[SSSD] SSSD Configuration issue

Jakub Hrozek jhrozek at redhat.com
Wed Nov 16 13:55:48 UTC 2011


On Tue, Nov 15, 2011 at 05:24:08PM +0530, Nitesh Mehare wrote:
>    is that the output which is expected in the trace.
>    Something missing in the trace which suggest any config problem???
> 
>    On Tue, Nov 15, 2011 at 5:22 PM, Nitesh Mehare <nitesh26 at gmail.com> wrote:
> 
>      This is the output of strace for the user which is in ldap server.
> 
>      bash-3.2# strace -e open su - nitback1
>      open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
>      open("/lib64/libpam.so.0", O_RDONLY)A A A  = 3
>      open("/lib64/libpam_misc.so.0", O_RDONLY) = 3
>      open("/lib64/libcrypt.so.1", O_RDONLY)A  = 3
>      open("/lib64/libdl.so.2", O_RDONLY)A A A A  = 3
>      open("/lib64/libc.so.6", O_RDONLY)A A A A A  = 3
>      open("/lib64/libaudit.so.0", O_RDONLY)A  = 3
>      open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
>      open("/etc/nsswitch.conf", O_RDONLY)A A A  = 3
>      open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
>      open("/lib64/libnss_files.so.2", O_RDONLY) = 3
>      open("/etc/passwd", O_RDONLY)A A A A A A A A A A  = 3
>      open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 3
>      open("/lib64/libnss_sss.so.2", O_RDONLY) = 3
>      open("/etc/pam.d/su-l", O_RDONLY)A A A A A A  = 4
>      open("/etc/pam.d/su", O_RDONLY)A A A A A A A A  = 5
>      open("/lib64/security/pam_rootok.so", O_RDONLY) = 6
>      open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 6
>      open("/lib64/libselinux.so.1", O_RDONLY) = 6
>      open("/lib64/libsepol.so.1", O_RDONLY)A  = 6
>      open("/etc/selinux/config", O_RDONLY)A A  = 6
>      open("/proc/mounts", O_RDONLY)A A A A A A A A A  = 6
>      open("/etc/pam.d/system-auth", O_RDONLY) = 6
>      open("/lib64/security/pam_env.so", O_RDONLY) = 7
>      open("/lib64/security/pam_unix.so", O_RDONLY) = 7
>      open("/etc/ld.so.cache", O_RDONLY)A A A A A  = 7
>      open("/usr/lib64/libcrack.so.2", O_RDONLY) = 7
>      open("/lib64/libnsl.so.1", O_RDONLY)A A A  = 7
>      open("/lib64/security/pam_succeed_if.so", O_RDONLY) = 7
>      open("/lib64/security/pam_sss.so", O_RDONLY) = 7

So it seems pam_sss is found ^^^^

I have one suggestion as per the system-auth PAM config, I think the
session is not correct, authconfig configures the PAM stack like this:
---
session  optional   pam_keyinit.so revoke
session  required   pam_limits.so
session  optional   pam_mkhomedir.so umask=0022 skel=/etc/skel/
session  [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session  required   pam_unix.so
session  optional   pam_sss.so
---

Can you check two more things for me? Can you look if you get any AVC
denials provided SELinux is set to enforcing (or retry with setenforce 0
set for that test).

Also, can you send the whole strace output? IOW, run:
strace su - nitback1
ideally as non-root so you're prompted for password



More information about the sssd-devel mailing list