sssd-users September 2024

sssd-users@lists.fedorahosted.org

8 participants
3 discussions

devcontainer
by Ryan Slominski 01 Oct '24

01 Oct '24

Hi, I'm looking for tips on building sssd in a devcontainer. The simplest naive thing: https://github.com/slominskir/sssd-devcontainer/blob/main/Dockerfile ```Dockerfile FROM fedora:40 RUN dnf install 'dnf-command(builddep)' tini git -y ; dnf builddep sssd -y ENTRYPOINT ["/usr/bin/tini", "--"] CMD ["sleep", "infinity"] ``` Configure step fails with: checking for CAP... no configure: error: libcap is missing Ran with: docker build . -t dev docker run --rm --name dev dev docker exec -it dev bash cd /opt git clone https://github.com/SSSD/sssd cd sssd autoreconf -if ./configure Regards, Ryan

4 7

Fwd: LDAP via SSSD identifies users but won't authenticate.
by GrahamC 15 Sep '24

15 Sep '24

Hi, I have existing systems that authenticate via LDAP using SSSD and have recently added a Fedora 40 system, except that it denies login to all of the LDAP users. It can see the users (user and groups owning files are displayed correctly, and the "finger" command finds the users), however for some reason it always fails to authenticate passwords. The following is from /var/log/secure Sep 15 11:26:27 ext5 sshd[265914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.131.55 user=graham Sep 15 11:26:29 ext5 sshd[265914]: Failed password for graham from 192.168.131.55 port 60366 ssh2 The LDAP server is a Fedora 34 but there are many older systems (back to Fedora 19) still authenticating via LDAP. I remember many years ago (I think it was when I was converting from NIS) that I had to change the password format, so maybe I have something old in my setup (passwords appear to be stored as a 52 character encrypted string). I am looking for some pointers as to where to look for testing and troubleshooting this issue. Are there any tools to test sssd authentication? Or any other information that may help me? Thank you /etc/nsswitch contains (on both the working Fedora 34 and the not working Fedora 40 systems) passwd: sss files systemd shadow: files group: sss files systemd hosts: files myhostname dns services: sss files netgroup: sss files automount: sss files aliases: files ethers: files gshadow: files networks: files dns protocols: files publickey: files rpc: files /etc/sssd/sssd.conf contains (on both the working Fedora 34 and the not working Fedora 40 systems) - domain name changed. [sssd] config_file_version = 2 domains = LDAP services = nss, pam [nss] filter_groups = root filter_users = root [pam] [domain/LDAP] id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.mydomain.net ldap_chpass_uri = ldap://ldap.mydomain.net ldap_search_base = dc=mydomain,dc=net ldap_id_use_start_tls = True cache_credentials = True ldap_tls_cacertdir = /etc/openldap/certs ldap_tls_reqcert = allow -- This email has been checked for viruses by AVG antivirus software. www.avg.com

2 2

proper sssd timeout configuration to prevent NAT timeout
by Jaehwan Kim 03 Sep '24

03 Sep '24

Hello. We've got a number (thousands) of hosts inside a private network of cloud environment. These all query the FreeIPA server for user and group information using NAT and a gateway server. However we're having issues with the LDAP queries timing out or becoming unresponsive due to NAT timeout. In order to prevent hosts (clients) from being disconnected due to NAT timeout, we wish to try some sssd timeout values. Because we have difficulty to find out proper timeout of sssd.conf.5 manual pages (website), can you advice us on the proper timeout or propose other way? Thank you. JHK

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users September 2024