Re: [Freeipa-interest] Announcing SSSD 1.16.0
by Michael Ströder
HI!
Has anything changed with building the man pages?
I'm asking because I now get formatting markup in the output of man (see
below).
Ciao, Michael.
SSSD-LDAP(5)
File Formats and Conventions
SSSD-LDAP(5)
.SH "NAME" sssd-ldap - SSSD LDAP provider
.SH "DESCRIPTION"
.PP This manual page describes the configuration of LDAP domains
for sssd(8). Refer to the “FILE FORMAT” section of the sssd.conf(5)
manual page for detailed syntax information.
.PP You can configure SSSD to use more than one LDAP domain.
6 years, 6 months
Kerberos Ticket renewal within Samba AD Domain
by Michael Löffler
Dear SSSD Users,
I have a question regarding the renewal of Kerberos tickets within a
Samba AD. All servers and clients are running Ubuntu 16.04. We have a
lot of Windows clients too; therefore we're using Samba. First of all,
I'll summarize our setup:
- One server acts as the Samba AD Host (and Kerberos (integrated in
Samba) principal)
- One server acts as a file server; all directories (the users' home
directories as well) are exported via kerberized NFS
- The clients mount the directories; login auth is realized using sssd
(with id_provider = ad, auth_provider = ad and access_provider = ad)
When a user logs in at a client, he gets a Kerberos ticket and is
therefore granted access to his home directory. If he locks the screen
and logs in again, the ticket is renewed. However, if the user keeps the
client locked for a time greater than the ticket lifetime, the ticket
expires and the user is not able to write to his home directory any
more. That's a problem if the user is, for example, running a process
which takes a long time (in our case mostly simulations which are
usually run overnight). The same things happens if a user connects to a
client via ssh. Then, the ticket is never renewed automatically.
Is it somehow possible to configure that sssd renews the krb5 ticket if
the user has active processes running?
Regards
Michael
6 years, 6 months
shortnames for 2 realms in Centos6
by Hampus Lundqvist
Hello
Im searching for a solution to use shortnames for users from both
FreeIPA(4.5) realm and a from a Trusted AD realm, I'm using Centos6.9
which has sssd 1.13.
I’m doing it for the centos7’s using domain resolution order in the IPA server.
Anyone has any suggestion on how to accomplish this on centos6?
BR
Hampus
6 years, 6 months
SSSD trusted domain in forest
by Andreas Hauffe
Hi,
I try to configure a client that is member of active directory domain
s2dom.d1dom.dom.example.com which is a subdomain of
d1dom.dom.example.com which itself is a subdomain of dom.example.com.
Now I try to to login with users from user(a)dom.example.com and
user1(a)s2dom.d1dom.dom.example.com. The last one works without problems.
But I'm not able to get a user(a)dom.example.com working.
my sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = s2dom.d1dom.dom.example.com
[nss]
default_shell=/bin/bash
override_homedir = /home/%u
[pam]
[domain/s2dom.d1dom.dom.example.com]
id_provider = ad
access_provider = ad
ldap_schema = ad
ldap_id_mapping=true
ldap_idmap_range_min=1000000
ldap_idmap_range_max=2000000
ldap_idmap_range_size=1000000
use_fully_qualified_names = true
Regards
Andreas
6 years, 6 months
pam_sss force smartcard for TTY logins
by Winberg, Adam
Using pam_pkcs11 we can use the parameter 'wait_for_card' to halt the pam
process until a smart card is inserted. Is there any feature like that with
pam_sss?
Use case is to require smart card for logins. With GDM this is configured
via dconf, but with console/tty logins there is no such configuration
available as I know of. So with pam_sss you can freely logon to a TTY
without using smartcard. Or maybe there is a solution out there I'm missing?
Regards
Adam
6 years, 6 months
p11_child showing certificate on smart card not valid
by Winberg, Adam
I'm trying to get smartcard auth working with sssd on RHEL 7.4. We
currently use a pam_pkcs11/pam_krb5 setup and I was hoping to simplify this
by using sssd instead. Unfortunately I cant get it to work, sssd does not
seem to detect my smartcard certificate.
Running p11_child I get the following:
$ /usr/libexec/sssd/p11_child --pre -d 10 --debug-fd=2
--nssdb=/etc/pki/nssdb --pin
(Thu Oct 19 10:43:19:786759 2017) [[sssd[p11_child[6320]]]] [main]
(0x0400): p11_child started.
