Questions tagged [sssd]

SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.

Filter by
Sorted by
Tagged with
1 vote
0 answers
24 views

What dictates the order of group listing with id and groups command

I am trying to work out what order the groups are listed by id and groups command (coreutils v8.22) I am using LDAP and have configured SSSD to read user and group information. My ldap server always ...
user avatar
  • 29
0 votes
0 answers
12 views

Connect xl2tpd to windows domain auth with SSSD

We have an xl2tpd VPN setup that we would like to auth users against our Windows domain. I found this older page: http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-...
user avatar
  • 121
2 votes
1 answer
33 views

sssd doesn't query LDAP for loginshell

I have configured an LDAP server and created a user. ldapsearch delivers the following results: # user, People, brave-vesperia.com dn: uid=masc,ou=People,dc=brave-vesperia,dc=com objectClass: top ...
user avatar
  • 217
0 votes
1 answer
120 views

Need to join RHEL 8.5 to AD using SSSD

How do i join my RHEL 8.5 server to AD using sssd? Is there a standard working process for AD joining. I have used adcli , realm join but there is always instability. Also is there a standard way to ...
user avatar
1 vote
1 answer
164 views

journalctl --user -u myservice "No journal files were found", for a specific user

Problem: systemd user units journalctl output display "No journal files were found." This only happens for the one sss user I am testing with, all local users seem to work fine. EDIT: sss ...
user avatar
  • 294
0 votes
0 answers
45 views

SSSD is running, but not working

I cross-compiled and installed SSSD on my Linux-based board (ARM architecture). This is my /etc/sssd/sssd.conf configuration file: [sssd] domains = LDAP_DOMAIN config_file_version = 2 services = nss, ...
user avatar
0 votes
0 answers
44 views

Unable to start a D-Bus server at unix:path [...] Socket name too long

I cross-compiled sssd and D-Bus for ARM architecture. When I start sssd, it crashes because of a wrong dbus path address : [sssd] [sbus_server_socket_listen] (0x0020): Unable to start a D-Bus server ...
user avatar
0 votes
0 answers
58 views

Why SSSD fails to start?

Hi cross compile and installed SSSD for ARM architecture. Since on my board I don't have systemctl, service or other similar programs, I try to start SSSD itself with the command: sssd start -c /etc/...
user avatar
0 votes
0 answers
106 views

How to insert new users directories

I am trying to set up the directories on Ubuntu Server, Linux 4.15.0-162-generic #170-Ubuntu SMP using command chown user:group however, I have gotten an error like chown: invalid spec: ‘2163147:’ ...
user avatar
1 vote
0 answers
148 views

SSSD with LDAP authentication, old password works

My client is Centos 7 and the LDAP server is Active Directory (Windows 2008 R2). I'm using sssd in order to authenticate to my machine with LDAP users (ad). My problem is that I manage to connect with ...
user avatar
  • 11
1 vote
1 answer
3k views

RHEL 8 , sssd - Could not start TLS encryption EE certificate key too weak

In my RedHat 8.4 server, after joining AD when I start the sssd process its giving below error message. sssd[be[XXX.XXX.XXX]][23324]: Could not start TLS encryption. error:1416F086:SSL routines:...
user avatar
  • 320
1 vote
0 answers
168 views

SSSD AD auth provider use tls port 636

we are trying to use TLS port for AD communication for RedHat Linux 8 using sssd. after joining server to domain. using below sssd config for user authentication. I expect sssd to connect using port ...
user avatar
  • 320
0 votes
0 answers
204 views

AD authentication failure Ubutnu || Access denied for user 4 (System error)

Facing this issue tried all the steps available online, but still having issue. need some expert solutions. ssh -vvv view OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 debug1: Reading configuration ...
user avatar
  • 2,953
0 votes
0 answers
22 views

openldap authentication with sssd redhat 7

I did setup an ldap server with a tls certificate. (auth-001) I have a test machine (auth-002) that successfully uses the openldap to authenticate. Therefore the server works fine I did setup a second ...
user avatar
  • 1
1 vote
1 answer
152 views

Linux in Active Directory: Persistent users

I was able to successfully join my Ubuntu 18.04 machine into AD. For this I'm using SSSD and Kerberos. I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
user avatar
0 votes
0 answers
52 views

