Questions tagged [sssd]
SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.
145
questions
0
votes
0
answers
15
views
pam_sss(sudo:auth): unknown option: minimum_uid:6000
I've recently tried to convert my Rhel7 configuration to my Rhel9 setup.
I'm running into some issues when it comes to authselect and system-auth configuration file.
For Rhel7 I used following:
auth ...
- 137
0
votes
0
answers
15
views
Switch from Rhel7 to Rhel9 | system-auth vs SSSD
Now that I've decided to switch from RHEL7 to RHEL9, I've previously configured my Rhel7 /etc/pam.d/system-auth etc, but if my understanding is correct it's preferred to used authselect together with /...
- 137
0
votes
0
answers
31
views
Configuring Sudo to use AD/LDAP password
Looking into the feasibility of configuring our VMs (RHEL 8) so users in the wheel group use their LDAP password to authenticate for Sudo
What I've done so far is configured sssd for LDAP ...
0
votes
0
answers
39
views
pam_unix error when attempting to setup rdxp with AD integration
Issue: Installed Realm, SSSD and SSH works with all users, but trying to remote desktop using xrdp fails with the following errors
Aug 30 00:00:00 PC-NAME xrdp-sesman[220997]: pam_unix(xrdp-sesman:...
0
votes
0
answers
26
views
How to allow specific LDAP users to authenticate oracle linux servers?
$ sudo grep -v -E '^\s*(#|$)' /etc/openldap/ldap.conf
SASL_NOCANON on
uri ldap://ldap.local.{company}.com
base dc={company},dc=com
$ sudo grep -v -E '^\s*(#|$)' /etc/pam.d/sshd
auth ...
0
votes
0
answers
26
views
Regarding user accounts, their gidNumbers, and SSSD requirement for a corresponding group with the same gidNumber(s)
If an LDAP user "Alice" has a gidNumber of 12345 and there is no LDAP group with the gidNumber of 12345, what are the implications with regard to sssd (System Security Services Daemon) and ...
- 103
2
votes
0
answers
106
views
How to exclude local users from PAM auto mount?
I'm using sssd and pam to allow people to log in via AD and automatically mount NFS shares. It works fine, but when I try to login as a local user like root, the auto-mount process fails and it takes ...
- 21
1
vote
0
answers
50
views
Splitting long lines in sssd.conf
I have an MS-AD domain joined SLES server, using sssd to control access.
Is there a way to break long lines in /etc/sssd/sssd.conf file for readability purposes?
From this:
ldap_group_search_base = ou=...
- 11
0
votes
1
answer
306
views
Difference between nsswitch, nslcd and sssd?
I'm trying to configure sssd instead of nslcd for my Rhel system, and then I came across nsswitch.
What's the difference between these three?
- 137
0
votes
0
answers
92
views
Kerberos ticket refreshed fine, but cache file has unexpected name: Appended "_randomstring" to cache file name
I have a Kerberos problem with a Debian 11 laptop that authenticates against a Samba server.
I use sssd, lightdm and KDE Plasma.
I have not overriden default_ccache_name in /etc/krb5.conf. According ...
- 103
0
votes
0
answers
329
views
Do we really need NSCD service running? What are the pros and cons?
We have a pretty mixed environment in terms of operating systems. Suse 12/15, Oracle Linux 6/7/8, Redhat 6/7/8 and a few others.
We've been using Active Directory authentication for some time.
For ...
- 11
1
vote
1
answer
296
views
Difference between Linux-PAM + SSSD and Linux-PAM using NSCD
Confused when it comes to Linux PAM, but also when people are talking about PAM + sssd.
I know sssd is some sort of a cache of users and groups, while PAM is used for authentication of local users. ...
- 137
0
votes
0
answers
63
views
How to add multiple ips in sssd.conf file and how to check failover is happening is working
Can some one help me to add multiple servers in sssd.conf file , if the primary ad server is down it should pick the secondary servers and how do we check failover is working fine or not. Any ...
- 1
0
votes
0
answers
19
views
Store domain user creds upon logon
Environment:
Clients - Debian based and connected to Win2019 DC/AD. sssd, realmd, krb5, nsswitch, pam, smb, lightdm installed
Issue:
Client users are getting dropped on our SSO system after certain ...
- 101
1
vote
0
answers
433
views
Linux server - AD Login enabled - how to add AD group to local group
My RHEL servers are enabled with Active Directory authentication configured in sssd.conf
I have allowed few AD groups in sssd.conf to login to the Linux server.
the issue is I need to know how do I ...
