Questions tagged [sssd]

SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.

Filter by
Sorted by
Tagged with
1
vote
0answers
12 views

AutoFS doesn't use user's krb5 ticket when in conjunction with sssd

I'm using a default /etc/auto.smb (uploaded to your convenience) and a single-line auto.master (/media /etc/auto.smb --timeout=300 --ghost) on Debian 10. SSSD is set up and working just fine - users ...
3
votes
1answer
1k views

Get sudoers through LDAP (SUSE Linux Enterprise Server 12)

I have a problem with my LDAP configuration on SUSE Linux Enterprise Server 12. As many of you know, the ldap.conf file has been replaced with sssd.conf and a couple of other conf files like nsswitch....
3
votes
2answers
719 views

No user exists for uid 721001106 when running ssh command within SSH chroot directory

I am running debian 8 with SSSD authentication. The authentication works and ssh works fine. I have copied all libraries etc over to my SSH chrootdirectory and all my applications work except ssh ...
2
votes
1answer
994 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
33 views

Not all groups syncing to linux machine with SSSD?

We have Active Directory synced to a linux server (centOS 7) via sssd and notice that some groups that users are set as members of in AD do not show up on the sssd-enabled linux server. Eg. I may ...
2
votes
1answer
2k views

sssd not working over ldap_id_use_start_tls

Have a weird situation going on. Trying to setup sssd, but I am having issues when I set ldap_id_use_start_tls on sssd.conf. In sssd.conf I have the following config: [domain] ldap_id_use_start_tls =...
1
vote
2answers
1k views

getent passwd does not return AD users Centos 7 SSSD

I'm used to joining windows 2008 r2 AD with Krb5.conf/ldap.conf/smb.conf and pam.d/authconfig_ac and being able to list users with getent passwd but after joining a centos 7 system I can logon fine, ...
0
votes
1answer
1k views

Enable sssd caching and linux to honor that cache on CentOS 5

I wanted to enable sssd caching on CentOs and not to use nscd caching, because sssd itself is giving that option. However, authconfig is not giving the option for --enablecachecreds even on the ...
2
votes
1answer
5k views

LDAP user does not exist when running 'su'

I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using authconfig-tui the FORCELEGACY ...
0
votes
0answers
327 views

SSSD new groups not added to user, “tsig verify failure … update failed: REFUSED”?

After adding a user to a group in Active Directory and looking for that group to appear with the user on a linux server linked to AD via SSSD, noticing that the group is not added to the user (even ...
2
votes
3answers
10k views

sssd: login problems with AD user

I've setup my samba4 DC to get account information from a central AD provider via sssd. What I'd like to do now is permit some subset of these users to login via ssh (to linux machines) or via RDP (to ...
0
votes
1answer
29 views

SSSD running but UID/GIDs wrong?

I have sssd installed on a server to use Active Directory accounts and can connect, but am seeing that the UIDs for AD users are very wrong (eg. an AD users posix UID is set to 1234, but I see ...
1
vote
1answer
3k views

sssd: AD user cannot login in RHEL 7

I can switch to the mentioned domain user with su command from the server, but ssh login is failing. The user domain group is already added in sssd.conf file under "simple_allow_groups" The errors in ...
0
votes
0answers
47 views

How list users / groups having access to a Linux server that is connected to AD using sssd

Is there a command to get the list of AD Users (or) AD groups, that can access a Linux server, from the command prompt on the server itself without logging into the windows server? Below is how our ...
3
votes
4answers
11k views

Edit home directory for an LDAP user in Linux

I have an LDAP user who accesses a server based on having the appropriate LDAP host attribute via sssd. This user does not show up in /etc/passwd because he is not local. How do I modify his home ...
1
vote
0answers
40 views

Why some Active Directory domain users can't connect to the server?

