It is my first question on the forum, so please, don't be mad if I miss important information about my issue.
I use Debian 8 and I joined an Active Directory domain (Windows server 2012) with SSSD according to this tutorial.
Everything works well , I can login with AD account. Moreover, I created an Active directory group to gathers users who will be allowed to connect to this server.
I allow this group with the command :
realm permit -g email@example.com
Until now, everything is o.k. and when I connect for the first time on my Linux server with an Active directory account, the
/home/domain/user is created.
However, when I want revoke permission to connect to the server for one user (so I remove the account from the group). Its folder
/home/domain/user still remains on the server and moreover the root account (or account with sudo permissions) can connect to the user witch doesn't have permissions anymore (with a warning message
Access Denied (ignored)).
Finally, the only way to not allow
su <deleted user> is to remove the AD account (but I can't remove AD account each time that I revoke permissions).
In my opinion, it is a terrible security issue. Is it possible to definitely remove the user (and its folder) on the Linux server when I revoke the AD account permissions?
Can you share me information about authentication between AD and SSSD ?
Please see below configuration files:
passwd: compat sss group: compat sss shadow: compat sss gshadow: files hosts: files dns networks: files protocols: db files services: db files sss ethers: db files rpc: db files netgroup: nis sss sudoers: files sss
[sssd] domains = mydomain.com config_file_version = 2 services = nss, pam [domain/mydomain.com] ad_domain = mydomain.com krb5_realm = MYREALM.COM realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%d/%u access_provider = simple simple_allow_groups = MyGroupAllowed
Before work with SSSD, I tried to use Winbind, but I had the same issue.
Thanks for your answer.