[SSSD-users] sssd auth issue on centos 5.10
mimianddaniel at gmail.com
Fri Aug 22 23:58:21 UTC 2014
So here is the step i had to get PAM+PASS SSSD working on centos5.10
- Upgrade openldap to 2.4.39 (recent openldap lib other than 2.4.19
otherwise, sssd would segfault) , will need to install nss-tool
- Upgrade nss with nss-pem
For those who has tried and didnt have success with working cert with
openldap + openssl/openssh
On Fri, Aug 22, 2014 at 4:35 PM, Daniel Jung <mimianddaniel at gmail.com>
> Hi Lukas,
> By eliminating the link libs to SSSD, i rebuilt nss and noticed that there
> is no libnsspem.so from the src  which seems to be required for reading
> PEM cert.
> After rebuilding nss with nss_pem.git for cento5 and PAM passwd + auth
> works now.
> Sat Aug 23 01:15:02:652979 2014) [sssd[be[LDAP]]]
> [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to with fd
> (Sat Aug 23 01:15:02:652999 2014) [sssd[be[LDAP]]] [sdap_sys_connect_done]
> (0x0100): Executing START TLS
> (Sat Aug 23 01:15:02:653682 2014) [sssd[be[LDAP]]] [sdap_connect_done]
> (0x0080): START TLS result: Success(0), (null)
> Openldap user land tools and openssh were able to create TLS connections
> to the ldap server without this rebuilt of NSS with libnsspem, which seems
> to indicate that when sssd was built it didnt have approprate dependency to
> read the pem file properly for centos5 > 5.6. I havent heard from anyone on
> the list to say that PAM + AUTH + SSSD is working on centos 5.6 and up yet.
> I found this to be very unsettling. Could you please verify?
> On Fri, Aug 22, 2014 at 3:23 PM, Lukas Slebodnik <lslebodn at redhat.com>
>> On (22/08/14 15:17), Daniel Jung wrote:
>> >Have already tested on different LDAP servers but running same version,
>> >latest avail from openldap, 2.4.39 and still same failure with TLS.
>> There should not be problem with openldap-server-2.4.39.
>> Do you use the same valid certificate (even self-signed) on server and
>> Could you send me log files with debug_level = 10?
>> sssd-users mailing list
>> sssd-users at lists.fedorahosted.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the sssd-users