Lukas,
Thank you for your quick response.
You can use authconfig to configure pam-stack and nsswitch on
CentOS/Fedora
This is part of my /etc/pam.d/password-auth
----------------------------------------------------------------------
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
Won't this allow local accounts before network accounts? I only want to
revert to local accounts if my ldap server is down.
SSSD could not connect to the LDAP server.
We will need whole log file sssd_default.log.
I am working on getting you that log file. I am running into some more
issues, so I will get it to you as soon as I can.
Thanks again!
Kevin
On Tue, Mar 18, 2014 at 3:55 PM, Lukas Slebodnik <lslebodn(a)redhat.com>wrote:
On (18/03/14 15:35), kevin sullivan wrote:
>After trying for several days, I want to ask if this is even possible:
>
>I am running CentOS 6.4 and I have sssd-1.9.2-82 installed. I would like
to
I would recommend to update to CentOS 6.5
(lot of crashes and bugs were fixed in 6.5)
>log into my machine by querying an OpenLDAP server running else where. The
>big difference that I have from the normal sssd setup, is I only want to
>use the local Unix accounts (/etc/passwd and /etc/shadow) if my LDAP
server
>is offline.
>
>So how do I do this? Should I be able to do all of this through pam?
Either
>way, the issue I am seeing with sssd is the return value of pam when sssd
>can't connect to my ldap server. It always returns 'user_unknown'
instead
>of 'authinfo_unavail' as I would expect. Am I configuring something
>incorrectly?
>
>/etc/pam.d/password-auth:
>
>#%PAM-1.0
># This file is auto-generated.
># User changes will be destroyed the next time authconfig is run.
>auth required pam_env.so
>auth [success=done new_authtok_reqd=done authinfo_unavail=ignore
>default=die] pam_sss.so forward_pass
>auth sufficient pam_unix.so nullok try_first_pass
>auth requisite pam_succeed_if.so uid >= 500 quiet
>auth required pam_deny.so
>
You can use authconfig to configure pam-stack and nsswitch on CentOS/Fedora
This is part of my /etc/pam.d/password-auth
----------------------------------------------------------------------
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass nullok
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
----------------------------------------------------------------------
>/etc/sssd/sssd.conf:
>
>[domain/default]
>debug_level = 9
>
>ldap_search_base = dc=example,dc=com
>id_provider = ldap
>auth_provider = ldap
>access_provider = ldap
>ldap_access_filter = memberOf=cn=group,ou=Roles,dc=example,dc=com
>ldap_group_member = memberUid
>ldap_group_search_base = ou=Roles,dc=example,dc=com
>chpass_provider = ldap
>ldap_uri = ldap://test-server/
>
>[sssd]
>debug_level = 9
>services = pam
>config_file_version = 2
>
>domains = default
>
>[nss]
>debug_level = 9
>
>[pam]
>debug_level = 9
>
>[sudo]
>debug_level = 9
>
>[autofs]
>debug_level = 9
>
>[ssh]
>debug_level = 9
>
>[pac]
>debug_level = 9
>
>/var/log/sssd/sssd_default.log:
>
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [sbus_message_handler]
>(0x4000): Received SBUS method [getAccountInfo]
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [be_get_account_info]
>(0x0100): Got request for [3][1][name=user]
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed
>event "ltdb_callback": 0x196b8f0
>
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Added timed
>event "ltdb_timeout": 0x196c2b0
>
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Destroying
>timer event 0x196c2b0 "ltdb_timeout"
>
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [ldb] (0x4000): Ending
timer
>event 0x196b8f0 "ltdb_callback"
>
>(Tue Mar 18 19:09:52 2014) [sssd[be[default]]] [acctinfo_callback]
>(0x0100): Request processed. Returned 1,11,Offline
SSSD could not connect to the LDAP server.
We will need whole log file sssd_default.log.
LS
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users