sssd not automatically switching to online mode when dns becomes available
by Robert Bayerl
When using dnsmasq as a local caching nameserver, sssd does not recover if it is started before DNS is available.
Steps to reproduce:
stop local caching nameserver
stop/start sssd
start local caching nameserver
sssd never switches to online mode or retries the DNS lookup for the SRV record.
8 years
access_provider is completely ignored
by Josh England
I have sssd doing authentication through ldap and I actually have a working configuration that uses access_provider=ldap and ldap_access_filter and does the right thing on CentOS 6.4. On another system (CentOS 6.7) the exact same configuration does not work. Access is granted at all times no matter what. In fact, I can put in access_provider=deny, and access is still granted. Is there some dependency that I got right on the first system that is incorrect on this one? I can post logs if needed.
Relevant info for non-working system:
OS: CentOS 6.7 x86_64
sssd version: 1.12.4-47 (also tried 1.13.3 built from source)
sssd.conf:
[domain/ldap]
ldap_schema = rfc2307
ldap_search_base = dc=DOMAIN
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = deny
ldap_uri = ldaps://LDAP_SERVER1,ldaps://LDAP_SERVER2
cache_credentials = True
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/openldap/cacerts
[sssd]
config_file_version = 2
services = nss, pam
debug_level = 1
domains = ldap
[nss]
debug_level = 1
[pam]
debug_level = 1
/etc/nsswitch.conf (relevant bits):
passwd: sss files
shadow: sss files
group: sss files
services: files sss
netgroup: files sss ldap
/etc/pam.d/system-auth:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3 type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_oddjob_mkhomedir.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
Thank you for any help,
-JE
8 years, 1 month
sssd+ldap and client certificates
by Graham Leggett
Hi all,
I have a 389ds server that uses a certmap to map client certificates to a valid bind, and this works fine.
I am struggling to get sssd on ubuntu trusty to use a client certificate to talk to this server, and I don't know what I'm doing wrong. My /etc/sssd/sssd.conf looks like below.
[sssd]
config_file_version = 2
domains = LDAP
services = nss, pam
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
# A native LDAP domain
[domain/LDAP]
enumerate = true
cache_credentials = TRUE
debug_level = 9
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://ldap.example.com:636
ldap_user_search_base = dc=example,dc=com
tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/root-ca.crt
ldap_tls_cert = /etc/ssl/certs/my.crt
ldap_tls_key = /etc/ssl/private/my.key
ldap_sasl_mech = EXTERNAL
When sssd attempts to connect to the LDAP server, first it connects and makes an anonymous bind, which the server refuses. sssd then tries to make a SASL EXTERNAL bind, which fails claiming external isn't a valid bind method.
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0400): Search result: Inappropriate authentication(48), Anonymous access is not allowed.
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_generic_ext_done] (0x0040): Unexpected result from ldap: Inappropriate authentication(48), Anonymous access is not allowed.
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [5]: Input/output error
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_get_server_opts_from_rootdse] (0x0200): No known USN scheme is supported by this server!
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x1000): the connection will expire at 1458231814
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: EXTERNAL, user: (null)
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-6)[Unknown authentication method]
(Thu Mar 17 16:08:34 2016) [sssd[be[LDAP]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-4): no mechanism available: ]
From what I can see, there is no attempt to use the client certificate at all.
Can anyone point out where I am going wrong?
Regards,
Graham
--
8 years, 1 month
access_provider is completely ignored
by Josh England
I'm using sssd along with ldap for user authentication and some access control. On an older CentOS 6.4 setup, I have used access_provider=ldap along with ldap_access_filter with success. However, on a newer system using CentOS 6.7 with the same configuration, I cannot get access control working. All users are granted access regardless of the access_provider setting. I've tried ldap, simple, and even deny and none of them work on the newer box. I've tried building the latest version from source to no avail and looking through logs with higher debug level doesn't provide any clues (to me). What are some things I can check to try to debug this?
-JE
8 years, 1 month
Re: Could not convert objectSID [...] to a UNIX ID
by Francis, Arthur
This combination also works well on our very large AD:
ldap_idmap_range_min = 200000
ldap_idmap_range_max = 2000200000
ldap_idmap_range_size = 1000000
_____________
The information contained in this message is proprietary and/or confidential. If you are not the intended recipient, please: (i) delete the message and all copies; (ii) do not disclose, distribute or use the message in any manner; and (iii) notify the sender immediately. In addition, please be aware that any message addressed to our domain is subject to archiving and review by persons other than the intended recipient. Thank you.
8 years, 1 month
SSSD ad mode issues version sssd-1.12.4-47.el6_7.7.x86_64
by Fabien CARRE
Hello,
I am experiencing some issues with this version of sssd in ad mode. I am
unable to connect to a computer. But when using the previous version on
another computer (sssd-1.11.6-30.el6.x86_64) it's working fine.
DC : Windows 2012R2
client 1 : centos 6.6 - sssd-1.11.6-30.el6.x86_64
client 2 centos 6.7- sssd-1.12.4-47.el6_7.7.x86_64
I am attaching the krb5_child.log file.
Has anyone got the same issues ?
Thanks
Regards,
8 years, 1 month
sssd and NIS?
by Hauke Fath
[re-sent after subscribing with my sender address]
All,
I am working on deploying sssd to a number of Debian Linux
workstations, and it's slow-going... and I could use some help.