Ubuntu ecryptfs active directory

At my office we use laptop on Ubuntu 18.04 with encrypted home with ecryptfs and users are logged with a Samba 4 as Active Directory. We don't have any problem when laptop are in the same samba 4's ...
user avatar
0 votes
0 answers
66 views

SSSD+LDAP+lightdm issue

I have one LDAP server and a linuxMint client with SSSD. When I login with a user with an expired password lightdm give an advice about it and stop the login, but it never prompts a textbox to change ...
user avatar
  • 1
1 vote
0 answers
64 views

List items in an autofs map

My org is transitioning off of NIS and connecting RHEL clients to AD via SSSD. I'm making use of the legacy NIS mounts created in the AD RFC2307 map editor and have configured sssd.conf to get mount ...
user avatar
2 votes
1 answer
8k views

Samba file server + AD + SSSD without Winbind

Currently have a CentOS8 server AD integrated using SSSD + automatic SID->UID mapping/generation. I would like to setup some file shares to make use of AD groups, but am struggling to get it set up....
user avatar
0 votes
1 answer
170 views

Automating SELinux user mappings for SSSD AD users without an IdM solution

I have several RHEL7 and CentOS7 based systems that are tied into a Windows Server 2019 Active Directory using realms/SSSD. Currently, AD users adopt the unconfined_u SELinux user mapping by default. ...
user avatar
1 vote
0 answers
195 views

CentOS 8, SSSD, LDAP and yubikey PIV authentication problem

Trying to set up the following Authentication with Yubikey (PIV) with LDAP. Already got the authentication with Yubikey and local users working with SSSD. Also got the LDAP working with SSSD but not ...
user avatar
0 votes
1 answer
2k views

Allowing Active Directory groups to sudo on Ubuntu 20.04

I've joined the domain and set up group login successfully, but can't get sudo to work for members of that group. %DOMAIN\\domain-group ALL=(ALL) ALL in /etc/sudoers doesn't work---users are not ...
user avatar
1 vote
0 answers
25 views

Sporadic / occasional problems logging into server with Windows AD account (via SSSD)

Trying to log into CentOS7 desktop GUI via Windows Remote Desktop Manager with a Windows AD account linked to the server via SSSD and seeing... Trying to ssh in as myuser does not work either, with ...
user avatar
0 votes
1 answer
332 views

How to authenticate windows AD group members to login to Linux systems without joining to windows domain

Please help me to get the steps to do on Centos/SUSE to use windows active directory LDAP feature alone for Linux clients to authenticate users belongs to a AD group instead of joining all Linux ...
user avatar
  • 1
1 vote
0 answers
779 views

FreeBSD + SSSD + Samba + Windos Server 2019 AD: Unable to set permissions or create files

I'm using: FreeBSD 12.1 release p10 amb64 Samba 4.10.17 sssd 1.11.7 I'm about to upgrade Active Directory from Windows 2012R2 to Windows 2019. In my existing setup, I have the unix attributes added ...
user avatar
1 vote
1 answer
123 views

Unable to authenticate to ldaps with sssd

I have a docker container running debian stretch and sssd 1.15.0. The plan is to use it for SFTP purposes, and to authenticate users through LDAPS. The LDAP provider in this case is Azure Active ...
user avatar
  • 11
2 votes
1 answer
8k views

CentOS 7.7 - sudo: PAM account management error: Permission denied

We have a CentOS 7.7 system which is joined to a Microsoft AD domain using realmd/sssd. Sudo does work perfectly fine for local system users, however when we attempt to use sudo as an Active Directory ...
user avatar
  • 21
0 votes
0 answers
964 views

Unable to open tdb '/var/lib/sss/db/config.ldb'

I have an Oracle Linux Server release 8.2 system that I recently updated via yum. Before the update ssh could authenticate against a LDAP server, sles linux. In the logs I now see (details below): [...
user avatar
  • 1
0 votes
0 answers
211 views

Authentication fails though the password is correct

I have a linux 7.7 machine which is integrated to Windows Active Directory. Also I have a local user "appuser" in the server for managing the application. While I switch to appuser, I am ...
user avatar
0 votes
1 answer
305 views

AD users unable to access Samba Share

I have a RHEL 7.6 server joined to AD using sssd and realm. I am able to SSH into the Linux servers as AD users, but the same users are unable to access the Samba share configured in the server. When ...
user avatar
1 vote
2 answers
839 views

SSH disconnecting after successful auth when using AD credentials

I am working on getting SSH to accept AD credentials. Server details CentOS 8 Server is successfully joined to the domain Ran realm discover which returned proper information regarding our AD ...
user avatar
  • 267
2 votes
2 answers
2k views

How does id command on linux get user groups or which pam module is used?

