It is my first question on the forum, so please, don't be mad if I miss important information about my issue.
I use Debian 8 and I joined an Active Directory domain (Windows server 2012) with SSSD according to this tutorial.
Everything works well , I can login with AD account. Moreover, I created an Active directory group to gathers users who will be allowed to connect to this server.
I allow this group with the command :
realm permit -g mygroup@mydomain.com
Until now, everything is o.k. and when I connect for the first time on my Linux server with an Active directory account, the /home/domain/user
is created.
However, when I want revoke permission to connect to the server for one user (so I remove the account from the group). Its folder /home/domain/user
still remains on the server and moreover the root account (or account with sudo permissions) can connect to the user witch doesn't have permissions anymore (with a warning message Access Denied (ignored)
).
Finally, the only way to not allow su <deleted user>
is to remove the AD account (but I can't remove AD account each time that I revoke permissions).
In my opinion, it is a terrible security issue. Is it possible to definitely remove the user (and its folder) on the Linux server when I revoke the AD account permissions?
Can you share me information about authentication between AD and SSSD ?
Please see below configuration files:
Content of /etc/nsswitch.conf
:
passwd: compat sss
group: compat sss
shadow: compat sss
gshadow: files
hosts: files dns
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
Content of /etc/sssd/sssd.conf
:
[sssd]
domains = mydomain.com
config_file_version = 2
services = nss, pam
[domain/mydomain.com]
ad_domain = mydomain.com
krb5_realm = MYREALM.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_groups = MyGroupAllowed
Before work with SSSD, I tried to use Winbind, but I had the same issue.
Thanks for your answer.
su <deleted user>
after this user is not enable to connect to the server (decided by Active directory).su
to a deleted/nonexisting account? Access to a local home directory and data within it? Access to a remotely mounted home directory? Access to some other external resource? What resource?su
, it can access to the local home directory or do command likewget
to download files for example.