Questions tagged [sssd]
SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.
134
questions
1
vote
0
answers
24
views
What dictates the order of group listing with id and groups command
I am trying to work out what order the groups are listed by id and groups command (coreutils v8.22)
I am using LDAP and have configured SSSD to read user and group information.
My ldap server always ...
- 29
0
votes
0
answers
12
views
Connect xl2tpd to windows domain auth with SSSD
We have an xl2tpd VPN setup that we would like to auth users against our Windows domain. I found this older page: http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-...
- 121
2
votes
1
answer
33
views
sssd doesn't query LDAP for loginshell
I have configured an LDAP server and created a user. ldapsearch delivers the following results:
# user, People, brave-vesperia.com
dn: uid=masc,ou=People,dc=brave-vesperia,dc=com
objectClass: top
...
- 217
0
votes
1
answer
120
views
Need to join RHEL 8.5 to AD using SSSD
How do i join my RHEL 8.5 server to AD using sssd?
Is there a standard working process for AD joining.
I have used adcli , realm join but there is always instability.
Also is there a standard way to ...
- 11
1
vote
1
answer
164
views
journalctl --user -u myservice "No journal files were found", for a specific user
Problem:
systemd user units journalctl output display "No journal files were found." This only happens for the one sss user I am testing with, all local users seem to work fine. EDIT: sss ...
- 294
0
votes
0
answers
45
views
SSSD is running, but not working
I cross-compiled and installed SSSD on my Linux-based board (ARM architecture).
This is my /etc/sssd/sssd.conf configuration file:
[sssd]
domains = LDAP_DOMAIN
config_file_version = 2
services = nss, ...
- 33
0
votes
0
answers
44
views
Unable to start a D-Bus server at unix:path [...] Socket name too long
I cross-compiled sssd and D-Bus for ARM architecture. When I start sssd, it crashes because of a wrong dbus path address :
[sssd] [sbus_server_socket_listen] (0x0020): Unable to start a D-Bus server ...
- 33
0
votes
0
answers
58
views
Why SSSD fails to start?
Hi cross compile and installed SSSD for ARM architecture.
Since on my board I don't have systemctl, service or other similar programs, I try to start SSSD itself with the command:
sssd start -c /etc/...
- 33
0
votes
0
answers
106
views
How to insert new users directories
I am trying to set up the directories on Ubuntu Server, Linux 4.15.0-162-generic #170-Ubuntu SMP using command
chown user:group
however, I have gotten an error like
chown: invalid spec: ‘2163147:’
...
1
vote
0
answers
148
views
SSSD with LDAP authentication, old password works
My client is Centos 7 and the LDAP server is Active Directory (Windows 2008 R2).
I'm using sssd in order to authenticate to my machine with LDAP users (ad).
My problem is that I manage to connect with ...
- 11
1
vote
1
answer
3k
views
RHEL 8 , sssd - Could not start TLS encryption EE certificate key too weak
In my RedHat 8.4 server, after joining AD when I start the sssd process its giving below error message.
sssd[be[XXX.XXX.XXX]][23324]: Could not start TLS encryption. error:1416F086:SSL routines:...
- 320
1
vote
0
answers
168
views
SSSD AD auth provider use tls port 636
we are trying to use TLS port for AD communication for RedHat Linux 8 using sssd. after joining server to domain. using below sssd config for user authentication. I expect sssd to connect using port ...
- 320
0
votes
0
answers
204
views
AD authentication failure Ubutnu || Access denied for user 4 (System error)
Facing this issue tried all the steps available online, but still having issue. need some expert solutions.
ssh -vvv view
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration ...
- 2,953
0
votes
0
answers
22
views
openldap authentication with sssd redhat 7
I did setup an ldap server with a tls certificate. (auth-001)
I have a test machine (auth-002) that successfully uses the openldap to authenticate.
Therefore the server works fine
I did setup a second ...
- 1
1
vote
1
answer
152
views
Linux in Active Directory: Persistent users
I was able to successfully join my Ubuntu 18.04 machine into AD.
For this I'm using SSSD and Kerberos.
I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
0
votes
0
answers
52
views
Ubuntu ecryptfs active directory
At my office we use laptop on Ubuntu 18.04 with encrypted home with ecryptfs and users are logged with a Samba 4 as Active Directory.
