[SSSD-users] sssd-ad : AD Authenticated users cant run 'su -' or 'su - root'

Lukas Slebodnik lslebodn at redhat.com
Fri Jan 16 14:30:53 UTC 2015


On (16/01/15 07:23), Chris Price wrote:
>
>Jakub,
>
>I have two unprivileged accounts configured on this test AD domain I am
>using, 'test1' and 'test2'.
>
>test1's 'unix attributes' tab in AD is set to : uid 10000, gid is 10000
>test2's 'unix attributes' tab in AD is set to : uid 10001, gid is 10000
>
>tested scenarios:
>
>1) Login via ssh with test1 account and run 'su -' or 'su - root' and
>supplying the root password when prompted the commands fail with 'incorrect
>password'.
>2) Login via ssh with test2 account and run 'su -' or 'su - root' and
>supplying the root password when prompted the commands fail with 'incorrect
>password'.
root is not handled by sssd. Are you sure you are using right password?
If you are using right password then problem will probably not be in sssd.

>3)Login via ssh with test1 and run 'su - test2' and supply the test2 password
>when prompted the command fails with 'incorrect password'.
>4) Login via ssh with test2 and run 'su - test1' and supply the test1
>password when prompted the command fails with 'incorrect password'
>
Did you change file /etc/pam.d/su-l ? Could you attach that file?

Is there something interesting in syslog and sssd log files?

LS


More information about the sssd-users mailing list