Questions tagged [sssd]
SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.
105
questions
0
votes
0answers
79 views
SSSD new groups not added to user, “tsig verify failure … update failed: REFUSED”?
After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
0
votes
1answer
16 views
SSSD running but UID/GIDs wrong?
I have sssd installed on a server to use Active Directory accounts and can connect, but am seeing that the UIDs for AD users are very wrong (eg. an AD users posix UID is set to 1234, but I see ...
0
votes
0answers
40 views
How list users / groups having access to a Linux server that is connected to AD using sssd
Is there a command to get the list of AD Users (or) AD groups, that can access a Linux server, from the command prompt on the server itself without logging into the windows server? Below is how our ...
0
votes
0answers
11 views
Put users into system group by LDAP group membership
Currently users can authenticate via SSSD using their LDAP user account. But there is no way of specifying special group memberships.
Now I have a LDAP group like this:
The user objects itself does ...
1
vote
0answers
33 views
Why some Active Directory domain users can't connect to the server?
I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server.
When I try to login with users which were created ...
0
votes
0answers
16 views
SSSD configured for optimal security Kerberos only no need for LDAPS?
SSSD configured for optimal security Kerberos only no need for LDAPS?
I want to ensure I have configured our SSSD for optimal security. Any insight would be appreciated.
Should I add any values?
...
2
votes
1answer
108 views
sssd not rotating its AD computer account password
I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening ...
0
votes
0answers
108 views
SSH Key Auth failed … sometimes with SSSD
I have an issue with one of my server
I use keys to authenticate on my server with AD account, it works most of the time.
SSSD module is used to authenticate AD user.
Sometimes i can't authenticate ...
2
votes
1answer
38 views
sudo-ldap works with !authenticate only
I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works.
However, sudo-ldap works only if !authenticate is set:
dn: cn=...
1
vote
1answer
285 views
Domain Joined Linux - PAM mkhomedir creating homedirs owned as root for SSH
Currently, I have a fleet of linux computers joined to an active directory domain with SSSD for user management - primarily ubuntu, with some Raspian as well.
I'm using pam_mkhomedir.so to create ...
0
votes
1answer
237 views
How can I confirm another user's sudo permissions using my sudo permissions?
I currently manage an IDM (FreeIPA) cluster and have full sudo rights, i.e. I can become root via sudo -Es. I'd like to verify a sudo rule that I've added to FreeIPA on a specific server to confirm ...
1
vote
1answer
119 views
Authentication via LDAP: where is ldap_search_ext defined?
There are two RHEL 8 servers which have been provisioned from the same template, with some manual fix and tweaking done manually on the first server only. They allow SSH user authentication via a ...
0
votes
1answer
145 views
Change authentication order GNU/Linux
I've got a CentOS7 server joined to a Windows Active Directory Server. I'm trying to connect to CentOS using my Active Directory credentials but it seems that it checks the local account as first step ...
5
votes
1answer
1k views
Linux clients can't login on samba share while windows and mac can (active directory env)
Setup
server
Centos 7.6
Samba 4.8
Winbind
SSSD
Kerberos
This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
1
vote
0answers
639 views
Alternative to autofs to mount CIFS folders in user home folders in multi-user environment
My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine.
So ...
0
votes
0answers
153 views
Add all users in AD-Group to the local wheel group
We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group.
The users that we want to permit to use the program 'su' are ...
3
votes
0answers
574 views
No user exists for uid 721001106 when running ssh command within SSH chroot directory
I am running debian 8 with SSSD authentication. The authentication works and ssh works fine. I have copied all libraries etc over to my SSH chrootdirectory and all my applications work except ssh ...
0
votes
0answers
338 views
sudoer: AD domain group in sudoer file won´t work
My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials.
I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(...
0
votes
0answers
634 views
Samba: share is not accessible for AD groups
I have a CentOS server joined to an ID domain with realm(8) using sssd(8). I don´t have winbind installed, though. I can log fine with AD domain users into this CentOS server. I set up samba shares in ...
0
votes
0answers
240 views
Freeipa client on debian 9 - Cannot find user error
EDIT 1: added solution, pam was faulty
i'm trying to set up freeipa client on debian 9 client using this guide:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
1
vote
1answer
3k views
sssd: AD user cannot login in RHEL 7
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in ...
1
vote
3answers
2k views
Allow AD group to access samba share
On my Linux I created a samba share like this, it was working fine.
[global]
security = user
passdb backend = tdbsam
map to guest = Bad User
guest account = mcms
[mml-t1]
path = /...
0
votes
2answers
116 views
On Solaris I get good id mapping..on linux not,why?
I use an Active Directory server for authentication,Solaris works fine following this Howto.
All works,and my user "user1" get the right UID assigned
on Windows AD,which is 10000.
On linux I follow ...
4
votes
1answer
338 views
SELinux Interfering With sss_cache
System:
HP Pavilion Power Laptop 15-cb0xx
Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios)
Fedora 28
NVIDIA GTX 1050 (mobile)
I used the dnfdragora GUI to update about ...
1
vote
0answers
40 views
in ldap make the default bind the current logged in user
I do not want to specify a default bind_dn in the sssd.conf file for ldap (either openldap or active directory). Is it possible to configure the system in a way, that the first logged in user becomes ...
1
vote
0answers
2k views
Samba can't fetch domain SID after joining AD domain
This is my scenario:
I have a CentOS 7.5 server which must act as a file server and allow AD-integrated authentication for Samba access, without the need to create local users with smbpasswd.
Samba ...
4
votes
0answers
3k views
Centos 7 AD authentication DataProvider is Offline
I have configured my Linux machine to use AD authentication. Sometimes few nodes are unable to login.
