[SSSD] Trying to ssh with sssd/pam configuration

Sterling Sahaydak sterling.sahaydak at pi-coral.com
Tue Jul 29 17:50:55 UTC 2014


Jakub,

Forgot to include from slapd:

access to attrs=userPassword,shadowLastChange
         by dn="cn=Manager,dc=something,dc=net" write
         by anonymous auth
         by self write
         by * none


------ Original Message ------
From: "Sterling Sahaydak" <sterling.sahaydak at pi-coral.com>
To: "Development of the System Security Services Daemon" 
<sssd-devel at lists.fedorahosted.org>
Sent: 7/29/2014 10:48:06 AM
Subject: Re[2]: [SSSD] Trying to ssh with sssd/pam configuration

>When you configured sssd.conf with the access_provider, what exactly
>were you trying to achieve? What are the expectations on who should be
>able to log in to the machine?
>
>*Trying to achieve those users who have sudoers role be allowed to ssh.
>In SudoRole I have 'All' allowed for sudoCommand.
>
>By having the cn=allowedusers in ou=Groups, I can add users from 
>ou=Employees and assign the attribute: memberUid in allowedusers the 
>list of users sudo rights.
>
>FYI - ldapsearch works in retrieving everything correctly as needed.
>
>
>
>------ Original Message ------
>From: "Jakub Hrozek" <jhrozek at redhat.com>
>To: sssd-devel at lists.fedorahosted.org
>Sent: 7/29/2014 10:37:46 AM
>Subject: Re: [SSSD] Trying to ssh with sssd/pam configuration
>
>>On Tue, Jul 29, 2014 at 01:53:17PM +0000, Sterling Sahaydak wrote:
>>>   Hi Jakub,
>>>
>>>  I'm not sure if simple access is what I need.
>>>
>>>  I have setup in LDAP:
>>>
>>>  cn=allowedusers, ou=Groups
>>>  - using attribute: memberUid - and adding the users uid here.
>>
>>OK
>>
>>>
>>>  ou=Employees, ou=People
>>>  - in Employees have users with objectClass: inetOrgPerson, 
>>>posixAccount
>>
>>OK
>>
>>>
>>>  ou=sudoers
>>>  - here have objectClass: sudoRole and creating cn= <username from 
>>>Employees>
>>>  and sudoUser = <username>
>>
>>sudo has nothing to do with access control.
>>
>>>
>>>  and also have a LDAP Proxy to Active Directory:
>>>  (*Note: for now, I'm commenting this section out and not connecting, 
>>>but
>>>  need to consider this to activate later)
>>>  - using this setup in slapd.conf:
>>>      database ldap
>>>      suffix "ou=Users,ou=adgroup,dc=ad,dc=something,dc=net"
>>>      uri ldap://ad1.something.net/
>>>      rebind-as-user
>>>      idassert-bind bindmethod=simple
>>>  
>>>binddn="cn=bindingacctname,ou=users,ou=adgroup,dc=ad,dc=something,dc=net"
>>>                  credentials="<password>"
>>>                  mode=none
>>>      idassert-authzFrom "*"
>>>      chase-referrals yes
>>>      subordinate
>>>
>>>  So, not sure if simple binding would be correct thing to do???
>>
>>Again, not directly connected to access control.
>>
>>When you configured sssd.conf with the access_provider, what exactly
>>were you trying to achieve? What are the expectations on who should be
>>able to log in to the machine?
>>_______________________________________________
>>sssd-devel mailing list
>>sssd-devel at lists.fedorahosted.org
>>https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list