We don't have any problem when laptop are in the same samba 4's ...
- 1
0
votes
0
answers
66
views
SSSD+LDAP+lightdm issue
I have one LDAP server and a linuxMint client with SSSD.
When I login with a user with an expired password lightdm give an advice about it and stop the login, but it never prompts a textbox to change ...
- 1
1
vote
0
answers
64
views
List items in an autofs map
My org is transitioning off of NIS and connecting RHEL clients to AD via SSSD. I'm making use of the legacy NIS mounts created in the AD RFC2307 map editor and have configured sssd.conf to get mount ...
- 11
2
votes
1
answer
8k
views
Samba file server + AD + SSSD without Winbind
Currently have a CentOS8 server AD integrated using SSSD + automatic SID->UID mapping/generation. I would like to setup some file shares to make use of AD groups, but am struggling to get it set up....
- 21
0
votes
1
answer
170
views
Automating SELinux user mappings for SSSD AD users without an IdM solution
I have several RHEL7 and CentOS7 based systems that are tied into a Windows Server 2019 Active Directory using realms/SSSD.
Currently, AD users adopt the unconfined_u SELinux user mapping by default. ...
- 1
1
vote
0
answers
195
views
CentOS 8, SSSD, LDAP and yubikey PIV authentication problem
Trying to set up the following
Authentication with Yubikey (PIV) with LDAP.
Already got the authentication with Yubikey and local users working with SSSD. Also got the LDAP working with SSSD but not ...
0
votes
1
answer
2k
views
Allowing Active Directory groups to sudo on Ubuntu 20.04
I've joined the domain and set up group login successfully, but can't get sudo to work for members of that group. %DOMAIN\\domain-group ALL=(ALL) ALL in /etc/sudoers doesn't work---users are not ...
1
vote
0
answers
25
views
Sporadic / occasional problems logging into server with Windows AD account (via SSSD)
Trying to log into CentOS7 desktop GUI via Windows Remote Desktop Manager with a Windows AD account linked to the server via SSSD and seeing...
Trying to ssh in as myuser does not work either, with ...
0
votes
1
answer
332
views
How to authenticate windows AD group members to login to Linux systems without joining to windows domain
Please help me to get the steps to do on Centos/SUSE to use windows active directory LDAP feature alone for Linux clients to authenticate users belongs to a AD group instead of joining all Linux ...
- 1
1
vote
0
answers
779
views
FreeBSD + SSSD + Samba + Windos Server 2019 AD: Unable to set permissions or create files
I'm using:
FreeBSD 12.1 release p10 amb64
Samba 4.10.17
sssd 1.11.7
I'm about to upgrade Active Directory from Windows 2012R2 to Windows 2019. In my existing setup, I have the unix attributes added ...
1
vote
1
answer
123
views
Unable to authenticate to ldaps with sssd
I have a docker container running debian stretch and sssd 1.15.0.
The plan is to use it for SFTP purposes, and to authenticate users through LDAPS. The LDAP provider in this case is Azure Active ...
- 11
2
votes
1
answer
8k
views
CentOS 7.7 - sudo: PAM account management error: Permission denied
We have a CentOS 7.7 system which is joined to a Microsoft AD domain using realmd/sssd. Sudo does work perfectly fine for local system users, however when we attempt to use sudo as an Active Directory ...
- 21
0
votes
0
answers
964
views
Unable to open tdb '/var/lib/sss/db/config.ldb'
I have an Oracle Linux Server release 8.2 system that I recently updated via yum. Before the update ssh could authenticate against a LDAP server, sles linux. In the logs I now see (details below):
[...
- 1
0
votes
0
answers
211
views
Authentication fails though the password is correct
I have a linux 7.7 machine which is integrated to Windows Active Directory. Also I have a local user "appuser" in the server for managing the application. While I switch to appuser, I am ...
- 13
0
votes
1
answer
305
views
AD users unable to access Samba Share
I have a RHEL 7.6 server joined to AD using sssd and realm. I am able to SSH into the Linux servers as AD users, but the same users are unable to access the Samba share configured in the server. When ...
- 13
1
vote
2
answers
839
views
SSH disconnecting after successful auth when using AD credentials
I am working on getting SSH to accept AD credentials.
Server details
CentOS 8
Server is successfully joined to the domain
Ran realm discover which returned proper information regarding our AD ...
