[SSSD] SSSD Configuration issue
Jakub Hrozek
jhrozek at redhat.com
Wed Nov 16 13:55:48 UTC 2011
On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote:
> is that the output which is expected in the trace.
> Something missing in the trace which suggest any config problem???
>
> On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare <nitesh26 at gmail.com> wrote:
>
> This is the output of strace for the user which is in ldap server.
>
> bash-3.2# strace -e open su - nitback1
> open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3
> open("/lib64/libpam.so.0", O_RDONLY)A A A = 3
> open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
> open("/lib64/libcrypt.so.1", O_RDONLY)A = 3
> open("/lib64/libdl.so.2", O_RDONLY)A A A A = 3
> open("/lib64/libc.so.6", O_RDONLY)A A A A A = 3
> open("/lib64/libaudit.so.0", O_RDONLY)A = 3
> open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
> open("/etc/nsswitch.conf", O_RDONLY)A A A = 3
> open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3
> open("/lib64/libnss_files.so.2", O_RDONLY) = 3
> open("/etc/passwd", O_RDONLY)A A A A A A A A A A = 3
> open("/etc/ld.so.cache", O_RDONLY)A A A A A = 3
> open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
> open("/etc/pam.d/su-l", O_RDONLY)A A A A A A = 4
> open("/etc/pam.d/su", O_RDONLY)A A A A A A A A = 5
> open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
> open("/etc/ld.so.cache", O_RDONLY)A A A A A = 6
> open("/lib64/libselinux.so.1", O_RDONLY) = 6
> open("/lib64/libsepol.so.1", O_RDONLY)A = 6
> open("/etc/selinux/config", O_RDONLY)A A = 6
> open("/proc/mounts", O_RDONLY)A A A A A A A A A = 6
> open("/etc/pam.d/system-auth", O_RDONLY) = 6
> open("/lib64/security/pam_env.so", O_RDONLY) = 7
> open("/lib64/security/pam_unix.so", O_RDONLY) = 7
> open("/etc/ld.so.cache", O_RDONLY)A A A A A = 7
> open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
> open("/lib64/libnsl.so.1", O_RDONLY)A A A = 7
> open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
> open("/lib64/security/pam_sss.so", O_RDONLY) = 7
So it seems pam_sss is found ^^^^
I have one suggestion as per the system-auth PAM config, I think the
session is not correct, authconfig configures the PAM stack like this:
---
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_mkhomedir.so umask=0022 skel=/etc/skel/
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
---
Can you check two more things for me? Can you look if you get any AVC
denials provided SELinux is set to enforcing (or retry with setenforce 0
set for that test).
Also, can you send the whole strace output? IOW, run:
strace su - nitback1
ideally as non-root so you're prompted for password
More information about the sssd-devel
mailing list