Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sssd]

SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.

5
votes
1answer
193 views

Linux clients can't login on samba share while windows and mac can (active directory env)

Setup server Centos 7.6 Samba 4.8 Winbind SSSD Kerberos This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
1
vote
0answers
91 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
0
votes
0answers
49 views

Add all users in AD-Group to the local wheel group

We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group. The users that we want to permit to use the program 'su' are ...
1
vote
0answers
136 views

No user exists for uid 721001106 when running ssh command within SSH chroot directory

I am running debian 8 with SSSD authentication. The authentication works and ssh works fine. I have copied all libraries etc over to my SSH chrootdirectory and all my applications work except ssh ...
0
votes
0answers
73 views

sudoer: AD domain group in sudoer file won´t work

My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials. I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(...
0
votes
0answers
133 views

Samba: share is not accessible for AD groups

I have a CentOS server joined to an ID domain with realm(8) using sssd(8). I don´t have winbind installed, though. I can log fine with AD domain users into this CentOS server. I set up samba shares in ...
0
votes
0answers
75 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
0answers
603 views

sssd: AD user cannot login in RHEL 7

I can switch to the mentioned domain user with su command from the server, but ssh login is failing. The user domain group is already added in sssd.conf file under "simple_allow_groups" The errors in ...
1
vote
3answers
404 views

Allow AD group to access samba share

On my Linux I created a samba share like this, it was working fine. [global] security = user passdb backend = tdbsam map to guest = Bad User guest account = mcms [mml-t1] path = /...
0
votes
2answers
54 views

On Solaris I get good id mapping..on linux not,why?

I use an Active Directory server for authentication,Solaris works fine following this Howto. All works,and my user "user1" get the right UID assigned on Windows AD,which is 10000. On linux I follow ...
4
votes
1answer
214 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
1
vote
0answers
16 views

in ldap make the default bind the current logged in user

I do not want to specify a default bind_dn in the sssd.conf file for ldap (either openldap or active directory). Is it possible to configure the system in a way, that the first logged in user becomes ...
0
votes
0answers
256 views

mount a cifs share with kerberos on linux with a sssd/kcm kerberos client

As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
1
vote
0answers
954 views

Samba can't fetch domain SID after joining AD domain

This is my scenario: I have a CentOS 7.5 server which must act as a file server and allow AD-integrated authentication for Samba access, without the need to create local users with smbpasswd. Samba ...
4
votes
0answers
1k views

Centos 7 AD authentication DataProvider is Offline

I have configured my Linux machine to use AD authentication. Sometimes few nodes are unable to login. The /var/log/sssd/sssd_nss.log log file reports the message below: Thu Sep 13 13:31:39 2018) [...
2
votes
1answer
200 views

How to Specify Group Owner During Cron

I've done a fair amount of research but either I'm having trouble formulating the context to create relevant results or the information is hard to find. I have a production ubuntu 16.04 server ...
6
votes
2answers
713 views

Setting login shell in SSS configuration for users from Active Directory

I'm trying to define different login shells for different users of an AD domain, as described here. The aim is to deny members of a particular group from logging in while allowing them to do SSH ...
2
votes
1answer
1k views

sssd and Active Directory user does not exist in CentOS

When I try to do a su user1@ADREALM.COM I get a "user does not exist" message. user1@ADREALM.COM exists in Active Directory. I can do kinit user1@ADREALM.COM successfully and get a ticket. Here are ...
1
vote
0answers
340 views

pam_sss access denied with kerberos authentication ok [closed]

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
1
vote
0answers
39 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
0
votes
1answer
201 views

About PAM authentication using sssd

there. I succeed to join Linux environment to Windows Server domain, using realm join command. (Thanks Roaima) From this Stack ticket. Now the next step seems to authenticate to Active Directory. So,...
0
votes
0answers
168 views

On starting sssd

there. At first, it says the daemon couldn't find the /etc/sssd/sssd.conf. So, I created this and, when executing sssd "systemctl start sssd.service", it shows the following errors. Jun 25 21:00:48 ...
3
votes
1answer
218 views

sssd or ldap.conf doesn't work without a bindDN and password in RHEL 5, but works in RHEL 6 and 7. Why?

I am trying to use LDAP for authentication. I see it doesn't work with RHEL 5, if we don't provide a bind DN and password, but works in RHEL 6 and 7. From sssd logs, I can understand that it is ...
0
votes
1answer
587 views

Cannot login to Linux with AD account and /bin/bash

I have configured everything necessary to log in with an AD account into Linux (Kerberos v5, SSSD, Samba and NTP), but when I connect with Putty to the server, the default shell that starts is /bin/sh....
4
votes
1answer
3k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
0
votes
1answer
290 views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
3
votes
1answer
2k views

Mapping AD groups to Linux groups - sssd and Windows server 2016

I have a setup with RHEL 7.4 machines that connect to Active Directory (AD) running on a Windows Server 2016 Datacenter Edition. The Linux machines are in direct integration with the AD. Since ...
0
votes
2answers
436 views

Prevent vsFTP auth via AD

I have a very small vm installed, for testing purposes, running CentOS 1708, with vsftp configured. i used https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/ to setup ...
3
votes
1answer
2k views

getent passwd -s sss LOCALUSER shows local user

tl;dr I want to easily and quickly tell if a user is local or domain (don't care which domain). Environment freeipa-client-4.6.1-3.fc27.x86_64 sssd-1.16.0-4.fc27.x86_64 Full story I am writing a ...
3
votes
0answers
661 views

auto groups in CentOS 7 in Active Directory domain?