- 71
1
vote
0
answers
646
views
Domains are not found after joining Ubuntu 22.04 to Active Directory using SSSD
Since Ubuntu 20.04 we are using SSSD and realmd to join these server to one of our Active Directory domains. This works (almost) out-of-the-box.
For Ubuntu 22.04, however, we run into issues. And I am ...
- 11
1
vote
1
answer
2k
views
'getent passwd' not showing LDAP users, athough users can log in
I have an administration node running LDAP and a login node which uses LDAP on the other node to authorize users. Users are able to log into the login node successfully.
When I run getent passwd, on ...
- 195
2
votes
0
answers
157
views
What dictates the order of group listing with id and groups command
I am trying to work out what order the groups are listed by id and groups command (coreutils v8.22)
I am using LDAP and have configured SSSD to read user and group information.
My ldap server always ...
- 39
2
votes
1
answer
204
views
sssd doesn't query LDAP for loginshell
I have configured an LDAP server and created a user. ldapsearch delivers the following results:
# user, People, brave-vesperia.com
dn: uid=masc,ou=People,dc=brave-vesperia,dc=com
objectClass: top
...
- 236
0
votes
1
answer
1k
views
Need to join RHEL 8.5 to AD using SSSD
How do i join my RHEL 8.5 server to AD using sssd?
Is there a standard working process for AD joining.
I have used adcli , realm join but there is always instability.
Also is there a standard way to ...
- 11
1
vote
1
answer
2k
views
journalctl --user -u myservice "No journal files were found", for a specific user
Problem:
systemd user units journalctl output display "No journal files were found." This only happens for the one sss user I am testing with, all local users seem to work fine. EDIT: sss ...
- 542
0
votes
0
answers
501
views
SSSD is running, but not working
I cross-compiled and installed SSSD on my Linux-based board (ARM architecture).
This is my /etc/sssd/sssd.conf configuration file:
[sssd]
domains = LDAP_DOMAIN
config_file_version = 2
services = nss, ...
- 43
0
votes
0
answers
990
views
Why SSSD fails to start?
Hi cross compile and installed SSSD for ARM architecture.
Since on my board I don't have systemctl, service or other similar programs, I try to start SSSD itself with the command:
sssd start -c /etc/...
- 43
0
votes
0
answers
239
views
How to insert new users directories
I am trying to set up the directories on Ubuntu Server, Linux 4.15.0-162-generic #170-Ubuntu SMP using command
chown user:group
however, I have gotten an error like
chown: invalid spec: ‘2163147:’
...
2
votes
0
answers
797
views
SSSD with LDAP authentication, old password works
My client is Centos 7 and the LDAP server is Active Directory (Windows 2008 R2).
I'm using sssd in order to authenticate to my machine with LDAP users (ad).
My problem is that I manage to connect with ...
- 21
1
vote
1
answer
10k
views
RHEL 8 , sssd - Could not start TLS encryption EE certificate key too weak
In my RedHat 8.4 server, after joining AD when I start the sssd process its giving below error message.
sssd[be[XXX.XXX.XXX]][23324]: Could not start TLS encryption. error:1416F086:SSL routines:...
- 330
1
vote
0
answers
735
views
SSSD AD auth provider use tls port 636
we are trying to use TLS port for AD communication for RedHat Linux 8 using sssd. after joining server to domain. using below sssd config for user authentication. I expect sssd to connect using port ...
- 330
0
votes
0
answers
1k
views
AD authentication failure Ubutnu || Access denied for user 4 (System error)
Facing this issue tried all the steps available online, but still having issue. need some expert solutions.
ssh -vvv view
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration ...
- 3,132
1
vote
1
answer
712
views
Linux in Active Directory: Persistent users
I was able to successfully join my Ubuntu 18.04 machine into AD.
For this I'm using SSSD and Kerberos.
I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
3
votes
1
answer
16k
views
Samba file server + AD + SSSD without Winbind
Currently have a CentOS8 server AD integrated using SSSD + automatic SID->UID mapping/generation. I would like to setup some file shares to make use of AD groups, but am struggling to get it set up....
- 31
0
votes
1
answer
448
views
Automating SELinux user mappings for SSSD AD users without an IdM solution
I have several RHEL7 and CentOS7 based systems that are tied into a Windows Server 2019 Active Directory using realms/SSSD.
Currently, AD users adopt the unconfined_u SELinux user mapping by default. ...
- 1
1
vote
0
answers
393
views
CentOS 8, SSSD, LDAP and yubikey PIV authentication problem
Trying to set up the following
Authentication with Yubikey (PIV) with LDAP.
