[SSSD-users] sssd-ad : AD Authenticated users cant run 'su -' or 'su - root'

Lukas Slebodnik lslebodn at redhat.com
Thu Jan 15 21:26:26 UTC 2015


On (15/01/15 12:57), cprice at its.to wrote:
>
>PLatform is RHEL 6 Update 6.
>
>Relevent RPMS are :
>
>sssd-ad-1.11.6-30.el6.x86_64
>krb5-workstation-1.10.3-33.el6.x86_64
>
>Pam was setup using " authconfig --enablesssd --enablesssdauth
>--enablemkhomedir --update"
>
>I have test users successfully authenticating against a test domain server
>with both the test linux RHEL6U6 box and the Windows 2008R2 AD server on
>an isolated subnet.
>
>After I login to the RHEL6U6 box with an AD user via either ssh, or via
>the console I cannot run 'su - <username>' to any other user, either AD
>based or local password file based. All I get is a 'incorrect password'
>error message.
That's interesting. Are you able to login with ssh to the machine
with two+ users in parallel sessions.

Is there anything interesting in /var/log/secure?

I can see you have enabled debugging in domain section.
You can filter the most critical message with next grep command.

grep -E': grep -E "\(0x00[1-9]0\)" /var/log/sssd/sssd_CORPTEST.LOCAL.log

>My sssd.conf:
>
>[sssd]
>  config_file_version = 2
>  domains = CORPTEST.LOCAL
>  services = nss, pam
>  debug_level = 10
>  timeout = 300
>
>[domain/CORPTEST.LOCAL]
>
>  id_provider = ad
>  auth_provider = ad
>  access_provider = ad
>
>  debug_level = 10
>
>  ldap_id_mapping = False
>
>  default shell = /bin/bash
>  fallback_homedir = /home/%u
>
>  use_fully_qualified_names = False
>
>
>nsswitch.conf has these lines for passwd, shadow and group:
>
>passwd:     files sss
>shadow:     files sss
>group:      files sss
>
>/etc/pam.d/system-auth-ac (not hand edited at all)
>
>#%PAM-1.0
># This file is auto-generated.
># User changes will be destroyed the next time authconfig is run.
>auth        required      pam_env.so
>auth        sufficient    pam_fprintd.so
>auth        sufficient    pam_unix.so nullok try_first_pass
>auth        requisite     pam_succeed_if.so uid >= 500 quiet
>auth        sufficient    pam_sss.so use_first_pass
>auth        required      pam_deny.so
>
>account     required      pam_unix.so
>account     sufficient    pam_localuser.so
>account     sufficient    pam_succeed_if.so uid < 500 quiet
>account     [default=bad success=ok user_unknown=ignore] pam_sss.so
>account     required      pam_permit.so
>
>password    requisite     pam_cracklib.so try_first_pass retry=3 minlen=14
>dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1
>password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass
>use_authtok
>password    sufficient    pam_sss.so use_authtok
>password    required      pam_deny.so
>
>session     optional      pam_keyinit.so revoke
>session     required      pam_limits.so
>session     optional      pam_mkhomedir.so umask=0077
>session     [success=1 default=ignore] pam_succeed_if.so service in crond
>quiet use_uid
>session     required      pam_unix.so
>session     optional      pam_sss.so
>
nsswitch.conf and pam stack are configuread corectly. (due to authconfig)


>The sssd-ad package in rhel6 update 6 is fairly new and as such I've been
>able to find limited web resources about its config directives.
>
You can read Jakub's blog post.
"Enrolling an Active Directory RHEL-6 client machine using adcli"
http://jhrozek.livejournal.com/3581.html

LS


More information about the sssd-users mailing list