pam_sss and pam_gnome_keyring does not work
by Joakim Tjernlund
Trying to get make automatic keyring unlock work with pam_sss and it fails :)
I have in my pam conf:
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass likeauth nullok
auth sufficient pam_sss.so forward_pass use_first_pass
auth optional pam_gnome_keyring.so
auth optional pam_group.so
auth required pam_deny.so
But this fails to unlock the keyring, but if I move pam_gnome_keyring.so before pam_sss.so
it works. It looks to as the forward_pass option fails to preserve the password.
Any pointers?
Jocke
7 years, 4 months
Adding service to sssd + AD
by Maciej Piechotka
I have following configuaration:
[sssd]
config_file_version = 2
domains = domain.com
services = nss, pam
[nss]
[pam]
[domain/domain.com]
cache_credentials = true
id_provider = ad
auth_provider = ad
access_provider = simple
default_shell = /bin/zsh
fallback_homedir = /home/%d/%u
use_fully_qualified_names = true
ldap_id_mapping = true
ldap_schema = ad
ldap_idmap_range_min = 100000
ldap_idmap_range_max = 2000100000
ldap_idmap_range_size = 200000000
ldap_idmap_default_domain = DOMAIN.COM
ignore_group_members = true
Ticket cache: FILE:/tmp/krb5cc_400389252_3sT5UifBXn
Default principal: username(a)DOMAIN.COM
Valid starting Expires Service principal
07/20/2016 12:18:01 07/20/2016 21:14:13 krbtgt/DOMAIN.COM(a)DOMAIN.COM
renew until 07/27/2016 11:14:13
I got kerberos working and login through gssapi to ssh:
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
2 host/hostname.domain.com(a)DOMAIN.COM
2 host/hostname.domain.com(a)DOMAIN.COM
2 host/hostname.domain.com(a)DOMAIN.COM
2 host/hostname.domain.com(a)DOMAIN.COM
2 host/hostname.domain.com(a)DOMAIN.COM
2 host/hostname(a)DOMAIN.COM
2 host/hostname(a)DOMAIN.COM
2 host/hostname(a)DOMAIN.COM
2 host/hostname(a)DOMAIN.COM
2 host/hostname(a)DOMAIN.COM
2 HOSTNAME$(a)DOMAIN.COM
2 HOSTNAME$(a)DOMAIN.COM
2 HOSTNAME$(a)DOMAIN.COM
2 HOSTNAME$(a)DOMAIN.COM
2 HOSTNAME$(a)DOMAIN.COM
However I cannot get OpenAFS to work. I suspect it is that I don't have
afs/hostname(a)DOMAIN.COM principal. How should I add service to keytab
(I don't have admin rights on KDC) with SSD + AD?
Maciej
7 years, 4 months
pam_sss and pam_gnome_keyring does not work
by Joakim Tjernlund
Trying to get make automatic keyring unlock work with pam_sss and it fails :)
I have in my pam conf:
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass likeauth nullok
auth sufficient pam_sss.so forward_pass use_first_pass
auth optional pam_gnome_keyring.so
auth optional pam_group.so
auth required pam_deny.so
But this fails to unlock the keyring, but if I move pam_gnome_keyring.so before pam_sss.so
it works. It looks to as the forward_pass option fails to preserve the password.
Any pointers?
Jocke
7 years, 4 months
usind sssd on aix machine.
by cem.yetil@teb.com.tr
Hi,
I am trying to implement Redhat Identity Management on my test environment. I have a question about sssd on Unix platform. Is there any way to implement sssd on Aix or Solaris machines? I heard about the opensource project but I couldn’t find anything about that on Google. Is there any community to discuss that? Thanks for your helps.
Best regards,
Cem
[http://image.teb.com.tr/TEBMailSignature/Banka/e-imza-logo.jpg]
Cem Yetil
Unix ve Veri Depolama Sistemleri Proje Uzmanı
Unix ve Veri Depolama Sistemleri Birimi
Genel Müdürlük
T: +90 (216) 645 10 00 - F: +90 (216) 636 36 36
M:
cem.yetil(a)teb.com.tr<mailto:cem.yetil@teb.com.tr>
teb.com.tr<http://www.teb.com.tr>
[http://image.teb.com.tr/TEBMailSignature/agac.jpg]Lütfen gerekli olmadıkça bu dokümanın kağıt çıktısını almayın, doğayı koruyun.
________________________________
Bu elektronik posta mesajı ve ekleri sadece gönderildiği kişi veya kuruma özeldir ve gizli bilgiler içerebilir. Eğer bu mesajı hataen aldıysanız lütfen bu durumu gönderen kişiye derhal bildiriniz ve mesajı sisteminizden siliniz. Eğer doğru kişiye ulaşmadığını düşünüyorsanız, bu mesajın gizlenmesi, yönlendirilmesi, kopyalanması veya herhangi bir şekilde kullanılması yasaktır. Internet iletişiminde güvenlik ve hatasız gönderim garanti edilemeyeceğinden, mesajın yerine ulaşmaması, geç ulaşması, içeriğinin bozulması ya da mesajın virüs taşıması gibi problemler oluşabilir. Gönderen taraf bu tip sorunlardan sorumlu tutulmaz.