I've been experiencing an issue with a RHEL 7 Server in which relatively newly created Active Directory domain users can't connect to the server. When I try to login with users which were created ...
0
votes
0answers
11 views

Put users into system group by LDAP group membership

Currently users can authenticate via SSSD using their LDAP user account. But there is no way of specifying special group memberships. Now I have a LDAP group like this: The user objects itself does ...
4
votes
2answers
5k views

SSH Logins failing for all users, even when using correct password

So, I have a RHEL server that is ad joined. Users are not able to login, even when using the correct passwords. I can login through console, but only with root, none of the AD accounts will work. I ...
5
votes
1answer
1k views

Linux clients can't login on samba share while windows and mac can (active directory env)

Setup server Centos 7.6 Samba 4.8 Winbind SSSD Kerberos This machine is attached to the company active directory as member server but not domain controller (I followed the RadHat documentation to ...
2
votes
1answer
175 views

sssd not rotating its AD computer account password

I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening ...
0
votes
0answers
18 views

SSSD configured for optimal security Kerberos only no need for LDAPS?

SSSD configured for optimal security Kerberos only no need for LDAPS? I want to ensure I have configured our SSSD for optimal security. Any insight would be appreciated. Should I add any values? ...
2
votes
2answers
1k views

Using openldap authentication only for some users

I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements. I basically know how ...
0
votes
1answer
437 views

On starting sssd

there. At first, it says the daemon couldn't find the /etc/sssd/sssd.conf. So, I created this and, when executing sssd "systemctl start sssd.service", it shows the following errors. Jun 25 21:00:48 ...
0
votes
1answer
339 views

How can I confirm another user's sudo permissions using my sudo permissions?

I currently manage an IDM (FreeIPA) cluster and have full sudo rights, i.e. I can become root via sudo -Es. I'd like to verify a sudo rule that I've added to FreeIPA on a specific server to confirm ...
0
votes
0answers
139 views

SSH Key Auth failed … sometimes with SSSD

I have an issue with one of my server I use keys to authenticate on my server with AD account, it works most of the time. SSSD module is used to authenticate AD user. Sometimes i can't authenticate ...
2
votes
1answer
49 views

sudo-ldap works with !authenticate only

I'm trying to setup sudo-ldap in a clean CentOS 7 docker environment. I've successfully setup sssd and PAM authentication, and it works. However, sudo-ldap works only if !authenticate is set: dn: cn=...
1
vote
1answer
367 views

Domain Joined Linux - PAM mkhomedir creating homedirs owned as root for SSH

Currently, I have a fleet of linux computers joined to an active directory domain with SSSD for user management - primarily ubuntu, with some Raspian as well. I'm using pam_mkhomedir.so to create ...
1
vote
1answer
136 views

Authentication via LDAP: where is ldap_search_ext defined?

There are two RHEL 8 servers which have been provisioned from the same template, with some manual fix and tweaking done manually on the first server only. They allow SSH user authentication via a ...
2
votes
2answers
3k views

pam_faillock and AD/CentOS 7.2

So, I have a CentOS 7.2 system and I used realmd to join the AD domain. I can do a # id {username}@{domain} which perfectly lists all of the AD information for that user. Awesome! Using stock pam.d/...
0
votes
1answer
169 views

Change authentication order GNU/Linux

I've got a CentOS7 server joined to a Windows Active Directory Server. I'm trying to connect to CentOS using my Active Directory credentials but it seems that it checks the local account as first step ...
1
vote
0answers
771 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
2
votes
2answers
4k views

LDAP Sudoers w/ AD & SSSD (returns only primary group)

I'm having issues getting LDAP sudoers rules to work. My environment is: Active Directory on Windows Server 2012 R2 Ubuntu 16.04.2 SSSD 1.13.4-1ubuntu1.5 sudo 1.8.20-3 (latest as of the posting, ...
6
votes
2answers
11k views

Missing config file for SSSD?

