Questions tagged [sssd]
SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.
5
votes
1answer
201 views
Linux clients can't login on samba share while windows and mac can (active directory env)
Setup
server
Centos 7.6
Samba 4.8
Winbind
SSSD
Kerberos
This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
1
vote
0answers
101 views
Alternative to autofs to mount CIFS folders in user home folders in multi-user environment
My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine.
So ...
0
votes
0answers
51 views
Add all users in AD-Group to the local wheel group
We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group.
The users that we want to permit to use the program 'su' are ...
1
vote
0answers
149 views
No user exists for uid 721001106 when running ssh command within SSH chroot directory
I am running debian 8 with SSSD authentication. The authentication works and ssh works fine. I have copied all libraries etc over to my SSH chrootdirectory and all my applications work except ssh ...
0
votes
0answers
86 views
sudoer: AD domain group in sudoer file won´t work
My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials.
I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(...
0
votes
0answers
141 views
Samba: share is not accessible for AD groups
I have a CentOS server joined to an ID domain with realm(8) using sssd(8). I don´t have winbind installed, though. I can log fine with AD domain users into this CentOS server. I set up samba shares in ...
0
votes
0answers
84 views
Freeipa client on debian 9 - Cannot find user error
EDIT 1: added solution, pam was faulty
i'm trying to set up freeipa client on debian 9 client using this guide:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
0answers
644 views
sssd: AD user cannot login in RHEL 7
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in ...
1
vote
3answers
440 views
Allow AD group to access samba share
On my Linux I created a samba share like this, it was working fine.
[global]
security = user
passdb backend = tdbsam
map to guest = Bad User
guest account = mcms
[mml-t1]
path = /...
0
votes
2answers
57 views
On Solaris I get good id mapping..on linux not,why?
I use an Active Directory server for authentication,Solaris works fine following this Howto.
All works,and my user "user1" get the right UID assigned
on Windows AD,which is 10000.
On linux I follow ...
4
votes
1answer
218 views
SELinux Interfering With sss_cache
System:
HP Pavilion Power Laptop 15-cb0xx
Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios)
Fedora 28
NVIDIA GTX 1050 (mobile)
I used the dnfdragora GUI to update about ...
1
vote
0answers
16 views
in ldap make the default bind the current logged in user
I do not want to specify a default bind_dn in the sssd.conf file for ldap (either openldap or active directory). Is it possible to configure the system in a way, that the first logged in user becomes ...
0
votes
0answers
261 views
mount a cifs share with kerberos on linux with a sssd/kcm kerberos client
As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
1
vote
0answers
991 views
Samba can't fetch domain SID after joining AD domain
This is my scenario:
I have a CentOS 7.5 server which must act as a file server and allow AD-integrated authentication for Samba access, without the need to create local users with smbpasswd.
Samba ...
4
votes
0answers
1k views
Centos 7 AD authentication DataProvider is Offline
I have configured my Linux machine to use AD authentication. Sometimes few nodes are unable to login.
The /var/log/sssd/sssd_nss.log log file reports the message below:
Thu Sep 13 13:31:39 2018) [...
2
votes
1answer
206 views
How to Specify Group Owner During Cron
I've done a fair amount of research but either I'm having trouble formulating the context to create relevant results or the information is hard to find.
I have a production ubuntu 16.04 server ...
6
votes
2answers
729 views
Setting login shell in SSS configuration for users from Active Directory
I'm trying to define different login shells for different users of an AD domain, as described here. The aim is to deny members of a particular group from logging in while allowing them to do SSH ...
2
votes
1answer
1k views
sssd and Active Directory user does not exist in CentOS
When I try to do a su user1@ADREALM.COM I get a "user does not exist" message.
user1@ADREALM.COM exists in Active Directory. I can do kinit user1@ADREALM.COM successfully and get a ticket. Here are ...
1
vote
0answers
346 views
pam_sss access denied with kerberos authentication ok [closed]
I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
1
vote
0answers
40 views
About connecting to Active Directory from CentOS7
I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet..
My environment is Windows Server 2012 RC and CentOS7.
1. I ...
0
votes
1answer
202 views
About PAM authentication using sssd
there.
I succeed to join Linux environment to Windows Server domain, using realm join command. (Thanks Roaima) From this Stack ticket.
Now the next step seems to authenticate to Active Directory.
So,...
0
votes
0answers
176 views
On starting sssd
there.
At first, it says the daemon couldn't find the /etc/sssd/sssd.conf. So, I created this and, when executing sssd "systemctl start sssd.service", it shows the following errors.
Jun 25 21:00:48 ...
3
votes
1answer
220 views
sssd or ldap.conf doesn't work without a bindDN and password in RHEL 5, but works in RHEL 6 and 7. Why?
I am trying to use LDAP for authentication.
I see it doesn't work with RHEL 5, if we don't provide a bind DN and password, but works in RHEL 6 and 7.
From sssd logs, I can understand that it is ...
0
votes
1answer
603 views
Cannot login to Linux with AD account and /bin/bash
I have configured everything necessary to log in with an AD account into Linux (Kerberos v5, SSSD, Samba and NTP), but when I connect with Putty to the server, the default shell that starts is /bin/sh....
4
votes
1answer
3k views
How do I clear a user's cached Active Directory password on CentOS 7?
I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so:
Install packages:
yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
0
votes
1answer
294 views
How nsswitch call sssd for credential?
I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result :
kinit username works fine
msktutil -u --...
