[SSSD] sssd vs winbind

Chris Hartman qrstuv at gmail.com
Mon Jan 27 17:50:46 UTC 2014


I don't have any documentation on my winbind setup, meaning that I've only
adjusted configs for SSSD (1.9.2) and Samba (configs for these included
below).

Before SSSD implemented ID mapping in a manner consistent with winbind, I
had to use Identity Management for Unix on the domain controller to
manually assign each user's UID (using an LDAP attribute) to the same value
as the UID that windbind would generate. Later, after SSSD implemented the
same ID mapping as Winbind, I removed IMU and let SSSD do its thing.

On this fileserver, PAM isn't even aware of winbind; all auth is handled by
SSSD. Winbind is only used by Samba when sharing files.

[root at tic windows_pc_backups]# cat /etc/samba/smb.conf

# This file automatically generated and maintained by Puppet.
> # Manual editing of this file is NOT recommended as your changes
> # will be overwritten.
> ### Begin minimal global configuration ###
> [global]
> # These settings will be overwritten by puppet.
> # Please make local changes to the include file
> log level = 5
> client ldap sasl wrapping = seal
> disable netbios = yes
> security = ads
> server signing = mandatory
> realm = DOMAIN.LOCAL
> workgroup = DOMAIN
> winbind separator = +
> winbind enum users = Yes
> winbind enum groups = Yes
> winbind nested groups = Yes
> winbind use default domain = yes
> kerberos method = system keytab
> load printers = yes
> printing = bsd
> include = /etc/samba/extra-settings.conf


extra-settings.conf just sets up some file shares:

> # Settings for backup servers
> printcap name = /dev/null
> disable spoolss = yes
> server string = Tic - Half Fresh
> idmap backend = tdb
> idmap uid = 1000000-1999999
> idmap gid = 1000000-1999999
> idmap config DOMAIN : backend  = ad
> idmap config DOMAIN : range = 10000-50000
> [backups]
> path = /mnt/storage2/windows_pc_backups
> read only = yes
> printable = no
> guest ok = no
> valid users = "@DOMAIN+Domain Users"
> create mask = 0775
> writeable = no


And my sssd.conf:

> # This file is autogenerated by Puppet.
> # # Manually editing this file is NOT recommended
> # # as your changes will be overwritten.
> #
> [sssd]
> config_file_version = 2
> debug_level = 0
> reconnection_retries = 3
> sbus_timeout = 30
> services = nss, pam
> domains = DOMAIN
>
> [pam]
> debug_level = 0
> [nss]
> debug_level = 0
> filter_users = ...
> filter_groups = ...
> reconnection_retries = 3
> default_shell = /bin/bash
> shell_fallback = /bin/bash
> [domain/DOMAIN]
> debug_level = 0
> ad_domain = DOMAIN.local
> id_provider = ad
> auth_provider = ad
> chpass_provider = ad
> access_provider = ad
> enumerate = true
> cache_credentials = true
> # Will check unixHomeDirectory LDAP attribute for a value first
> fallback_homedir = /home/%u
> # This is necessary for IPv4 and IPv6 dynamic DNS updates
> dyndns_iface = eth0
> ldap_user_home_directory = unixHomeDirectory
> dyndns_update = true
> dyndns_update_ptr = true
> ldap_schema = ad
> ldap_id_mapping = true


-Chris


On Mon, Jan 27, 2014 at 12:26 PM, Rowland Penny <repenny241155 at gmail.com>wrote:

> On 27/01/14 17:21, Chris Hartman wrote:
>
>> For what it's worth, I use winbind + sssd as a windows fileserver and
>> have no problems with the setup. It's true that winbind is necessary to
>> share files but certainly SSSD can co-exist with winbind.
>>
>>
>> -Chris
>>
>>
>>  Do you have to set winbind up? and if so how?
>
>
> Rowland
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140127/6d4d050b/attachment.html>


More information about the sssd-devel mailing list