(Thu Oct 19 10:43:19:786836 2017) [[sssd[p11_child[6320]]]] [main]
(0x2000): Running in [pre-auth] mode.
(Thu Oct 19 10:43:19:786849 2017) [[sssd[p11_child[6320]]]] [main]
(0x2000): Running with effective IDs: [0][0].
(Thu Oct 19 10:43:19:786859 2017) [[sssd[p11_child[6320]]]] [main]
(0x2000): Running with real IDs [0][0].
(Thu Oct 19 10:43:20:755639 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Default Module List:
(Thu Oct 19 10:43:20:755722 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): common name: [NSS Internal PKCS #11 Module].
(Thu Oct 19 10:43:20:755753 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): dll name: [(null)].
(Thu Oct 19 10:43:20:755780 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): common name: [p11-kit-trust].
(Thu Oct 19 10:43:20:755864 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): dll name: [/usr/lib64/pkcs11/p11-kit-trust.so].
(Thu Oct 19 10:43:20:755900 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): common name: [OpenSC PKCS #11 Module].
(Thu Oct 19 10:43:20:755958 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): dll name: [/usr/lib64/pkcs11/opensc-pkcs11.so].
(Thu Oct 19 10:43:20:755992 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Dead Module List:
(Thu Oct 19 10:43:20:756025 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): DB Module List:
(Thu Oct 19 10:43:20:756057 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): common name: [NSS Internal Module].
(Thu Oct 19 10:43:20:756085 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): dll name: [(null)].
(Thu Oct 19 10:43:20:756112 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): common name: [Policy File].
(Thu Oct 19 10:43:20:756140 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): dll name: [(null)].
(Thu Oct 19 10:43:20:771873 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Description [NSS User Private Key and Certificate Services
Mozilla Foundation ] Manufacturer [Mozilla
Foundation ] flags [1].
(Thu Oct 19 10:43:20:771969 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Description [NSS Internal Cryptographic Services
Mozilla Foundation ] Manufacturer [Mozilla
Foundation ] flags [1].
(Thu Oct 19 10:43:20:772007 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Description [/usr/share/pki/ca-trust-source
PKCS#11 Kit ] Manufacturer [PKCS#11 Kit
] flags [1].
(Thu Oct 19 10:43:20:772037 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Description [/etc/pki/ca-trust/source
PKCS#11 Kit ] Manufacturer [PKCS#11 Kit
] flags [1].
(Thu Oct 19 10:43:20:772245 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Description [Alcor Micro AU9540 00 00
Generic ] Manufacturer [Generic
] flags [7].
(Thu Oct 19 10:43:20:772290 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Found [identification (Instant EID IP9)] in slot [Alcor Micro
AU9540 00 00][0] of module [3][/usr/lib64/pkcs11/opensc-pkcs11.so].
(Thu Oct 19 10:43:20:772320 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Token is NOT friendly.
(Thu Oct 19 10:43:20:772346 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Trying to switch to friendly to read certificate.
(Thu Oct 19 10:43:20:772372 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Login required.
(Thu Oct 19 10:43:20:772397 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x0020): Login required but no pin available, continue.
(Thu Oct 19 10:43:20:773994 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): found cert[identification (Instant EID
IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com]
(Thu Oct 19 10:43:20:774071 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): Filtered certificates:
(Thu Oct 19 10:43:20:774167 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): found cert[identification (Instant EID
IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com]
(Thu Oct 19 10:43:20:804677 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x0040): Certificate [identification (Instant EID
IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] not valid [-8062],
skipping.
(Thu Oct 19 10:43:20:804857 2017) [[sssd[p11_child[6320]]]] [do_work]
(0x4000): No certificate found.
What does the error code '-8062' mean?
Regards,
Adam
6 years, 6 months
p11_child selinux woes
by Winberg, Adam
I'm running tests with using sssd for smartcard auth as an pam_pkcs11
replacement. I've gotten it to work, but am getting a _lot_ of selinux
denials.
It seems that p11_child inherits the sssd selinux context and therefore
runs in the 'sssd_t' domain. This causes problems since p11_child seems to
want access to a whole lot of stuff. Some examples:
SELinux is preventing /usr/libexec/sssd/p11_child from search access on the
directory fs.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /dev/hugepages.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /proc/fs/nfsd.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /boot.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /home.
SELinux is preventing /usr/libexec/sssd/p11_child from search access on the
directory /var/lib/nfs.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /.
SELinux is preventing /usr/libexec/sssd/p11_child from execute access on
the file /run/user/60483/ffiSOUzGu (deleted).
