least 8, please) with the
> server-side logs?
>
> btw the sssd-users mailing list might be a better place to debug sssd.
>
> In general I agree with Howard that sssd is at fault here, but at the
> same time I don't think this is expected activity. We've seen a report
> like this in the past, but could never reproduce it or get better
> debug
> logs, so maybe you could help us trace this bug down?
>
> >
> > > ReceivedAt FromHost SysLogTag Message
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 fd=29
> ACCEPT from
> > > IP=192.168.88.4:59233 <http://192.168.88.4:59233>
> (IP=192.168.88.1:389 <http://192.168.88.1:389>)
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0
> SRCH base=""
> > > scope=0 deref=0 filter="(objectClass=*)"
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0
> SRCH attr=*
> > > altServer namingContexts supportedControl supportedExtension
> supportedFeatures
> > > supportedLDAPVersion supportedSASLMechanisms
> domainControllerFunctionality
> > > defaultNamingContext lastUSN highestCommittedUSN
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0
> SEARCH RESULT
> > > tag=101 err=0 nentries=1 text=
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1
> BIND dn=""
> > > method=163
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1
> RESULT tag=97
> > > err=14 text=SASL(0): successful result:
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2
> BIND dn=""
> > > method=163
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2
> RESULT tag=97
> > > err=14 text=SASL(0): successful result:
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3
> BIND dn=""
> > > method=163
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND
> > > authcid="host/hypervisor.bpk2.com(a)BPK2.COM
> <mailto:hypervisor.bpk2.com@BPK2.COM>"
> > > authzid="host/hypervisor.bpk2.com(a)BPK2.COM
> <mailto:hypervisor.bpk2.com@BPK2.COM>"
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND
> > > dn="cn=hypervisor,ou=computers,dc=bpk2,dc=com" mech=GSSAPI
> sasl_ssf=56 ssf=56
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3
> RESULT tag=97
> > > err=0 text=
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:00 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:00 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:00 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:00 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:00 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:00 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=11
> ABANDON msg=5
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=12
> ABANDON msg=6
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=13
> ABANDON msg=7
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=14
> ABANDON msg=8
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=15
> ABANDON msg=9
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=16
> ABANDON msg=10
> > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=17
> ABANDON msg=11
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=21
> ABANDON msg=19
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=22
> ABANDON msg=20
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=23
> ABANDON msg=21
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:03 PM server1 slapd[5033]:
> connection_input: conn=2434
> > > deferring operation: too many executing
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=30
> ABANDON msg=25
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=31
> ABANDON msg=26
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=32
> ABANDON msg=27
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=33
> ABANDON msg=28
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=34
> ABANDON msg=29
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=35
> ABANDON msg=30
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=37
> ABANDON msg=37
> > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=39
> ABANDON msg=39
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH
> > > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0
> > >
> filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))"
> > >
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH
> > > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption
> sudoRunAs
> > > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter
> sudoOrder modifyTimestamp
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=43
> ABANDON msg=41
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=44
> ABANDON msg=42
> > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=45
> ABANDON msg=43
> > > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 op=46
> UNBIND
> > > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 fd=29
> closed
> > >
> > >
> > >
> >
> >
> > --
> > -- Howard Chu
> > CTO, Symas Corp. http://www.symas.com
> > Director, Highland Sun http://highlandsun.com/hyc/
> > Chief Architect, OpenLDAP http://www.openldap.org/project/
> <http://www.openldap.org/project/>
> >
>
moving this to sssd-users...
i am setting up the logging. what system should have log levels
increased to 8 in sssd.conf? the servers, a client, all?
7 years, 3 months
autofs bogus option
by john lehardos
Hello,
I am getting crazy on a parse error on an automount map (syntax error).
Can you please help me to highlight were is the error or what are the best practices on on mounting an NFS path tree ?
