Questions tagged [sssd]

SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

pam_sss(sudo:auth): unknown option: minimum_uid:6000

I've recently tried to convert my Rhel7 configuration to my Rhel9 setup. I'm running into some issues when it comes to authselect and system-auth configuration file. For Rhel7 I used following: auth ...
N. J's user avatar
  • 137
0 votes
0 answers
15 views

Switch from Rhel7 to Rhel9 | system-auth vs SSSD

Now that I've decided to switch from RHEL7 to RHEL9, I've previously configured my Rhel7 /etc/pam.d/system-auth etc, but if my understanding is correct it's preferred to used authselect together with /...
N. J's user avatar
  • 137
0 votes
0 answers
31 views

Configuring Sudo to use AD/LDAP password

Looking into the feasibility of configuring our VMs (RHEL 8) so users in the wheel group use their LDAP password to authenticate for Sudo What I've done so far is configured sssd for LDAP ...
user3777740's user avatar
0 votes
0 answers
39 views

pam_unix error when attempting to setup rdxp with AD integration

Issue: Installed Realm, SSSD and SSH works with all users, but trying to remote desktop using xrdp fails with the following errors Aug 30 00:00:00 PC-NAME xrdp-sesman[220997]: pam_unix(xrdp-sesman:...
themantimeforgot's user avatar
0 votes
0 answers
26 views

How to allow specific LDAP users to authenticate oracle linux servers?

$ sudo grep -v -E '^\s*(#|$)' /etc/openldap/ldap.conf SASL_NOCANON on uri ldap://ldap.local.{company}.com base dc={company},dc=com $ sudo grep -v -E '^\s*(#|$)' /etc/pam.d/sshd auth ...
nagarjuna v's user avatar
0 votes
0 answers
26 views

Regarding user accounts, their gidNumbers, and SSSD requirement for a corresponding group with the same gidNumber(s)

If an LDAP user "Alice" has a gidNumber of 12345 and there is no LDAP group with the gidNumber of 12345, what are the implications with regard to sssd (System Security Services Daemon) and ...
Brian McMahon's user avatar
2 votes
0 answers
106 views

How to exclude local users from PAM auto mount?

I'm using sssd and pam to allow people to log in via AD and automatically mount NFS shares. It works fine, but when I try to login as a local user like root, the auto-mount process fails and it takes ...
stappero's user avatar
1 vote
0 answers
50 views

Splitting long lines in sssd.conf

I have an MS-AD domain joined SLES server, using sssd to control access. Is there a way to break long lines in /etc/sssd/sssd.conf file for readability purposes? From this: ldap_group_search_base = ou=...
Norskyi's user avatar
  • 11
0 votes
1 answer
306 views

Difference between nsswitch, nslcd and sssd?

I'm trying to configure sssd instead of nslcd for my Rhel system, and then I came across nsswitch. What's the difference between these three?
N. J's user avatar
  • 137
0 votes
0 answers
92 views

Kerberos ticket refreshed fine, but cache file has unexpected name: Appended "_randomstring" to cache file name

I have a Kerberos problem with a Debian 11 laptop that authenticates against a Samba server. I use sssd, lightdm and KDE Plasma. I have not overriden default_ccache_name in /etc/krb5.conf. According ...
MrSnrub's user avatar
  • 103
0 votes
0 answers
329 views

Do we really need NSCD service running? What are the pros and cons?

We have a pretty mixed environment in terms of operating systems. Suse 12/15, Oracle Linux 6/7/8, Redhat 6/7/8 and a few others. We've been using Active Directory authentication for some time. For ...
tmorais's user avatar
  • 11
1 vote
1 answer
296 views

Difference between Linux-PAM + SSSD and Linux-PAM using NSCD

Confused when it comes to Linux PAM, but also when people are talking about PAM + sssd. I know sssd is some sort of a cache of users and groups, while PAM is used for authentication of local users. ...
N. J's user avatar
  • 137
0 votes
0 answers
63 views

How to add multiple ips in sssd.conf file and how to check failover is happening is working

Can some one help me to add multiple servers in sssd.conf file , if the primary ad server is down it should pick the secondary servers and how do we check failover is working fine or not. Any ...
Tejas's user avatar
  • 1
0 votes
0 answers
19 views

Store domain user creds upon logon

Environment: Clients - Debian based and connected to Win2019 DC/AD. sssd, realmd, krb5, nsswitch, pam, smb, lightdm installed Issue: Client users are getting dropped on our SSO system after certain ...
shafuq's user avatar
  • 101
1 vote
0 answers
433 views

Linux server - AD Login enabled - how to add AD group to local group

My RHEL servers are enabled with Active Directory authentication configured in sssd.conf I have allowed few AD groups in sssd.conf to login to the Linux server. the issue is I need to know how do I ...
judi's user avatar
  • 71
1 vote
0 answers
646 views

