[SSSD-users] SSSD + AD: adcli, kerberos

Dmitri Pal dpal at redhat.com
Wed Aug 26 22:25:05 UTC 2015


On 08/26/2015 01:13 PM, l at avc.su wrote:
> Dmitri Pal wrote 2015-08-26 19:39:
>> On 08/26/2015 10:00 AM, l at avc.su wrote:
>>> Hi all.
>>> I've enrolled linux machine into domain using this tutorial:
>>> http://jhrozek.livejournal.com/3581.html
>>>
>>> Now I can connect to linux machine with kerberos ticket from linux
>>> machine, or Windows machine. But I can't login using password anymore.
>>> Although I can obtain user info, can request TGT, and operate on this
>>> server normally, I can't login to it with pwd.
>>> I've ran 'authconfig --enablesssd --enablesssdauth --enablemkhomedir
>>> --update', so all auth should be done in SSSD. I haven't configured
>>> winbind with sssd.
>>> I've managed to workaround it by adding to /etc/pam.d/system-auth this
>>> line:
>>> auth        sufficient     pam_krb5.so
>>>
>>> But this seems like wrong way to do it. Very wrong and dirty way. Or
>>> maybe I'm wrong?
>>> I want to use SSSD as a service for id and auth, with AD as backend.
>>>
>>>
>>> Here's what debug4 says:
>>> [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for
>>> ...
>>> [704417315] gid [704400513] validate [true] enterprise principal
>>> [true] offline [false] UPN [ssh-username at DOMAIN.LOCAL]
>>> [[sssd[krb5_child[7974]]]] [unpack_buffer] (0x0100): ccname:
>>> [FILE:/tmp/krb5cc_704417315_XXXXXX] old_ccname:
>>> [FILE:/tmp/krb5cc_704417315_9XJZwx] keytab: [/etc/krb5.keytab]
>>> [[sssd[krb5_child[7974]]]] [check_use_fast] (0x0100): Not using FAST.
>>> [[sssd[krb5_child[7974]]]] [privileged_krb5_setup] (0x0080): Cannot
>>> open the PAC responder socket
>>
>> This seems to be a problem.
>> Because it leads to access denied this is why you can't login.
>> PAC responder process is either not running or SELinux blocks the socket
>> or something along those lines. Monitor logs should show is it exists.
>> Cores will be there if it crashes.
>> What distro is it? What version? Do you see any AVCs is you are using
>> SELinux?
>>
>>> _______________________________________________
>>> sssd-users mailing list
>>> sssd-users at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>
> Hi Dmitri.
> Thank you for the reply.
> I'm using CentOS 6.7 with SSSD v. 1.12.4
> SELinux is disabled on this machine, since this is testing environment.
>
> As I can see in man sssd.conf, PAC is a service, but I haven't enabled
> it in sssd.conf:
> [sssd]
> services    = nss,pam,ssh
>
> Should I set it, or PAC runs anyway?

I think it should be running anyways but this stretches the limits of my
knowledge.
Looking at the man pages it seems like it needs to be added explicitly.
Please try adding it.
I think the [pac] section needs to be added too later in the file even
if it is empty.


>
>
> Thanks.


-- 
Thank you,
Dmitri Pal

Engineering Director, Identity Management and Platform Security
Red Hat, Inc.



More information about the sssd-users mailing list