My logs :
Dec 05 13:06:49 inflin01.super.int automount[17148]: using kernel protocol version 5.02
Dec 05 13:06:49 inflin01.super.int automount[17148]: lookup(file): file map /etc/auto.master_animfr missing or not readable
Dec 05 13:06:49 inflin01.super.int automount[17148]: syntax error in map near [ prods -fstype=nfs,rw,bg,hard,intr,tcp,vers=3 animnas: ]
Dec 05 13:06:49 inflin01.super.int automount[17148]: syntax error in map near [ root ]
Dec 05 13:06:49 inflin01.super.int automount[17148]: syntax error in map near [ Prods ]
Dec 05 13:06:49 inflin01.super.int automount[17148]: mounted indirect on /misc with timeout 3600, freq 900 seconds
Dec 05 13:06:49 inflin01.super.int automount[17148]: ghosting enabled
Dec 05 13:06:49 inflin01.super.int automount[17148]: mounted indirect on /net with timeout 3600, freq 900 seconds
Dec 05 13:06:49 inflin01.super.int automount[17148]: ghosting enabled
Dec 05 13:06:49 inflin01.super.int systemd[1]: Started Automounts filesystems on demand.
My maps :
dn: ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr
ou: auto.master_animfr
objectClass: automountMap
objectClass: top
dn: cn=/homes,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr
automountInformation: ldap:ou=auto.home,ou=autofs,dc=superimage,dc=fr --timeout=3600
cn: /homes
objectClass: automount
objectClass: top
dn: ou=auto.s,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr
ou: auto.s
objectClass: automountMap
objectClass: top
dn: cn=apps,ou=auto.s,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr
cn: apps
description: auto.s
objectClass: automount
objectClass: top
automountInformation: -fstype=nfs,noatime,hard,intr,nosuid appserv.super.int:/vol/apps
dn: cn=prods,ou=auto.s,ou=auto.master_animfr,ou=autofs,dc=superimage,dc=fr
cn: prods
objectClass: automount
objectClass: top
automountInformation: -fstype=nfs,rw,bg,hard,intr,tcp,vers=3 animnas:/root/Prods
many thanks,
J
7 years, 3 months
Authenticating to either AD and KRB5/LDAP domains using separate domains and PAM stacks?
by Robert Sturrock
Hi All.
I’m trying to craft a configuration (on RHEL7, sssd-1.13.0-40.el7_2.12.x86_64) that will offer the following:
- authenticate a specific application (‘app’) via PAM/sssd to our AD directory (EXAMPLE.COM)
- authenticate everything else (in particular, sshd) via PAM/sssd to our UNIX-based Kerberos/LDAP directory (UNIXAUTH.EXAMPLE.COM)
Note that users have the same username in both directories, but have different passwords and different group membership.
The config I’m using to achieve this is:
----------
[sssd]
config_file_version = 2
services = nss, pam
domains = example.com, unixauth.example.com
[nss]
filter_groups = root
filter_users = root
default_shell = /bin/bash
override_homedir = /home/%u
[pam]
[domain/example.com]
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = permit
cache_credentials = true
ldap_idmap_range_size = 200000000
dyndns_update = false
ignore_group_members = true
debug_level = 7
[domain/unixauth.example.com]
debug_level = 9
id_provider = ldap
auth_provider = krb5
access_provider = ldap
chpass_provider = none
sudo_provider = none
authfs_provider = none
dns_discovery_domain = unixauth.example.com
lookup_family_order = ipv4_only
enumerate = true
ldap_uri = _srv_
ldap_default_bind_dn = cn=UNIX Manager,ou=admin,o=example
ldap_default_authtok = XXXXXXXXXXXXXXX
ldap_id_use_start_tls = true
ldap_access_filter = (isMemberOf=cn=systems,ou=roles,o=example)
ldap_user_search_base = ou=people,o=example?subtree?(|(isMemberOf=cn=systems,ou=roles,o=example))
ldap_group_search_base = ou=unix,o=example
ldap_schema = rfc2307
ldap_tls_reqcert = never
ldap_tls_cacertfile = /etc/openldap/cacerts/unixauth-ca-bundle.crt
# Get all the settings from /etc/krb5.conf
krb5_realm = UNIXAUTH.EXAMPLE.COM
—————
In addition, I’m specifying:
- ‘pam_sss.so […] domains=example.com’ in /etc/pam.d/app
- ‘pam_sss.so […] domains=unixauth.example.com’ in /etc/pam.d/system-auth
This configuration works to a point. The ‘app’ auth works correctly using AD credentials. However, although I can ssh-in to the host with my ‘unixauth.example.com’ credentials successfully as I want, my *group* membership is coming from AD (example.com) *instead of* LDAP (unixauth.example.com)!
Should it be possible to setup the configuration I describe? If so, are there some settings I’m missing to make this work?
