[SSSD] Kerberos login

Braden McDaniel braden at endoframe.com
Sun Apr 15 19:37:29 UTC 2012


On Sun, 2012-04-15 at 20:24 +0200, Jakub Hrozek wrote:
> On Fri, Apr 13, 2012 at 11:51:01PM -0400, Braden McDaniel wrote:
> > I have set up Kerberos and OpenLDAP on Fedora 16.  For the most part,
> > things seem to be working; I can use "kinit" to get a Kerberos ticket.
> > But I'm not getting a Kerberos ticket on login; which suggests to me
> > that Kerberos isn't really being used for login.
> > 
> > In "system-config-authentication", the authentication method is set to
> > "Kerberos password".  Where should I be looking to see what's missing?
> > 
> 
> How are you logging in? ssh, login, gdm?

Er, yes.  All three.  None gives me a Kerberos ticket.

> Can you attach /etc/pam.d/password-auth and/or /etc/pam.d/system-auth ?

        $ cat /etc/pam.d/password-auth
        #%PAM-1.0
        # This file is auto-generated.
        # User changes will be destroyed the next time authconfig is run.
        auth        required      pam_env.so
        auth        sufficient    pam_unix.so nullok try_first_pass
        auth        requisite     pam_succeed_if.so uid >= 1000 quiet
        auth        sufficient    pam_sss.so use_first_pass
        auth        required      pam_deny.so
        
        account     required      pam_unix.so broken_shadow
        account     sufficient    pam_localuser.so
        account     sufficient    pam_succeed_if.so uid < 1000 quiet
        account     [default=bad success=ok user_unknown=ignore] pam_sss.so
        account     required      pam_permit.so
        
        password    requisite     pam_cracklib.so try_first_pass retry=3 type=
        password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
        password    sufficient    pam_sss.so use_authtok
        password    required      pam_deny.so
        
        session     optional      pam_keyinit.so revoke
        session     required      pam_limits.so
        -session     optional      pam_systemd.so
        session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
        session     required      pam_unix.so
        session     optional      pam_sss.so
        
        
        $ cat /etc/pam.d/system-auth
        #%PAM-1.0
        # This file is auto-generated.
        # User changes will be destroyed the next time authconfig is run.
        auth        required      pam_env.so
        auth        sufficient    pam_fprintd.so
        auth        sufficient    pam_unix.so nullok try_first_pass
        auth        requisite     pam_succeed_if.so uid >= 1000 quiet
        auth        sufficient    pam_sss.so use_first_pass
        auth        required      pam_deny.so
        
        account     required      pam_unix.so broken_shadow
        account     sufficient    pam_localuser.so
        account     sufficient    pam_succeed_if.so uid < 1000 quiet
        account     [default=bad success=ok user_unknown=ignore] pam_sss.so
        account     required      pam_permit.so
        
        password    requisite     pam_cracklib.so try_first_pass retry=3 type=
        password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
        password    sufficient    pam_sss.so use_authtok
        password    required      pam_deny.so
        
        session     optional      pam_keyinit.so revoke
        session     required      pam_limits.so
        -session     optional      pam_systemd.so
        session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
        session     required      pam_unix.so
        session     optional      pam_sss.so
        
I've had more or less the same experience upon a fresh install of the
Fedora 17 prerelease on a different machine.  That machine has no local
user account (other than root); and I'm not able to log into it at all
(except as root).  The LDAP bit does appear to be working there, as gdm
was apparently able to get my user information.

Here's /etc/pam.d/{password,system}-auth from that machine:

        # cat /etc/pam.d/password-auth
        #%PAM-1.0
        # This file is auto-generated.
        # User changes will be destroyed the next time authconfig is run.
        auth        required      pam_env.so
        auth        sufficient    pam_unix.so nullok try_first_pass
        auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
        auth        sufficient    pam_sss.so use_first_pass
        auth        required      pam_deny.so
        
        account     required      pam_unix.so broken_shadow
        account     sufficient    pam_localuser.so
        account     sufficient    pam_succeed_if.so uid < 1000 quiet
        account     [default=bad success=ok user_unknown=ignore] pam_sss.so
        account     required      pam_permit.so
        
        password    requisite     pam_pwquality.so try_first_pass retry=3 type=
        password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
        password    sufficient    pam_sss.so use_authtok
        password    required      pam_deny.so
        
        session     optional      pam_keyinit.so revoke
        session     required      pam_limits.so
        -session     optional      pam_systemd.so
        session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
        session     required      pam_unix.so
        session     optional      pam_sss.so
        
        # cat /etc/pam.d/system-auth
        #%PAM-1.0
        # This file is auto-generated.
        # User changes will be destroyed the next time authconfig is run.
        auth        required      pam_env.so
        auth        sufficient    pam_fprintd.so
        auth        sufficient    pam_unix.so nullok try_first_pass
        auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
        auth        sufficient    pam_sss.so use_first_pass
        auth        required      pam_deny.so
        
        account     required      pam_unix.so broken_shadow
        account     sufficient    pam_localuser.so
        account     sufficient    pam_succeed_if.so uid < 1000 quiet
        account     [default=bad success=ok user_unknown=ignore] pam_sss.so
        account     required      pam_permit.so
        
        password    requisite     pam_pwquality.so try_first_pass retry=3 type=
        password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
        password    sufficient    pam_sss.so use_authtok
        password    required      pam_deny.so
        
        session     optional      pam_keyinit.so revoke
        session     required      pam_limits.so
        -session     optional      pam_systemd.so
        session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
        session     required      pam_unix.so
        session     optional      pam_sss.so

-- 
Braden McDaniel <braden at endoframe.com>




More information about the sssd-devel mailing list