Already got the authentication with Yubikey and local users working with SSSD. Also got the LDAP working with SSSD but not ...
1
vote
1
answer
5k
views
Allowing Active Directory groups to sudo on Ubuntu 20.04
I've joined the domain and set up group login successfully, but can't get sudo to work for members of that group. %DOMAIN\\domain-group ALL=(ALL) ALL in /etc/sudoers doesn't work---users are not ...
- 11
1
vote
0
answers
43
views
Sporadic / occasional problems logging into server with Windows AD account (via SSSD)
Trying to log into CentOS7 desktop GUI via Windows Remote Desktop Manager with a Windows AD account linked to the server via SSSD and seeing...
Trying to ssh in as myuser does not work either, with ...
0
votes
1
answer
504
views
How to authenticate windows AD group members to login to Linux systems without joining to windows domain
Please help me to get the steps to do on Centos/SUSE to use windows active directory LDAP feature alone for Linux clients to authenticate users belongs to a AD group instead of joining all Linux ...
- 1
1
vote
0
answers
1k
views
FreeBSD + SSSD + Samba + Windos Server 2019 AD: Unable to set permissions or create files
I'm using:
FreeBSD 12.1 release p10 amb64
Samba 4.10.17
sssd 1.11.7
I'm about to upgrade Active Directory from Windows 2012R2 to Windows 2019. In my existing setup, I have the unix attributes added ...
1
vote
1
answer
317
views
Unable to authenticate to ldaps with sssd
I have a docker container running debian stretch and sssd 1.15.0.
The plan is to use it for SFTP purposes, and to authenticate users through LDAPS. The LDAP provider in this case is Azure Active ...
- 11
3
votes
1
answer
18k
views
CentOS 7.7 - sudo: PAM account management error: Permission denied
We have a CentOS 7.7 system which is joined to a Microsoft AD domain using realmd/sssd. Sudo does work perfectly fine for local system users, however when we attempt to use sudo as an Active Directory ...
- 31
0
votes
0
answers
2k
views
Unable to open tdb '/var/lib/sss/db/config.ldb'
I have an Oracle Linux Server release 8.2 system that I recently updated via yum. Before the update ssh could authenticate against a LDAP server, sles linux. In the logs I now see (details below):
[...
- 1
0
votes
0
answers
448
views
Authentication fails though the password is correct
I have a linux 7.7 machine which is integrated to Windows Active Directory. Also I have a local user "appuser" in the server for managing the application. While I switch to appuser, I am ...
- 13
0
votes
1
answer
875
views
AD users unable to access Samba Share
I have a RHEL 7.6 server joined to AD using sssd and realm. I am able to SSH into the Linux servers as AD users, but the same users are unable to access the Samba share configured in the server. When ...
- 13
1
vote
2
answers
2k
views
SSH disconnecting after successful auth when using AD credentials
I am working on getting SSH to accept AD credentials.
Server details
CentOS 8
Server is successfully joined to the domain
Ran realm discover which returned proper information regarding our AD ...
- 267
3
votes
2
answers
3k
views
How does id command on linux get user groups or which pam module is used?
We have sssd configuration as follows:
id_provider = ad
auth_provider = krb5
access_provider = ldap
enumerate = false
ignore_group_members = true;
As you can see, we are not enumerating users and ...
- 775
0
votes
0
answers
2k
views
Not all groups syncing to linux machine with SSSD?
We have Active Directory synced to a linux server (centOS 7) via sssd and notice that some groups that users are set as members of in AD do not show up on the sssd-enabled linux server.
Eg. I may ...
2
votes
0
answers
14k
views
SSSD new groups not added to user, "tsig verify failure ... update failed: REFUSED"?
After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
1
vote
1
answer
2k
views
SSSD running but UID/GIDs wrong?
I have sssd installed on a server to use Active Directory accounts and can connect, but am seeing that the UIDs for AD users are very wrong (eg. an AD users posix UID is set to 1234, but I see ...
1
vote
0
answers
842
views
Why some Active Directory domain users can't connect to the server?
I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server.
When I try to login with users which were created ...
- 11
5
votes
1
answer
5k
views
sssd not rotating its AD computer account password
I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening ...
- 101
0
votes
0
answers
1k
views
SSH Key Auth failed ... sometimes with SSSD
I have an issue with one of my server
I use keys to authenticate on my server with AD account, it works most of the time.
SSSD module is used to authenticate AD user.
Sometimes i can't authenticate ...
- 1
2
votes
1
answer
468
views
sudo-ldap works with !authenticate only
I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works.
However, sudo-ldap works only if !authenticate is set:
dn: cn=...
- 53.7k