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /sys/fs/fuse/connections.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /dev.
SELinux is preventing /usr/libexec/sssd/p11_child from execute access on
the file /dev/shm/ffi8thWCx (deleted).
SELinux is preventing /usr/libexec/sssd/p11_child from execute access on
the file /run/ffi24njzA (deleted).
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /sys/kernel/config.
SELinux is preventing /usr/libexec/sssd/p11_child from write access on the
directory /sys/fs/selinux.
An Sealert output:
SELinux is preventing /usr/libexec/sssd/p11_child from search access on the
directory .config.
***** Plugin catchall (100. confidence) suggests
**************************
If you believe that p11_child should be allowed search access on the
.config directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'p11_child' --raw | audit2allow -M my-p11child
# semodule -i my-p11child.pp
Additional Information:
Source Context system_u:system_r:sssd_t:s0
Target Context unconfined_u:object_r:config_home_t:s0
Target Objects .config [ dir ]
Source p11_child
Source Path /usr/libexec/sssd/p11_child
Port <Unknown>
Host c21226.ad.smhi.se
Source RPM Packages sssd-krb5-common-1.15.2-50.el7_4.6.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.13.1-166.el7_4.5.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name c21226.ad.smhi.se
Platform Linux c21226.ad.smhi.se
3.10.0-693.5.2.el7.x86_64
#1 SMP Fri Oct 13 10:46:25 EDT 2017 x86_64
x86_64
Alert Count 29
First Seen 2017-10-20 08:14:10 CEST
Last Seen 2017-10-20 13:21:38 CEST
Local ID 17d70bbe-a54d-47c3-8515-985d6646a93f
Raw Audit Messages
type=AVC msg=audit(1508498498.877:13286): avc: denied { search } for
pid=29036 comm="krb5_child" name=".config" dev="sda2" ino=16782181
scontext=system_u:system_r:sssd_t:s0
tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1508498498.877:13286): arch=x86_64 syscall=openat
success=no exit=EACCES a0=ffffffffffffff9c a1=56536c43c350 a2=90800 a3=0
items=0 ppid=20098 pid=29036 auid=4294967295 uid=0 gid=0 euid=0 suid=0
fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=krb5_child
exe=/usr/libexec/sssd/krb5_child subj=system_u:system_r:sssd_t:s0 key=(null)
Hash: p11_child,sssd_t,config_home_t,dir,search
Whats with all the acceses, is that normal? And if so, how's that suppose
to work while running in the 'sssd_t' context?
Regards
Adam
6 years, 6 months
kerberos/sssd lowercase problem
by Hampus Lundqvist
Hi
Facing an issue where kinit defaults to using realm name in lowercase. Im switching to the user and execute 'kinit'
the krb5kdc.log shows that it uses lowercased realm name and kinit gives an e-text error..
if I run as same user: kinit username it will add @REALM.. i did use "su" to become this user.
Krb5.conf is running with defaults from ipa-client install, sssd 1.15.
Any ideas?
BR
Hampus
6 years, 6 months
sssd pam password
by Günther J. Niederwimmer
Hello,
CentOS 7.4
I mean this is a old question :-(.
but is it possible to have a password from sssd ?
My Problem is, I installed FreeIPA and like to have a Dovecot SASL -> postfix
installation?
I configured Dovecot to use PAM, but with this I have no password for the
postfix!
What is the correct way to have a secure authentication for dovecot SASL ->
postfix?
Have I to do this with LDAP or is it possible with a "normal" way.
Thanks for a answer,
--
mit freundlichen Grüssen / best regards,
Günther J. Niederwimmer
6 years, 6 months
sudo trying to use proxy for auth
by Asif Iqbal
I setup sssd to login with 2 factor auth and it works fine and then I am
failing to sudo with ldap even though id_provider is ldap.
Here is log from sssd_LDAP when running sudo -s
http://dpaste.com/36PTMS0.txt
Here is relevant config
[domain/LDAP]
chpass_provider = krb5
access_provider = ldap
id_provider = ldap
...
auth_provider = proxy
proxy_pam_target = securid
..
There is no sudo_* in here
sudo -s works if I use the auth provider, which is 2FA. So it seems like
sudo auth follows whatever auth_provider is set to?
Can I have ssh login with proxy as auth provider and sudo login with ldap
as auth provider?
I know both ssh and sudo login works with ldap and krb5, but I need to have
the ssh login with 2FA in my env.
Thanks for your help
--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
6 years, 6 months