[SSSD] sssd can't get shadow information from ldap

Aziz Sasmaz aziz.sasmaz at gmail.com
Fri Nov 18 11:55:13 UTC 2011


Hi,

sssd can't get shadow info from ldap.  When I type getent passwd it shows
pass section as  *  not as "x"
As passwd (5) ;  If the encrypted password is set to an asterisk, the user
will be unable to login using login.

Can sssd get shadow information from ldap. Is it possible to cache
authentication when we use ldap/shadow ?


nlastname1:*:1094:1004:Name Lastname:/home/user1:/bin/bash
nlastname2:*:1025:501:otemli:/home/user2:/bin/sh
nlastname3:*:1040:1009:Name Lastname:/home/user3:/bin/bash
splunk:*:1116:1025:Splunk Server:/opt/splunkforwarder:/bin/bash

my sssd.conf file:

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = ldap.jazzythemartian.com

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]

[domain/ldap.jazzythemartian.com]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldaps://ldaptest.jazzythemartian.com
ldap_search_base = dc=jazzythemartian,dc=com
ldap_tls_reqcert = allow
cache_credentials = true
enumerate = true
entry_cache_timeout = 5400
ldap_pwd_policy = shadow
ldap_user_gecos = uid


My system-auth file:
auth        required      pam_env.so
auth        sufficient    pam_sss.so use_first_pass
auth        sufficient   pam_ldap.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account     sufficient     pam_ldap.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

#password    requisite     pam_cracklib.so try_first_pass retry=3
password        required        pam_passwdqc.so enforce=users
min=disabled,16,12,8,6
password    sufficient    pam_sss.so use_authtok
password    sufficient    pam_ldap.so use_authtok
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    required      pam_deny.so

session     optional    pam_mkhomedir.so skel=/etc/skel/ umask=0022
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
session     sufficient    pam_sss.so
session     required      pam_unix.so
session     sufficient    pam_ldap.so


Thanks,

AS
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111118/f5a04952/attachment.html>


More information about the sssd-devel mailing list