The /var/log/sssd/sssd_nss.log log file reports the message below:
Thu Sep 13 13:31:39 2018) [...
3
votes
1answer
412 views
How to Specify Group Owner During Cron
I've done a fair amount of research but either I'm having trouble formulating the context to create relevant results or the information is hard to find.
I have a production ubuntu 16.04 server ...
5
votes
2answers
2k views
Setting login shell in SSS configuration for users from Active Directory
I'm trying to define different login shells for different users of an AD domain, as described here. The aim is to deny members of a particular group from logging in while allowing them to do SSH ...
3
votes
1answer
3k views
sssd and Active Directory user does not exist in CentOS
When I try to do a su user1@ADREALM.COM I get a "user does not exist" message.
user1@ADREALM.COM exists in Active Directory. I can do kinit user1@ADREALM.COM successfully and get a ticket. Here are ...
1
vote
0answers
67 views
About connecting to Active Directory from CentOS7
I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet..
My environment is Windows Server 2012 RC and CentOS7.
1. I ...
0
votes
1answer
276 views
About PAM authentication using sssd
there.
I succeed to join Linux environment to Windows Server domain, using realm join command. (Thanks Roaima) From this Stack ticket.
Now the next step seems to authenticate to Active Directory.
So,...
0
votes
1answer
393 views
On starting sssd
there.
At first, it says the daemon couldn't find the /etc/sssd/sssd.conf. So, I created this and, when executing sssd "systemctl start sssd.service", it shows the following errors.
Jun 25 21:00:48 ...
3
votes
1answer
319 views
sssd or ldap.conf doesn't work without a bindDN and password in RHEL 5, but works in RHEL 6 and 7. Why?
I am trying to use LDAP for authentication.
I see it doesn't work with RHEL 5, if we don't provide a bind DN and password, but works in RHEL 6 and 7.
From sssd logs, I can understand that it is ...
0
votes
1answer
1k views
Cannot login to Linux with AD account and /bin/bash
I have configured everything necessary to log in with an AD account into Linux (Kerberos v5, SSSD, Samba and NTP), but when I connect with Putty to the server, the default shell that starts is /bin/sh....
4
votes
1answer
6k views
How do I clear a user's cached Active Directory password on CentOS 7?
I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so:
Install packages:
yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
0
votes
1answer
662 views
How nsswitch call sssd for credential?
I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result :
kinit username works fine
msktutil -u --...
3
votes
1answer
3k views
Mapping AD groups to Linux groups - sssd and Windows server 2016
I have a setup with RHEL 7.4 machines that connect to Active Directory (AD) running on a Windows Server 2016 Datacenter Edition. The Linux machines are in direct integration with the AD.
Since ...
0
votes
2answers
705 views
Prevent vsFTP auth via AD
I have a very small vm installed, for testing purposes, running CentOS 1708, with vsftp configured.
i used
https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/
to setup ...
5
votes
1answer
4k views
getent passwd -s sss LOCALUSER shows local user
tl;dr
I want to easily and quickly tell if a user is local or domain (don't care which domain).
Environment
freeipa-client-4.6.1-3.fc27.x86_64
sssd-1.16.0-4.fc27.x86_64
Full story
I am writing a ...
3
votes
0answers
895 views
auto groups in CentOS 7 in Active Directory domain?
I am having an issue that might be mostly cosmetic but I've gotta keep the user complaints down. :)
I have a set of servers running CentOS 7.4 and have the requirement to join the servers to an ...
2
votes
1answer
1k views
sssd not working over ldap_id_use_start_tls
Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf.
In sssd.conf I have the following config:
[domain]
ldap_id_use_start_tls =...
0
votes
2answers
93 views
sssd caching question - login delays after deleting cache & purge cache values
Two questions:
After I stop the sssd service and delete the cache is it normal for it to take a a minute or two before being able to login again?
If I have this value set to 7 days in the /etc/sssd/...
0
votes
1answer
498 views
SSSD LDAP authentication using two different LDAP servers
I am trying to setup LDAP authentication using SSSD on CentOS 7.
Is it possible to set up SSSD in a way that it uses two LDAP servers: one LDAP server is used just for login (basically just to ...
1
vote
1answer
1k views
SSSD delete users
It is my first question on the forum, so please, don't be mad if I miss important information about my issue.
I use Debian 8 and I joined an Active Directory domain (Windows server 2012) with SSSD ...
4
votes
2answers
5k views
SSH Logins failing for all users, even when using correct password
So, I have a RHEL server that is ad joined. Users are not able to login, even when using the correct passwords.
I can login through console, but only with root, none of the AD accounts will work. I ...
0
votes
0answers
5k views
CentOS 7 SSSD AD with Samba Share
I followed this site's tutorial to install SSSD (without WinBind) to join a Windows Server 2008 domain. And it is a great success. Before that I was trying to use Zentyal to set up share folders but ...
0
votes
1answer
503 views
Linux getent automount?
I just got a user account on a server with its nsswitch pointing at ldap.
Something is wrong with my home folder (I don't have one).
Generally the home folders are mounted by automount/autofs and ...
0
votes
2answers
835 views
sssd caching user credentials even the cache_credentials is set to false
I have setup Redhat host to authenticate AD users for ssh sessions. Everything is working as expected, however, single concern, user credentials are being cached somewhere.
Upon first time login ...
1
vote
1answer
225 views
Sudo long wait for Active Directory user
My Fedora 26 (was 25 when installed/joined to AD) has a long timeout when I run sudo for my Active Directory user if I leave it alone for to long.
Timeout is long. 25 seconds.
I used strace (sudo ...
