[SSSD] SSSD GSSAPI Question

Sumit Bose sbose at redhat.com
Fri Feb 1 10:55:42 UTC 2013


On Thu, Jan 31, 2013 at 03:10:16PM -0500, Derek Page wrote:
> Hi Devs,
> 
> I am using SSSD with kerberos with gssapi auth and it works really
> well for our environment using AD for authentication.
> 
> I am not sure if this is an SSSD issue but I though I would ask since
> I can't find a solution anywhere.
> SSH'ing from system to system works great using GSSAPI passing along
> your kerberos ticket. But seems to only work with its FQDN or
> shortname.
> 
> The issue I have is we run Virtual IP's with different A records that
> point to services for our systems. When I ssh to one of these A
> records Kerberos/sssd seems to reject and GSSAPI authenticaion that is
> not directed due to reverse dns mismatch.

I guess this might be a limitation of sshd. iirc it will not use all
tickets from the keytab but only the one that matches
host/fully.qualified.host.name where the fully.qualified.host.name is
determined with uname() or gethostname(). This means by default a system
is only accessible with one fully qualified name with ssh and GSSAPI.

HTH

bye,
Sumit

> 
> I have disabled reverse rdns in kerberos.
> 
> I think this could also be the issue.
> ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM
> 
> Is there a way to tell sssd to accept anything?
> Let me know if this is not an SSSD issue and I will leave you guys
> along. However we really need this to work otherwise I have to go back
> to using SSH keys, which I really don't want to. I really like the
> security of krb tickets.
> 
> rpm -qa | egrep 'sssd|krb'
> sssd-client-1.8.0-32.el6.x86_64
> sssd-1.8.0-32.el6.x86_64
> krb5-devel-1.9-33.el6_3.3.x86_64
> pam_krb5-2.3.11-9.el6.x86_64
> krb5-libs-1.9-33.el6_3.3.x86_64
> krb5-workstation-1.9-33.el6_3.3.x86_64
> 
> 
> My sssd.conf
> 
> [domain/default]
> 
> cache_credentials = fasle
> [sssd]
> config_file_version = 2
> domains = my.domain.com
> reconnection_retries = 3
> sbus_timeout = 30
> services = nss, pam
> 
> [nss]
> filter_groups = root, appl, mysql
> filter_users = root, mirror, appl, mysql, bamboo, puppet
> reconnection_retries = 3
> 
> [pam]
> reconnection_retries = 3
> 
> [domain/my.domain.com]
> cache_credentials = true
> enumerate = true
> min_id = 80
> max_id = 30000
> id_provider = ldap
> auth_provider = krb5
> 
> ldap_uri = ldap://ad3.my.domain.com/,ldap://ad4.my.domain.com/,ldap://ad8.my.domain.com/,ldap://ad9.my.domain.com/
> 
> ldap_schema = rfc2307bis
> ldap_user_search_base = <REMOVED FOR SECURITY>
> ldap_user_object_class = person
> ldap_user_modify_timestamp = whenChanged
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_search_base = OU=Security Groups,DC=skydive,DC=runwaynine,DC=com
> ldap_group_object_class = group
> ldap_group_modify_timestamp = whenChanged
> ldap_group_nesting_level = 5
> ldap_account_expire_policy = ad
> ldap_sasl_authid = M4DEPLOY01$@MY.DOMAIN.COM
> ldap_krb5_init_creds = true
> ldap_pwd_policy = mit_kerberos
> chpass_provider = krb5
> ldap_sasl_mech = GSSAPI
> krb5_realm = MY.DOMAIN.COM
> krb5_validate = true
> ldap_user_name = sAMAccountName
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_home_directory = unixHomeDirectory
> ldap_user_shell = loginShell
> ldap_user_principal = userPrincipalName
> ldap_group_object_class = group
> ldap_group_name = sAMAccountName
> ldap_group_gid_number = gidNumber
> ldap_force_upper_case_realm = true
> ldap_referrals = false
> 
> # User Group and Account Access
> access_provider = simple
> simple_allow_groups = m4_login
> 
> 
> my krb.conf
> [logging]
>  default = FILE:/var/log/krb5libs.log
>  kdc = FILE:/var/log/krb5kdc.log
>  admin_server = FILE:/var/log/kadmind.log
> 
> [libdefaults]
>  default_realm = MY.DOMAIN.COM
>  dns_lookup_realm = false
>  dns_lookup_kdc = false
>  ticket_lifetime = 24h
>  renew_lifetime = 7d
>  forwardable = true
>  default_tgs_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
>  default_tkt_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
>  permitted_enctypes = rc4-hmac aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> 
>  rdns = false
> 
> 
> [realms]
> MY.DOMAIN.COM = {
> 
>   kdc = ad3.my.domain.com:88
>   kdc = ad4.my.domain.com:88
>   admin_server = ad3.my.domain.com
>   default_domain = my.domain.com
>  }
> 
> [domain_realm]
>  .my.domain.com = MY.DOMAIN.COM
>  my.domain.com = MY.DOMAIN.COM
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list