Domains are not found after joining Ubuntu 22.04 to Active Directory using SSSD

Since Ubuntu 20.04 we are using SSSD and realmd to join these server to one of our Active Directory domains. This works (almost) out-of-the-box. For Ubuntu 22.04, however, we run into issues. And I am ...
Smithers91's user avatar
1 vote
1 answer
2k views

'getent passwd' not showing LDAP users, athough users can log in

I have an administration node running LDAP and a login node which uses LDAP on the other node to authorize users. Users are able to log into the login node successfully. When I run getent passwd, on ...
loris's user avatar
  • 195
2 votes
0 answers
157 views

What dictates the order of group listing with id and groups command

I am trying to work out what order the groups are listed by id and groups command (coreutils v8.22) I am using LDAP and have configured SSSD to read user and group information. My ldap server always ...
Rendalf's user avatar
  • 39
2 votes
1 answer
204 views

sssd doesn't query LDAP for loginshell

I have configured an LDAP server and created a user. ldapsearch delivers the following results: # user, People, brave-vesperia.com dn: uid=masc,ou=People,dc=brave-vesperia,dc=com objectClass: top ...
Fang's user avatar
  • 236
0 votes
1 answer
1k views

Need to join RHEL 8.5 to AD using SSSD

How do i join my RHEL 8.5 server to AD using sssd? Is there a standard working process for AD joining. I have used adcli , realm join but there is always instability. Also is there a standard way to ...
Salman Khan's user avatar
1 vote
1 answer
2k views

journalctl --user -u myservice "No journal files were found", for a specific user

Problem: systemd user units journalctl output display "No journal files were found." This only happens for the one sss user I am testing with, all local users seem to work fine. EDIT: sss ...
Dave's user avatar
  • 542
0 votes
0 answers
501 views

SSSD is running, but not working

I cross-compiled and installed SSSD on my Linux-based board (ARM architecture). This is my /etc/sssd/sssd.conf configuration file: [sssd] domains = LDAP_DOMAIN config_file_version = 2 services = nss, ...
user15061000's user avatar
0 votes
0 answers
990 views

Why SSSD fails to start?

Hi cross compile and installed SSSD for ARM architecture. Since on my board I don't have systemctl, service or other similar programs, I try to start SSSD itself with the command: sssd start -c /etc/...
user15061000's user avatar
0 votes
0 answers
239 views

How to insert new users directories

I am trying to set up the directories on Ubuntu Server, Linux 4.15.0-162-generic #170-Ubuntu SMP using command chown user:group however, I have gotten an error like chown: invalid spec: ‘2163147:’ ...
Rodrigo N M's user avatar
2 votes
0 answers
797 views

SSSD with LDAP authentication, old password works

My client is Centos 7 and the LDAP server is Active Directory (Windows 2008 R2). I'm using sssd in order to authenticate to my machine with LDAP users (ad). My problem is that I manage to connect with ...
Utz's user avatar
  • 21
1 vote
1 answer
10k views

RHEL 8 , sssd - Could not start TLS encryption EE certificate key too weak

In my RedHat 8.4 server, after joining AD when I start the sssd process its giving below error message. sssd[be[XXX.XXX.XXX]][23324]: Could not start TLS encryption. error:1416F086:SSL routines:...
sfgroups's user avatar
  • 330
1 vote
0 answers
735 views

SSSD AD auth provider use tls port 636

we are trying to use TLS port for AD communication for RedHat Linux 8 using sssd. after joining server to domain. using below sssd config for user authentication. I expect sssd to connect using port ...
sfgroups's user avatar
  • 330
0 votes
0 answers
1k views

AD authentication failure Ubutnu || Access denied for user 4 (System error)

Facing this issue tried all the steps available online, but still having issue. need some expert solutions. ssh -vvv view OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 debug1: Reading configuration ...
AReddy's user avatar
  • 3,132
1 vote
1 answer
712 views

Linux in Active Directory: Persistent users

I was able to successfully join my Ubuntu 18.04 machine into AD. For this I'm using SSSD and Kerberos. I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
Anton  Merzliakov's user avatar
3 votes
1 answer
16k views

Samba file server + AD + SSSD without Winbind

Currently have a CentOS8 server AD integrated using SSSD + automatic SID->UID mapping/generation. I would like to setup some file shares to make use of AD groups, but am struggling to get it set up....
Stuart475898's user avatar
0 votes
1 answer
448 views

Automating SELinux user mappings for SSSD AD users without an IdM solution

I have several RHEL7 and CentOS7 based systems that are tied into a Windows Server 2019 Active Directory using realms/SSSD. Currently, AD users adopt the unconfined_u SELinux user mapping by default. ...
skykam87's user avatar
1 vote
0 answers
393 views

CentOS 8, SSSD, LDAP and yubikey PIV authentication problem

Trying to set up the following Authentication with Yubikey (PIV) with LDAP. Already got the authentication with Yubikey and local users working with SSSD. Also got the LDAP working with SSSD but not ...
C. Hermansson's user avatar
1 vote
1 answer
5k views