Türk Ekonomi Bankası A.Ş.
Ticaret Sicil No: 189356 Mersis No: 0876004342000105
TEB Kampüs C ve D Blok Saray Mah. Sokullu Cad. No:7A - 7B
Ümraniye 34768 / İSTANBUL
www.teb.com.tr <http://www.teb.com.tr>
This e-mail message and any attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this message in error, please notify the sender immediately and delete it from your system. If you are not the intended recipient you are hereby notified that any dissemination, forwarding, copying or use of any of the information is prohibited. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. The sender therefore does not accept liability for any errors or omissions in the context of this message which arise as a result of Internet transmission
Türk Ekonomi Bankası A.Ş.
Trade Registry Number: 189356, Central Registration System Number: 0876004342000105
TEB Kampüs C ve D Blok Saray Mah. Sokullu Cad. No:7A - 7B
Ümraniye/ İSTANBUL/Turkey
www.teb.com.tr <http://www.teb.com.tr>
7 years, 4 months
error: cannot find input file: `po/Makefile.in.in'
by Srinivasa Rao Ragolu
Hi All,
I am trying to build sssd using yocto bitbake recipe http://git.yoctoproject.org/cgit/cgit.cgi/meta-security/tree/recipes-secu.... While configuring sssd , I am facing below error.
configure: creating ./config.status
config.status: creating Makefile
config.status: creating contrib/sssd.spec
config.status: creating src/examples/rwtab
config.status: creating src/doxy.config
config.status: creating contrib/sssd-pcsc.rules
config.status: creating src/sysv/sssd
config.status: creating src/sysv/gentoo/sssd
config.status: creating src/sysv/SUSE/sssd
config.status: error: cannot find input file: `po/Makefile.in.in'
Configure failed. The contents of all config.log files follows to aid debugging
Please suggest me any patch available to fix this issue. Or help me in resolving this issue.
Thanks,
Srinivas.
7 years, 4 months
Setting alternative shell for members of group in AD child domain
by Renfro, Michael
I've previously only used sssd in a much simpler situation, on a
single-domain AD forest with no additional complications. Now, I'm trying
to make it work with the following:
1. Forest (vvu.edu) with two domains (vvu.edu, the root domain) and
vae.vvu.edu (child domain), with the default two-way trust between the
domains. For reasons of Windows system management and user experience, I
can't easily break the domain trust or put all users in the root domain.
2. Linux system with sssd, preferably Debian or Ubuntu, tied to the child
domain. CentOS and RHEL may be a possibility later. I assume any working
version number of sssd will work identically on any platform.
3. As far as the Linux system is concerned, all user accounts in the root
domain are normal, unprivileged end-user accounts. These should get a
shell of /usr/bin/rssh.
4. The only user accounts in the child domain are for system
administrators. Accounts in the AD group 'server-admins' should get a
shell of /bin/bash.
I got hints from both
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl
and http://serverfault.com/a/577885 , but I'm stuck without a complete
solution.
For a test case on Debian 8, sssd 1.11.7-3, my sssd.conf has contents of:
[sssd]
#domains = admins_vae, vae.vvu.edu
domains = vae.vvu.edu
config_file_version = 2
services = nss, pam
[domain/vae.vvu.edu]
id_provider = ad
ad_domain = vae.vvu.edu
override_homedir = /home/vvu.edu/%u
default_shell = /usr/bin/rssh
[domain/admins_vae]
id_provider = ad
ad_domain = vae.vvu.edu
override_homedir = /home/vae.vvu.edu/%u
default_shell = /bin/bash
#access_provider = simple
#simple_allow_groups = server-admins
access_provider = ad
ad_access_filter =
memberOf=cn=server-admins,ou=groups,dc=vae,dc=vvu,dc=edu
and testing with this configuration returns:
root@files:~# getent group server-admins
server-admins:*:225001113:_renfro
root@files:~# getent passwd renfro(a)vvu.edu
renfro@vvu.edu:*:927801103:927801103:renfro:/home/vvu.edu/renfro:/usr/bin/r
ssh
root@files:~# getent passwd _renfro(a)vae.vvu.edu
_renfro:*:225001109:225000513:_renfro:/home/vvu.edu/_renfro:/usr/bin/rssh
root@files:~# getent passwd _renfro
_renfro:*:225001109:225000513:_renfro:/home/vvu.edu/_renfro:/usr/bin/rssh
where the group membership is correct and the single enabled sssd domain
provides NSS information as instructed.