The workstations mount users' homes and a few public shares over NFS,
using automount. User information, automounter maps etc are shared
through NIS. Besides caching, easy switching of backends (say, to
Kerberos and LDAP) is why I want to move to sssd. But it looks like NIS
support is a bit under-documented.
The installed ssd version ("wheezy-backports") is
# dpkg-query -l sssd
Desired=Unknown/Install/Remove/Purge/Hold
|
Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-============-============-=================================
ii sssd 1.11.7.3-3~b amd64 System Security Services
Daemon -
#
Debian updates pam.d/common-*
# fgrep sss /etc/pam.d/*
/etc/pam.d/common-account:account [default=bad success=ok
user_unknown=ignore] pam_sss.so
/etc/pam.d/common-auth:auth [success=1
default=ignore] pam_sss.so use_first_pass
/etc/pam.d/common-password:password
sufficient pam_sss.so
/etc/pam.d/common-session:session
optional pam_sss.so
#
and nsswitch.conf, funny enough by appending the sss modules
# fgrep sss /etc/nsswitch.conf
passwd: files nis sss
group: files nis sss
shadow: files nis sss
netgroup: nis sss
sudoers: files sss
#
and does not install any /etc/sssd/sssd.conf, so the system is broken
after installing sssd and friends.
My sssd.conf is
[sssd]
config_file_version = 2
reconnection_retries = 3
debug_level = 0x0070
services = nss, pam
domains = spgnts
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
debug_level = 0x0070
[pam]
reconnection_retries = 3
pam_verbosity = 3
debug_level = 0x0070
[domain/spgnts]
debug_level = 0x0070
enumerate = true
id_provider = proxy
proxy_lib_name = nis
min_id = 500
auth_provider = proxy
proxy_pam_target = none
-- if there is any further configuration detail you consider relevant
to the issue, please let me know.
When I start all this, things work until I take out the 'nis' entries
from nsswitch.conf. To my understanding, as long as they are in,
queries never go to the nss_sss module.
Once I take out the 'nis' entries, I can log in as root on the console,
I can log in as a regular user over ssh (public key auth), but all
other login attempts time out. kdm mutters about pam_setcred() problems
on the console.
The /var/log/sssd/* logs are voluminous, but virtually free of any
helpful information. Upon login, sssd appears to start a bunch of
proxy_child processes, which hang there until timeout, at which point
they get killed. I tried copying a commandline from ps, and strace a
proxy_child invocation, but the trace didn't speak to me.
I have searched the web far and wide, but there is little more than lip
service to using the proxymodule, much less NIS. As of now, my hunch is
the problem lies with PAM - how do you configure the domain's
auth_provider for NIS? I came across "#proxy_auth_target =
nis_pam_proxy", but it wasn't documented.
Thanks for reading this far; any comments are most welcome!
Cheerio,
Hauke
--
The ASCII Ribbon Campaign Hauke Fath
() No HTML/RTF in email Institut für Nachrichtentechnik
/\ No Word docs in email TU Darmstadt
Respect for open standards Ruf +49-6151-16-21344
8 years, 1 month
Information Flow Question
by Kenneth Schwartz
I hope somebody can answer this for me and clarify questions I have about this
process. If this is not the right place to ask the question please tell me
where I might be able to get answers to my questions.
I want a Linux machine to become a user of the active directory Does
SSD configure
you to be part of the Windows domain or is it only using a small part such
as list, positions of things, resource sharing, etc. Or is it a full-fledged
Windows user? I want to know about the process of enrolling the CAC with
the PKI/widows domain/active directory. When you log in with the
smartcard/CAC, when and how does enrollment occur? I think enrollment could
be one of two things: You could use the certificates/identifier number
from the CAC to enroll and be in active directory/PKI. What is the enrollment
PKI? I want to understand the associations between the CAC, Windows, and
what information is stored. I don't think it's the cerificate but just
the number. Once you've logged into the machine does in use certificates
from the CAC and how does the information get there. How do you associate
the CAC with the windows user from active directory? How do you connect
using your key? Once you're on a machine and you need to log in to a Linux
machine that's a member and you want to prove who you are
from a machine that has become part of active directory how do you know? Does
Linux associate the CAC the same way that Windows does? For SSH? kinit
involvement?
Does the SSS module or pam module handle session tickets or does it only
give you your only initial ticket granting ticket?
8 years, 1 month
SSSD: Cross Forest AD Trust with sssd-ad provider
by PARTH MONGA
Hi List,
I am using sssd-1.13 to authenticate my linux clients against Active Directory.
Got this working too.
Now we have an incoming one way trust from another domain.
So here is the scenario:
AD1: dom1.com - One-way incoming trust from AD2.
AD2: dom2.com - One-way outgoing trust to AD1.
LinuxClient1: member of AD1/dom1.com
Can lookup User1(Created in AD1/DOM1): Linux1>$id AD1\User1 - OK
Can't lookup User2(Created in AD2/DOM2) Linux1>$id AD2\User2 - Not OK.
SSSD is configured with AD1 domain.
Is this kind of configuration possible with SSSD and sssd-ad provider because i am able to achieve the above using likewise but not sssd.
Please show some light on this.
Regards,
Parth
8 years, 1 month