[SSSD-users] problems sssd-1.9.2

Longina Przybyszewska longina at sdu.dk
Thu Nov 29 11:12:32 UTC 2012


On Wed 28 Nov 2012 04:53:54 AM EST, Longina Przybyszewska wrote:
> Thanks. I get it finally working!! : Ubuntu-Quantal sssd+ad_provider+NFSv4 - :-))  but still have some issues:
> 1.
> Ticket expires after 10 hours - I run msktutil (application for joining linux to AD and adding principals to the account and some more)
>   daily in crontab to prevent ticket expiration - maybe this is not necessary?
> Anyway, I ends  having to manually reset machine's account and create 
> a new keytab ( it is inefficient, but haven't figured out yet another way) How  does sssd  renew tickets if machine was offline more then 10 hours?
>

>>This is wrong. You don't want to be replacing the keytab. The keytab should not be expiring for weeks or months (or ever, if so configured). 
>>What *is* expiring is the ticket-granting ticket (TGT). Instead of using msktutil and replacing the keytab, you should be using 'kinit -k -t /path/to/keytab <host_principal>' to reacquire the TGT.

Can sssd do it for me ? Do I miss some options configured properly ?

In the log (krb5_child.log) I can see  messages :
...Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment
   Cannot read [SSSD_KRB5_LIFETIME] from environment
> 2.
>   To get rid off listing of  tens of group at login, I use the option:
>

>>What do you mean by "listing tens of group"?

root at jota:/home/alongina# id longina
uid=332405654(longina) gid=332400513 groups=332400513,1172668083,1172671850,1172626924,1172670697,1172632585,1172657894,1172647528,1172673996,1172630281,1172650784,1172649006,1172646018,1172626637,1172668082,1172647518,332406100(nat-esignatur),332403786(nat-terminal-users),1172647527,332405659(imada-terminal-users),1172647519,1172671034,1172652129,1172650787,1172608193,1172646019,1172649007,1172645844,1172630472,1172648739,1172645167,332402830(nat-lectures),1172649004,1172649400,1172671853,1172650786,332408307(dl-nat-it),332402685(common_users),1172645166,1172645845,988802256,1172651920,1172649005,1172659655,1172606592,1172647852,1172633504,1172667765,1172666809,1172645842,1172649046,1172667764,1172647523,1172626846,1172633505,1172645161,1172658369,1172645843,1172616454,1172607216,332411221(nat-pri-setcomputerdesc),1172659249,332410635(nat-it-outlook-admin),1172645163,1172644173,1172670698,988803287,1172645162,1172645841,1172659248,1172666810,1172659262,1172626838,1172647520,988807606,1172626843,332411220(nat-fnc-pri-setdiscription),1172612780,1172649045,1172645152,1172645147,1172626938,1172658370,1172658365,1172630586,1172649398,1172627322,332413664,1172607213,1172626943,1172649060,332408204(nat-it-ansatte),1172632583,1172658364,1172626827,332407177(dl-nat-it-staff),1172658371,1172653861,1172645344,332403699(terminal brugere),1172649061,1172645146,1172632578,1172671847,1172626940,1172626841,1172648741,1172649062,1172632579,1172658363,1172627278,1172645150,1172653860,332411184(nat-booking),332408312(nat-it-ad-hoc),1172632582,1172645145,1172671028,1172645144,1172627767,1172626935,1172632581,1172672165,1172645151,1172671032,332411734(data-nat-nat-it-groupdrive rw),1172657810,1172612322,1172650789,1172648253,1172657811,1172648254,1172649064,1172627766,1172645974,1172672164,1172671286,1172632580,1172648736,1172679679,1172622933,1172679716,1172645975,1172671030,1172620701,1172650191,1172648735

In sssd.conf I use :

ldap_schema = rfc2307bis 

 ldap_group_member = uniqueMember

The last one doesn't seem to have an effect.

Longina



More information about the sssd-users mailing list