After changing the list of domains in sssd.conf to use **both** the
vae_admins domain and the vae.vvu.edu one, both users end up getting admin
settings, instead of the admin user getting the admin setting, and the
regular user getting his original setting:
root@files:~# getent group server-admins
server-admins:*:225001113:_renfro
root@files:~# getent passwd _renfro
_renfro:*:225001109:225000513:_renfro:/home/vae.vvu.edu/_renfro:/bin/bash
root@files:~# getent passwd renfro(a)vvu.edu
renfro@vvu.edu:*:927801103:927801103:renfro:/home/vae.vvu.edu/renfro:/bin/b
ash
I get identical results with the simple access provider, too (both users
get admin settings). Where can I go from here? Thanks in advance for any
help.
--
Mike Renfro / R&D Engineer, Center for Manufacturing Research,
931 372-3601 / Tennessee Technological University
7 years, 4 months
sssd authentication fails with "Cannot read password" after upgrading to 1.14
by David Wilhelm
After upgrading from 1.13.4 to 1.14.0, I am unable to sign in or use sudo for kerberos-authenticated accounts. However, kinit still succeeds and "getent passwd" still lists all network users. Downgrading to 1.13.4 (after clearing the credential cache folder) restores normal operation.
My setup:
I'm running Arch linux, and have PAM set to use sssd. sssd in turn authenticates against a kerberos instance running on my NAS, and pulls user information from an openldap instance. PAM, kerberos, and openldap were configured by hand as a learning experience, and have been running for about a year. DNS and NTP are working, ldap is returning users, and kinit is succeeding on both my local machine and the server.
This appears to be the relevant section of the logs, from krb5_child.log (with debug_level 10):
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x0400): krb5_child started.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [unpack_buffer] (0x1000): total buffer size: [147]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [unpack_buffer] (0x0100): cmd [241] uid [1042] gid [1001] validate [false] enterprise principal [false] offline [false] UPN [dave(a)LA-LA.LAN]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1042_XXXXXX] old_ccname: [FILE:/tmp/krb5cc_1042_93EyUo] keytab: [/etc/krb5.keytab]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [check_use_fast] (0x0100): Not using FAST.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [switch_creds] (0x0200): Switch user to [1042][1001].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [switch_creds] (0x0200): Switch user to [0][0].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [FILE:/tmp/krb5cc_1042_93EyUo] and is active and TGT is valid.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [become_user] (0x0200): Trying to become user [1042][1001].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x2000): Running as [1042][1001].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [become_user] (0x0200): Trying to become user [1042][1001].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [become_user] (0x0200): Already user [1042].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_setup] (0x2000): Running as [1042][1001].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_child_set_krb5_tracing] (0x0100): krb5 tracing is not available
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [false]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x0400): Will perform online auth
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [tgt_req_child] (0x1000): Attempting to get a TGT
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [LA-LA.LAN]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_krb5_prompter] (0x4000): sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_krb5_prompter] (0x0020): Cannot handle password prompts.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [sss_krb5_prompter] (0x4000): Prompt [0][Password for dave(a)LA-LA.LAN].
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [get_and_save_tgt] (0x0020): 1296: [-1765328254][Cannot read password]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [map_krb5_error] (0x0020): 1365: [-1765328254][Cannot read password]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_send_data] (0x0200): Received error code 1432158218
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [pack_response_packet] (0x2000): response packet size: [4]
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [k5c_send_data] (0x4000): Response sent.
(Thu Jul 14 16:47:32 2016) [[sssd[krb5_child[2461]]]] [main] (0x0400): krb5_child completed successfully
Please let me know if any other logs or configurations are needed.
7 years, 4 months
SSSD not responding to pings
by mohammed irfan
Hi Team,
I have installed Rstuido-server in one our linux instance. After installing
Rstudio on our machine we have been facing SSSD deamon issues. i.e. "sssd:
Killing service [AD], not responding to pings!"
[image: Inline image 2]
Could any one help us on this issue. thanks in advance.
Thanks,
Irfan
7 years, 4 months
sssd 1.13.3 - Failed to retreive users
by Ondrej Valousek
Hi List,
After upgrade from 1.12 to 1.13.3. I see sporadically messages like these:
(Fri Jul 8 09:47:20 2016) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Fri Jul 8 09:47:20 2016) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success
(Fri Jul 8 09:49:59 2016) [sssd[be[default]]] [sdap_get_users_done] (0x0040): Failed to retrieve users
I am running RHEL-6 with AD provider. Google pointed me at:
https://fedorahosted.org/sssd/ticket/2906
so tried to add 'ldap_referrals = False', but I still see these messages.
So far, it does not seem to affect the functionality, but in rare cases I see sssd being unable to recognize some users.
Any ideas?
Thanks,
Ondrej
-----
The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.
7 years, 4 months