Allowing Active Directory groups to sudo on Ubuntu 20.04

I've joined the domain and set up group login successfully, but can't get sudo to work for members of that group. %DOMAIN\\domain-group ALL=(ALL) ALL in /etc/sudoers doesn't work---users are not ...
ardelbrax's user avatar
1 vote
0 answers
43 views

Sporadic / occasional problems logging into server with Windows AD account (via SSSD)

Trying to log into CentOS7 desktop GUI via Windows Remote Desktop Manager with a Windows AD account linked to the server via SSSD and seeing... Trying to ssh in as myuser does not work either, with ...
lampShadesDrifter's user avatar
0 votes
1 answer
504 views

How to authenticate windows AD group members to login to Linux systems without joining to windows domain

Please help me to get the steps to do on Centos/SUSE to use windows active directory LDAP feature alone for Linux clients to authenticate users belongs to a AD group instead of joining all Linux ...
Anoop's user avatar
  • 1
1 vote
0 answers
1k views

FreeBSD + SSSD + Samba + Windos Server 2019 AD: Unable to set permissions or create files

I'm using: FreeBSD 12.1 release p10 amb64 Samba 4.10.17 sssd 1.11.7 I'm about to upgrade Active Directory from Windows 2012R2 to Windows 2019. In my existing setup, I have the unix attributes added ...
Steve K Jackson's user avatar
1 vote
1 answer
317 views

Unable to authenticate to ldaps with sssd

I have a docker container running debian stretch and sssd 1.15.0. The plan is to use it for SFTP purposes, and to authenticate users through LDAPS. The LDAP provider in this case is Azure Active ...
Lazarix's user avatar
  • 11
3 votes
1 answer
18k views

CentOS 7.7 - sudo: PAM account management error: Permission denied

We have a CentOS 7.7 system which is joined to a Microsoft AD domain using realmd/sssd. Sudo does work perfectly fine for local system users, however when we attempt to use sudo as an Active Directory ...
OCF_Lee's user avatar
  • 31
0 votes
0 answers
2k views

Unable to open tdb '/var/lib/sss/db/config.ldb'

I have an Oracle Linux Server release 8.2 system that I recently updated via yum. Before the update ssh could authenticate against a LDAP server, sles linux. In the logs I now see (details below): [...
hm9075's user avatar
  • 1
0 votes
0 answers
448 views

Authentication fails though the password is correct

I have a linux 7.7 machine which is integrated to Windows Active Directory. Also I have a local user "appuser" in the server for managing the application. While I switch to appuser, I am ...
rohit pillai's user avatar
0 votes
1 answer
875 views

AD users unable to access Samba Share

I have a RHEL 7.6 server joined to AD using sssd and realm. I am able to SSH into the Linux servers as AD users, but the same users are unable to access the Samba share configured in the server. When ...
rohit pillai's user avatar
1 vote
2 answers
2k views

SSH disconnecting after successful auth when using AD credentials

I am working on getting SSH to accept AD credentials. Server details CentOS 8 Server is successfully joined to the domain Ran realm discover which returned proper information regarding our AD ...
bourne's user avatar
  • 267
3 votes
2 answers
3k views

How does id command on linux get user groups or which pam module is used?

We have sssd configuration as follows: id_provider = ad auth_provider = krb5 access_provider = ldap enumerate = false ignore_group_members = true; As you can see, we are not enumerating users and ...
GP92's user avatar
  • 775
0 votes
0 answers
2k views

Not all groups syncing to linux machine with SSSD?

We have Active Directory synced to a linux server (centOS 7) via sssd and notice that some groups that users are set as members of in AD do not show up on the sssd-enabled linux server. Eg. I may ...
lampShadesDrifter's user avatar
2 votes
0 answers
14k views

SSSD new groups not added to user, "tsig verify failure ... update failed: REFUSED"?

After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
lampShadesDrifter's user avatar
1 vote
1 answer
2k views

SSSD running but UID/GIDs wrong?

I have sssd installed on a server to use Active Directory accounts and can connect, but am seeing that the UIDs for AD users are very wrong (eg. an AD users posix UID is set to 1234, but I see ...
lampShadesDrifter's user avatar
1 vote
0 answers
842 views

Why some Active Directory domain users can't connect to the server?

I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server. When I try to login with users which were created ...
SystemKing's user avatar
5 votes
1 answer
5k views

sssd not rotating its AD computer account password

I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening ...
kerplunk's user avatar
  • 101
0 votes
0 answers
1k views

SSH Key Auth failed ... sometimes with SSSD

I have an issue with one of my server I use keys to authenticate on my server with AD account, it works most of the time. SSSD module is used to authenticate AD user. Sometimes i can't authenticate ...
Cyril B.'s user avatar
2 votes
1 answer
468 views

sudo-ldap works with !authenticate only

I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works. However, sudo-ldap works only if !authenticate is set: dn: cn=...
daisy's user avatar
  • 53.7k