[SSSD] Trying to ssh with sssd/pam configuration
Jakub Hrozek
jhrozek at redhat.com
Mon Jul 28 19:13:13 UTC 2014
On Mon, Jul 28, 2014 at 07:01:16PM +0000, Sterling Sahaydak wrote:
> Hi Jakub,
>
> Greatly appreciate you taking the time and providing help!
>
> Answer to your questions:
>
> 1) Can you also include debugging from the pam responder?
>
> Hmmm, yes - I want to, but having issues enabling the logging to:
> sssd_pam.log
I don't think we need that anymore, the reason is clear from
/var/log/secure..
>
> Seems like I have everything going to: sssd_LDAP.log
>
> Obviously, I'm a unix newbie. If you can provide how to enable that would
> be greatly appreciated. Wasn't clear with syslog enabling?
>
>
> 2)I would suggest to not use enumerate=true unless some legacy application
> needs that.
> I've updated this to: enumerate=false
Thanks!
>
>
> 3) Why do you have two domains defined with the same server but access
> control defined only in the first one.
>
> Hmmm, not sure here what 'defined only in the first one'? I'm sure it's a
> configuration setup issue on my part in not understanding.
>
Judging by the name 'default', I guess it was set up by authconfig,
default is the name authconfig uses for all its domains.
>
>
> 4)The PAM config looks OK to me, although you might want to re-run
> # authconfig --enablesssdauth --enablesssd --update
> to make sure.
> So... I entered "authconfig --enablesssdauth --enablesssd --update" on the
> cmd line but didn't see anything.
Normally this means the utility did its job :)
>
>
> 5) Did you include 'sss' to /etc/nsswitch.conf?
>
>
> #passwd: files sss
> #shadow: files sss
> #group: files sss
> passwd: files sss
> group: files sss
> sudoers: files sss
>
> #hosts: db files nisplus nis dns
> hosts: files dns
>
> # Example - obey only what nisplus tells us...
> #services: nisplus [NOTFOUND=return] files
> #networks: nisplus [NOTFOUND=return] files
> #protocols: nisplus [NOTFOUND=return] files
> #rpc: nisplus [NOTFOUND=return] files
> #ethers: nisplus [NOTFOUND=return] files
> #netmasks: nisplus [NOTFOUND=return] files
>
> bootparams: nisplus [NOTFOUND=return] files
>
> ethers: files
> netmasks: files
> networks: files
> protocols: files
> rpc: files
> services: files sss
>
> netgroup: files sss
>
> publickey: nisplus
>
> automount: files
> aliases: files nisplus
> initgroups: files sss
> shadow: files sss
>
>
> What does /var/log/secure say when you attempt to authenticate?
>
> Jul 28 14:54:10 ldap01 sshd[26892]: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.215.207.210
> user=test1234
> Jul 28 14:54:10 ldap01 sshd[26892]: pam_sss(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.215.207.210
> user=test1234
> Jul 28 14:54:10 ldap01 sshd[26892]: pam_sss(sshd:auth): received for user
> test1234: 6 (Permission denied)
^^^
OK, here we see the user was authenticated by SSSD, but not allowed
access by the access_provider of sssd.
In your config file I see:
ldap_access_filter = cn=allowedusers,ou=Groups,dc=something,dc=net
That doesn't sound right to me, the ldap_access_filter is supposed to be
a filter applied when looking for the user.
If you want to restrict access to members of a group called
allowedusers, then I would suggest the simple access provider instead:
access_provider = simple
simple_allow_groups = allowedusers
See man sssd-simple for some examples and more info.
More information about the sssd-devel
mailing list