I am having an issue that might be mostly cosmetic but I've gotta keep the user complaints down. :) I have a set of servers running CentOS 7.4 and have the requirement to join the servers to an ...
2
votes
0answers
895 views

sssd not working over ldap_id_use_start_tls

Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf. In sssd.conf I have the following config: [domain] ldap_id_use_start_tls =...
0
votes
2answers
75 views

sssd caching question - login delays after deleting cache & purge cache values

Two questions: After I stop the sssd service and delete the cache is it normal for it to take a a minute or two before being able to login again? If I have this value set to 7 days in the /etc/sssd/...
0
votes
1answer
357 views

SSSD LDAP authentication using two different LDAP servers

I am trying to setup LDAP authentication using SSSD on CentOS 7. Is it possible to set up SSSD in a way that it uses two LDAP servers: one LDAP server is used just for login (basically just to ...
1
vote
1answer
779 views

SSSD delete users

It is my first question on the forum, so please, don't be mad if I miss important information about my issue. I use Debian 8 and I joined an Active Directory domain (Windows server 2012) with SSSD ...
0
votes
0answers
4k views

CentOS 7 SSSD AD with Samba Share

I followed this site's tutorial to install SSSD (without WinBind) to join a Windows Server 2008 domain. And it is a great success. Before that I was trying to use Zentyal to set up share folders but ...
0
votes
1answer
329 views

Linux getent automount?

I just got a user account on a server with its nsswitch pointing at ldap. Something is wrong with my home folder (I don't have one). Generally the home folders are mounted by automount/autofs and ...
0
votes
2answers
616 views

sssd caching user credentials even the cache_credentials is set to false

I have setup Redhat host to authenticate AD users for ssh sessions. Everything is working as expected, however, single concern, user credentials are being cached somewhere. Upon first time login ...
1
vote
1answer
147 views

Sudo long wait for Active Directory user

My Fedora 26 (was 25 when installed/joined to AD) has a long timeout when I run sudo for my Active Directory user if I leave it alone for to long. Timeout is long. 25 seconds. I used strace (sudo ...
1
vote
0answers
482 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
2
votes
2answers
3k views

LDAP Sudoers w/ AD & SSSD (returns only primary group)

I'm having issues getting LDAP sudoers rules to work. My environment is: Active Directory on Windows Server 2012 R2 Ubuntu 16.04.2 SSSD 1.13.4-1ubuntu1.5 sudo 1.8.20-3 (latest as of the posting, ...
0
votes
1answer
1k views

sssd / ad no ssh login after migration debian 8 => 9: Access denied for user xxx: 4 (System error)

After migration form debian jessie to stretch - login over ssh fails for Ad users, also su to AD user (sssd env) fails. Any hints? Log lines: Jun 20 12:48:57 myhost sshd[1736]: pam_sss(sshd:account):...
1
vote
1answer
160 views

SSSD Domain Configuration Snippets

Generally, it seems, the idea with conf.d-style directories is to allow a very modular, drop-in method to add features or configurations. With SSSD, specifically, it would seem logical to add further ...
1
vote
2answers
609 views

Using openldap authentication only for some users

I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements. I basically know how ...
1
vote
0answers
424 views

SSSD list allowed users only

We are using SSSD for authentication using LDAP. And I filter the user access using simple_allow_groups as follows: access_provider = simple simple_allow_groups = Computer Admins (Note: Computer ...
1
vote
0answers
1k views

Why is my IPA Client not recognizing AD Trusted users

I have installed an IPA Server, created a replica agreement and set up a one way trust to our AD Forest. The IPA servers have integrated DNS and are in their own dns zone. This works as expected, I am ...
1
vote
0answers
91 views

Cloning Machines joined to Domain using SSSD

We are using Amazon Web services and have a number of Debian boxes that are registered to our domain. I want to clone these boxes, change there hostname and rejoin them to the domain without impacting ...
2
votes
1answer
4k views

LDAP user does not exist when running 'su'

I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using authconfig-tui the FORCELEGACY ...
2
votes
1answer
387 views

How to understand this SSSD log?

(Wed Apr 19 14:16:47 2017) [sssd[be[xx.xx.COM]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: `RefErr`: DSID-03100781, data 0, 1 access points What does this mean?
2
votes
1answer
405 views

SSSD: Why does setting ldap_group_nesting_level to “0” improve the performance greatly?

What is the default value for this parameter if I don't mention it in the configuration file? In a hundred of people enterprise environment, multiple tools - CDH Hadoop, analytics tool, Tableau, ...
1
vote
0answers
92 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...