Regards,
Robert.
7 years, 3 months
problems to get sssd started
by Johan Kragsterman
Hi!
I'm a newbie on sssd, and not fancy at ldap either.
So I'm starting with this in a small way to see where I can get it.
I've been googling quite extensively the last 3 days, and haven't found any answers.
System: Ubuntu 16.10
sssd version: 1.13.4
LDAP server OpenDJ
sssd.conf:
~$ sudo cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss,pam
domain = HEMMA.HOME
[nss]
#Not authenticated usr from ldap
filter_users = root,lightdm,nslcd,dnsmasq,dbus,avahi,avahi-autoipd,backup,beagleindex,bin,deamon,games,gdm,gnats,haldeamon,hplip,irc,ivm,an,klog,libuuid,list,lp,mail,man,messagebus,mysql,news,ntp,polkituser,proxy,pulse,saned,sshd,sync,sys,syslog,uucp,vde2-net,www-data
filter_groups = root
[pam]
[domain/HEMMA.HOME]
autofs_provider = ldap
ldap_schema = rfc2307bis
ldap_search_base = dc=hemma,dc=home
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ldap:389
ldap_id_use_start_tls = False
cache_credentials = True
enumerate = True
PAM:
~$ cat /etc/pam.d/common-session
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.
# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional pam_umask.so
# and here are more per-package modules (the "Additional" block)
session required pam_unix.so
session optional pam_sss.so
session optional pam_ldap.so
session optional pam_systemd.so
session optional pam_cgfs.so -c freezer,memory,name=systemd
# end of pam-auth-update config
~$ sudo service sssd restart
Job for sssd.service failed because the control process exited with error code.
See "systemctl status sssd.service" and "journalctl -xe" for details.
~$ sudo systemctl status sssd.service
● sssd.service - System Security Services Daemon
Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since lör 2016-12-03 17:37:15 CET; 25s ago
Process: 2236 ExecStart=/usr/sbin/sssd -D -f (code=exited, status=4)
dec 03 17:37:15 GX620 systemd[1]: Starting System Security Services Daemon...
dec 03 17:37:15 GX620 sssd[2236]: SSSD couldn't load the configuration database [2]: No such file or directory.
dec 03 17:37:15 GX620 systemd[1]: sssd.service: Control process exited, code=exited status=4
dec 03 17:37:15 GX620 systemd[1]: Failed to start System Security Services Daemon.
dec 03 17:37:15 GX620 systemd[1]: sssd.service: Unit entered failed state.
dec 03 17:37:15 GX620 systemd[1]: sssd.service: Failed with result 'exit-code'.
The only real problem I can see, is the:
"dec 03 17:37:15 GX620 sssd[2236]: SSSD couldn't load the configuration database [2]: No such file or directory"
And I don't understand why sssd couldn't load it. I ran:
~$ sudo ldbsearch -H /var/lib/sss/db/config.ldb
server_sort:Unable to register control with rootdse!
# record 1
dn: cn=HEMMA.HOME,cn=domain,cn=config
auth_provider: ldap
autofs_provider: ldap
cache_credentials: True
chpass_provider: ldap
cn: HEMMA.HOME
enumerate: True
id_provider: ldap
ldap_id_use_start_tls: False
ldap_schema: rfc2307bis
ldap_search_base: dc=hemma,dc=home
ldap_uri: ldap://ldap:389
distinguishedName: cn=HEMMA.HOME,cn=domain,cn=config
# record 2
dn: cn=sssd,cn=config
cn: sssd
config_file_version: 2
domain: HEMMA.HOME
services: nss,pam
distinguishedName: cn=sssd,cn=config
# record 3
dn: cn=config
version: 2
lastUpdate: 1480690424
distinguishedName: cn=config
# record 4
dn: cn=nss,cn=config
cn: nss
filter_groups: root
filter_users: root
distinguishedName: cn=nss,cn=config
# record 5
dn: cn=pam,cn=config
cn: pam
distinguishedName: cn=pam,cn=config
# returned 5 records
# 5 entries
# 0 referrals
And I can't see any problems there, except the "server_sort:Unable to register control with rootdse!" which I read in posts was not supposed to be a real problem. Or...?
Anyone can help me out a bit here...?
Best regards from/Med vänliga hälsningar från
Johan Kragsterman
Capvert
7 years, 3 months