- 267
2
votes
2
answers
2k
views
How does id command on linux get user groups or which pam module is used?
We have sssd configuration as follows:
id_provider = ad
auth_provider = krb5
access_provider = ldap
enumerate = false
ignore_group_members = true;
As you can see, we are not enumerating users and ...
- 703
0
votes
0
answers
1k
views
Not all groups syncing to linux machine with SSSD?
We have Active Directory synced to a linux server (centOS 7) via sssd and notice that some groups that users are set as members of in AD do not show up on the sssd-enabled linux server.
Eg. I may ...
1
vote
0
answers
10k
views
SSSD new groups not added to user, "tsig verify failure ... update failed: REFUSED"?
After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
1
vote
1
answer
1k
views
SSSD running but UID/GIDs wrong?
I have sssd installed on a server to use Active Directory accounts and can connect, but am seeing that the UIDs for AD users are very wrong (eg. an AD users posix UID is set to 1234, but I see ...
1
vote
0
answers
394
views
Why some Active Directory domain users can't connect to the server?
I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server.
When I try to login with users which were created ...
- 11
4
votes
1
answer
3k
views
sssd not rotating its AD computer account password
I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening ...
- 51
0
votes
0
answers
767
views
SSH Key Auth failed ... sometimes with SSSD
I have an issue with one of my server
I use keys to authenticate on my server with AD account, it works most of the time.
SSSD module is used to authenticate AD user.
Sometimes i can't authenticate ...
- 1
2
votes
1
answer
275
views
sudo-ldap works with !authenticate only
I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works.
However, sudo-ldap works only if !authenticate is set:
dn: cn=...
- 51k
1
vote
1
answer
2k
views
Domain Joined Linux - PAM mkhomedir creating homedirs owned as root for SSH
Currently, I have a fleet of linux computers joined to an active directory domain with SSSD for user management - primarily ubuntu, with some Raspian as well.
I'm using pam_mkhomedir.so to create ...
- 131
0
votes
1
answer
2k
views
How can I confirm another user's sudo permissions using my sudo permissions?
I currently manage an IDM (FreeIPA) cluster and have full sudo rights, i.e. I can become root via sudo -Es. I'd like to verify a sudo rule that I've added to FreeIPA on a specific server to confirm ...
slm♦
- 346k
1
vote
1
answer
579
views
Authentication via LDAP: where is ldap_search_ext defined?
There are two RHEL 8 servers which have been provisioned from the same template, with some manual fix and tweaking done manually on the first server only. They allow SSH user authentication via a ...
- 25.8k
0
votes
1
answer
566
views
Change authentication order GNU/Linux
I've got a CentOS7 server joined to a Windows Active Directory Server. I'm trying to connect to CentOS using my Active Directory credentials but it seems that it checks the local account as first step ...
5
votes
1
answer
3k
views
Linux clients can't login on samba share while windows and mac can (active directory env)
Setup
server
Centos 7.6
Samba 4.8
Winbind
SSSD
Kerberos
This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
- 1,067
1
vote
1
answer
2k
views
Alternative to autofs to mount CIFS folders in user home folders in multi-user environment
My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine.
So ...
- 133
0
votes
0
answers
396
views
Add all users in AD-Group to the local wheel group
We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group.
The users that we want to permit to use the program 'su' are ...
- 101
3
votes
3
answers
4k
views
No user exists for uid 721001106 when running ssh command within SSH chroot directory
I am running debian 8 with SSSD authentication. The authentication works and ssh works fine. I have copied all libraries etc over to my SSH chrootdirectory and all my applications work except ssh ...
- 31
0
votes
0
answers
1k
views
sudoer: AD domain group in sudoer file won´t work
My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials.
I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(...
- 194
0
votes
0
answers
3k
views
Samba: share is not accessible for AD groups
I have a CentOS server joined to an ID domain with realm(8) using sssd(8). I don´t have winbind installed, though. I can log fine with AD domain users into this CentOS server. I set up samba shares in ...
- 194
1
vote
3
answers
12k
views
sssd: AD user cannot login in RHEL 7
I can switch to the mentioned domain user with su command from the server, but ssh login is failing.
The user domain group is already added in sssd.conf file under "simple_allow_groups"
The errors in ...
- 47