[SSSD] Access denied by pam_sss(sshd:account)

Jakub Hrozek jhrozek at redhat.com
Fri Jun 28 13:59:43 UTC 2013


On Fri, Jun 28, 2013 at 09:49:12AM -0400, Dmitri Pal wrote:
> On 06/28/2013 03:53 AM, Jakub Hrozek wrote:
> > On Fri, Jun 28, 2013 at 01:12:37AM +0200, Mathieu Bouillaguet wrote:
> >> I have two more questions for my own knowledge and maybe those of others :
> >>
> >> * 1st question :
> >> If 2 users, a local user called "aminata" and a domain user
> >> "aminata at domain" exist, how does sssd choose who we are when we ssh in
> >> the system with a username of "aminata" and the re_expressions is set to:
> >>
> > First, what is a "local domain" ? Does that mean that the user resides
> > in /etc/passwd ?
> >
> > If so, then the order of databases that is queried depends on the
> > configuration in /etc/nsswitch.conf, in particular the lines starting
> > with "passwd" for users and "groups" for groups. You should use "files
> > sss" because you still want root and users that represent various system
> > services to be queried locally first.
> >
> >> "(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))"
> >>
> >> which allows three different styles for user names:
> >>
> >>     • username 
> >>     • username at domain.name <mailto:username at domain.name> 
> >>     • domain\username 
> >>
> > You can ssh in as:
> >
> > ssh system.example.com -l username at domain.name
> >
> > for instance
> >
> >> ?
> >>
> >> * 2nd question :
> >> If we have two AD domains A and B. A linux machine is in the domain B,
> >> and we want the users from domain A to be able to authenticate in the
> >> linux machine. Our sssd configuration is id_provider=ldap
> >> (ldaps://auth.domainA.com), auth_provider=krb5 (auth.domainA.com). A
> >> keytab was generated for the linux machine on domain B AD and installed
> >> on the machine. Is this architecture possible without using a trust
> >> relationship from domain A to domain B ? My first thought is that it's
> >> not possible since the linux system belonging to domain B needs to be
> >> able to browse the directory of domain A.
> >>
> > No, I don't think this is possible, you should kinit against the KDC
> > that generated the keytab.
> >
> >> Thanks in advance for your replies.
> >>
> >> Mathieu
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> Jakub,
> 
> If you define two domains can you have two different keytabs in SSSD?
> I do not think so. Do we have an RFE to support that?

Yes, you can set a keytab per-domain using krb5_keytab or
ldap_krb5_keytab option. So you can have:

[domain/Foo]
krb5_keytab = /etc/foo.keytab

[domain/Bar]
krb5_keytab = /etc/bar.keytab

> Also may be it can be hacked so that connection to one domain is armored
> with keytab and to another is armored by certs?

Sure

> Can we use just LDAP for the second domain instead of kerberos auth?
> 

Yes, but Kerberos is recommended.

> Also in 1.10 SSSD should support transitive trusts so if there is a
> trust between the domains SSSD 1.10 should be able to authenticate users
> from both domains.

You can use the TGT to access both trusted domains in a trust, but the
TGT must be obtained from the KDC you are enrolled with. At least
with AD, because there are no krb5-master SRV records by default on the
AD side, so the libkrb5 has no means of asking who to contact to if the
keytab is not local to the domain. One could work around by adding the
SRV records or adding the master_kdc option to krb5.conf, but the AD
provider only talks to the local KDC when acquiring a TGT by default.

I learned this the hard way when debugging the trusts in the AD provider
recently :)



More information about the sssd-devel mailing list