3
votes
1answer
2k views
Mapping AD groups to Linux groups - sssd and Windows server 2016
I have a setup with RHEL 7.4 machines that connect to Active Directory (AD) running on a Windows Server 2016 Datacenter Edition. The Linux machines are in direct integration with the AD.
Since ...
0
votes
2answers
443 views
Prevent vsFTP auth via AD
I have a very small vm installed, for testing purposes, running CentOS 1708, with vsftp configured.
i used
https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/
to setup ...
4
votes
1answer
2k views
getent passwd -s sss LOCALUSER shows local user
tl;dr
I want to easily and quickly tell if a user is local or domain (don't care which domain).
Environment
freeipa-client-4.6.1-3.fc27.x86_64
sssd-1.16.0-4.fc27.x86_64
Full story
I am writing a ...
3
votes
0answers
671 views
auto groups in CentOS 7 in Active Directory domain?
I am having an issue that might be mostly cosmetic but I've gotta keep the user complaints down. :)
I have a set of servers running CentOS 7.4 and have the requirement to join the servers to an ...
2
votes
0answers
910 views
sssd not working over ldap_id_use_start_tls
Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf.
In sssd.conf I have the following config:
[domain]
ldap_id_use_start_tls =...
0
votes
2answers
76 views
sssd caching question - login delays after deleting cache & purge cache values
Two questions:
After I stop the sssd service and delete the cache is it normal for it to take a a minute or two before being able to login again?
If I have this value set to 7 days in the /etc/sssd/...
0
votes
1answer
359 views
SSSD LDAP authentication using two different LDAP servers
I am trying to setup LDAP authentication using SSSD on CentOS 7.
Is it possible to set up SSSD in a way that it uses two LDAP servers: one LDAP server is used just for login (basically just to ...
1
vote
1answer
794 views
SSSD delete users
It is my first question on the forum, so please, don't be mad if I miss important information about my issue.
I use Debian 8 and I joined an Active Directory domain (Windows server 2012) with SSSD ...
0
votes
0answers
4k views
CentOS 7 SSSD AD with Samba Share
I followed this site's tutorial to install SSSD (without WinBind) to join a Windows Server 2008 domain. And it is a great success. Before that I was trying to use Zentyal to set up share folders but ...
0
votes
1answer
332 views
Linux getent automount?
I just got a user account on a server with its nsswitch pointing at ldap.
Something is wrong with my home folder (I don't have one).
Generally the home folders are mounted by automount/autofs and ...
0
votes
2answers
622 views
sssd caching user credentials even the cache_credentials is set to false
I have setup Redhat host to authenticate AD users for ssh sessions. Everything is working as expected, however, single concern, user credentials are being cached somewhere.
Upon first time login ...
1
vote
1answer
150 views
Sudo long wait for Active Directory user
My Fedora 26 (was 25 when installed/joined to AD) has a long timeout when I run sudo for my Active Directory user if I leave it alone for to long.
Timeout is long. 25 seconds.
I used strace (sudo ...
1
vote
0answers
485 views
Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group
I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
2
votes
2answers
3k views
LDAP Sudoers w/ AD & SSSD (returns only primary group)
I'm having issues getting LDAP sudoers rules to work. My environment is:
Active Directory on Windows Server 2012 R2
Ubuntu 16.04.2
SSSD 1.13.4-1ubuntu1.5
sudo 1.8.20-3 (latest as of the posting, ...
0
votes
1answer
1k views
sssd / ad no ssh login after migration debian 8 => 9: Access denied for user xxx: 4 (System error)
After migration form debian jessie to stretch - login over ssh fails for Ad users, also su to AD user (sssd env) fails. Any hints?
Log lines:
Jun 20 12:48:57 myhost sshd[1736]: pam_sss(sshd:account):...
1
vote
1answer
160 views
SSSD Domain Configuration Snippets
Generally, it seems, the idea with conf.d-style directories is to allow a very modular, drop-in method to add features or configurations. With SSSD, specifically, it would seem logical to add further ...
1
vote
2answers
614 views
Using openldap authentication only for some users
I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements.
I basically know how ...
1
vote
0answers
427 views
SSSD list allowed users only
We are using SSSD for authentication using LDAP. And I filter the user access using simple_allow_groups as follows:
access_provider = simple
simple_allow_groups = Computer Admins
(Note: Computer ...
1
vote
0answers
1k views
Why is my IPA Client not recognizing AD Trusted users
I have installed an IPA Server, created a replica agreement and set up a one way trust to our AD Forest. The IPA servers have integrated DNS and are in their own dns zone. This works as expected, I am ...
1
vote
0answers
92 views
Cloning Machines joined to Domain using SSSD
We are using Amazon Web services and have a number of Debian boxes that are registered to our domain. I want to clone these boxes, change there hostname and rejoin them to the domain without impacting ...
2
votes
1answer
4k views
LDAP user does not exist when running 'su'
I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using authconfig-tui the FORCELEGACY ...
2
votes
1answer
390 views
How to understand this SSSD log?
(Wed Apr 19 14:16:47 2017) [sssd[be[xx.xx.COM]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: `RefErr`: DSID-03100781, data 0, 1 access points
What does this mean?
2
votes
1answer
406 views
SSSD: Why does setting ldap_group_nesting_level to “0” improve the performance greatly?
What is the default value for this parameter if I don't mention it in the configuration file?
In a hundred of people enterprise environment, multiple tools - CDH Hadoop, analytics tool, Tableau, ...
1
vote
0answers
92 views
'Merging' Local Server and AD Accounts
I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts.
There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