I want to make an CentOS 7 installation with LDAP authentication, so I installed authconfig-gtk, sssd and krb5-workstation. When I tried to start the service, I've got a message telling me that there ...
0
votes
0answers
167 views

Add all users in AD-Group to the local wheel group

We have limited 'su' to users that are in the wheel group and are now looking to permit certain users that are in a particular AD-Group. The users that we want to permit to use the program 'su' are ...
0
votes
0answers
5k views

CentOS 7 SSSD AD with Samba Share

I followed this site's tutorial to install SSSD (without WinBind) to join a Windows Server 2008 domain. And it is a great success. Before that I was trying to use Zentyal to set up share folders but ...
0
votes
0answers
381 views

sudoer: AD domain group in sudoer file won´t work

My server is joined to AD domain, and I used SSSD and realm to do so. I can log fine to the server using SSH and my AD credentials. I wanted to allow my user to run sudo, so I added %MY_AD_GROUP ALL=(...
0
votes
0answers
757 views

Samba: share is not accessible for AD groups

I have a CentOS server joined to an ID domain with realm(8) using sssd(8). I don´t have winbind installed, though. I can log fine with AD domain users into this CentOS server. I set up samba shares in ...
1
vote
3answers
2k views

Allow AD group to access samba share

On my Linux I created a samba share like this, it was working fine. [global] security = user passdb backend = tdbsam map to guest = Bad User guest account = mcms [mml-t1] path = /...
0
votes
2answers
2k views

Is SSSD supported on AIX and Solaris?

Is SSSD supported on AIX and Solaris? If so, any good setup guide?
4
votes
3answers
8k views

Join Redhat 7 without prompting the password

I am trying to automate domain join on RedHat 7 using the following command: realm join -U serviceaccount --client-software=sssd abc.com The problem is this command prompts for password which stops ...
0
votes
2answers
133 views

On Solaris I get good id mapping..on linux not,why?

I use an Active Directory server for authentication,Solaris works fine following this Howto. All works,and my user "user1" get the right UID assigned on Windows AD,which is 10000. On linux I follow ...
4
votes
1answer
350 views

SELinux Interfering With sss_cache

System: HP Pavilion Power Laptop 15-cb0xx Intel i7-7700HQ w/ integrated graphics enabled (can't be turned off in bios) Fedora 28 NVIDIA GTX 1050 (mobile) I used the dnfdragora GUI to update about ...
4
votes
0answers
5k views

sssd configuration with Active directory

I need to configure the sssd so that we can use Windows Active directory username to login to Redhat machine. I have below configuration file for sssd.conf file I get the following error in log. ...
1
vote
0answers
41 views

in ldap make the default bind the current logged in user

I do not want to specify a default bind_dn in the sssd.conf file for ldap (either openldap or active directory). Is it possible to configure the system in a way, that the first logged in user becomes ...
4
votes
0answers
4k views

Centos 7 AD authentication DataProvider is Offline

I have configured my Linux machine to use AD authentication. Sometimes few nodes are unable to login. The /var/log/sssd/sssd_nss.log log file reports the message below: Thu Sep 13 13:31:39 2018) [...
1
vote
0answers
2k views

Samba can't fetch domain SID after joining AD domain

This is my scenario: I have a CentOS 7.5 server which must act as a file server and allow AD-integrated authentication for Samba access, without the need to create local users with smbpasswd. Samba ...
3
votes
1answer
4k views

sssd and Active Directory user does not exist in CentOS

When I try to do a su user1@ADREALM.COM I get a "user does not exist" message. user1@ADREALM.COM exists in Active Directory. I can do kinit user1@ADREALM.COM successfully and get a ticket. Here are ...
4
votes
1answer
7k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
5
votes
2answers
2k views

Setting login shell in SSS configuration for users from Active Directory

I'm trying to define different login shells for different users of an AD domain, as described here. The aim is to deny members of a particular group from logging in while allowing them to do SSH ...
3
votes
1answer
484 views

How to Specify Group Owner During Cron

I've done a fair amount of research but either I'm having trouble formulating the context to create relevant results or the information is hard to find. I have a production ubuntu 16.04 server ...