We have sssd configuration as follows: id_provider = ad auth_provider = krb5 access_provider = ldap enumerate = false ignore_group_members = true; As you can see, we are not enumerating users and ...
user avatar
  • 703
0 votes
0 answers
1k views

Not all groups syncing to linux machine with SSSD?

We have Active Directory synced to a linux server (centOS 7) via sssd and notice that some groups that users are set as members of in AD do not show up on the sssd-enabled linux server. Eg. I may ...
user avatar
1 vote
0 answers
10k views

SSSD new groups not added to user, "tsig verify failure ... update failed: REFUSED"?

After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
user avatar
1 vote
1 answer
1k views

SSSD running but UID/GIDs wrong?

I have sssd installed on a server to use Active Directory accounts and can connect, but am seeing that the UIDs for AD users are very wrong (eg. an AD users posix UID is set to 1234, but I see ...
user avatar
1 vote
0 answers
394 views

Why some Active Directory domain users can't connect to the server?

I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server. When I try to login with users which were created ...
user avatar
4 votes
1 answer
3k views

sssd not rotating its AD computer account password

I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening ...
user avatar
0 votes
0 answers
767 views

SSH Key Auth failed ... sometimes with SSSD

I have an issue with one of my server I use keys to authenticate on my server with AD account, it works most of the time. SSSD module is used to authenticate AD user. Sometimes i can't authenticate ...
user avatar
2 votes
1 answer
275 views

sudo-ldap works with !authenticate only

I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works. However, sudo-ldap works only if !authenticate is set: dn: cn=...
user avatar
  • 51k
1 vote
1 answer
2k views

Domain Joined Linux - PAM mkhomedir creating homedirs owned as root for SSH

Currently, I have a fleet of linux computers joined to an active directory domain with SSSD for user management - primarily ubuntu, with some Raspian as well. I'm using pam_mkhomedir.so to create ...
user avatar
  • 131
0 votes
1 answer
2k views

How can I confirm another user's sudo permissions using my sudo permissions?

I currently manage an IDM (FreeIPA) cluster and have full sudo rights, i.e. I can become root via sudo -Es. I'd like to verify a sudo rule that I've added to FreeIPA on a specific server to confirm ...
user avatar
  • 346k
1 vote
1 answer
579 views

Authentication via LDAP: where is ldap_search_ext defined?

There are two RHEL 8 servers which have been provisioned from the same template, with some manual fix and tweaking done manually on the first server only. They allow SSH user authentication via a ...
user avatar
  • 25.8k
0 votes
1 answer
566 views

Change authentication order GNU/Linux

I've got a CentOS7 server joined to a Windows Active Directory Server. I'm trying to connect to CentOS using my Active Directory credentials but it seems that it checks the local account as first step ...
user avatar
5 votes
1 answer
3k views

Linux clients can't login on samba share while windows and mac can (active directory env)

Setup server Centos 7.6 Samba 4.8 Winbind SSSD Kerberos This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
user avatar
  • 1,067
1 vote
1 answer
2k views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
user avatar
  • 133
0 votes
0 answers
396 views

Add all users in AD-Group to the local wheel group

We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group. The users that we want to permit to use the program 'su' are ...
user avatar
3 votes
3 answers
4k views

No user exists for uid 721001106 when running ssh command within SSH chroot directory

I am running debian 8 with SSSD authentication. The authentication works and ssh works fine. I have copied all libraries etc over to my SSH chrootdirectory and all my applications work except ssh ...
user avatar
0 votes
0 answers
1k views

sudoer: AD domain group in sudoer file won´t work

My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials. I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(...
user avatar
0 votes
0 answers
3k views

Samba: share is not accessible for AD groups

I have a CentOS server joined to an ID domain with realm(8) using sssd(8). I don´t have winbind installed, though. I can log fine with AD domain users into this CentOS server. I set up samba shares in ...
user avatar
1 vote
3 answers
12k views

sssd: AD user cannot login in RHEL 7

I can switch to the mentioned domain user with su command from the server, but ssh login is failing. The user domain group is already added in sssd.conf file under "simple_allow_groups" The errors in ...
user avatar