Questions tagged [sssd]

SSSD System Security Services Daemon provides an NSS and PAM interface to remote authenticators such as LDAP, Kerberos, FreeIPA.

Filter by
Sorted by
Tagged with
0
votes
2answers
904 views

sssd caching user credentials even the cache_credentials is set to false

I have setup Redhat host to authenticate AD users for ssh sessions. Everything is working as expected, however, single concern, user credentials are being cached somewhere. Upon first time login ...
1
vote
1answer
262 views

Sudo long wait for Active Directory user

My Fedora 26 (was 25 when installed/joined to AD) has a long timeout when I run sudo for my Active Directory user if I leave it alone for to long. Timeout is long. 25 seconds. I used strace (sudo ...
1
vote
0answers
664 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
2
votes
2answers
4k views

LDAP Sudoers w/ AD & SSSD (returns only primary group)

I'm having issues getting LDAP sudoers rules to work. My environment is: Active Directory on Windows Server 2012 R2 Ubuntu 16.04.2 SSSD 1.13.4-1ubuntu1.5 sudo 1.8.20-3 (latest as of the posting, ...
0
votes
1answer
2k views

sssd / ad no ssh login after migration debian 8 => 9: Access denied for user xxx: 4 (System error)

After migration form debian jessie to stretch - login over ssh fails for Ad users, also su to AD user (sssd env) fails. Any hints? Log lines: Jun 20 12:48:57 myhost sshd[1736]: pam_sss(sshd:account):...
1
vote
1answer
222 views

SSSD Domain Configuration Snippets

Generally, it seems, the idea with conf.d-style directories is to allow a very modular, drop-in method to add features or configurations. With SSSD, specifically, it would seem logical to add further ...
2
votes
2answers
1k views

Using openldap authentication only for some users

I am trying to set up a couple of Linux workstations (RedHat 7), and I am trying to figure out how to set up authentication against an LDAP server with some unusual requirements. I basically know how ...
1
vote
0answers
519 views

SSSD list allowed users only

We are using SSSD for authentication using LDAP. And I filter the user access using simple_allow_groups as follows: access_provider = simple simple_allow_groups = Computer Admins (Note: Computer ...
1
vote
0answers
2k views

Why is my IPA Client not recognizing AD Trusted users

I have installed an IPA Server, created a replica agreement and set up a one way trust to our AD Forest. The IPA servers have integrated DNS and are in their own dns zone. This works as expected, I am ...
1
vote
0answers
129 views

Cloning Machines joined to Domain using SSSD

We are using Amazon Web services and have a number of Debian boxes that are registered to our domain. I want to clone these boxes, change there hostname and rejoin them to the domain without impacting ...
2
votes
1answer
6k views

LDAP user does not exist when running 'su'

I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using authconfig-tui the FORCELEGACY ...
2
votes
1answer
480 views

How to understand this SSSD log?

(Wed Apr 19 14:16:47 2017) [sssd[be[xx.xx.COM]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: `RefErr`: DSID-03100781, data 0, 1 access points What does this mean?
2
votes
1answer
525 views

SSSD: Why does setting ldap_group_nesting_level to “0” improve the performance greatly?

What is the default value for this parameter if I don't mention it in the configuration file? In a hundred of people enterprise environment, multiple tools - CDH Hadoop, analytics tool, Tableau, ...
1
vote
0answers
109 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
1
vote
0answers
167 views

SSSD server as centralized authentication

I have a linux server that successfully communicates with Windows Active Directory to get user logins, using SSSD. Everything works good. Now, I'd like to allow a second linux server to use those AD ...
7
votes
2answers
12k views

Missing config file for SSSD?

I want to make an CentOS 7 installation with LDAP authentication, so I installed authconfig-gtk, sssd and krb5-workstation. When I tried to start the service, I've got a message telling me that there ...
10
votes
1answer
10k views

PAM vs LDAP vs SSSD vs Kerberos

I am basically aware of what these services do separate from each other. What I want to know: what exactly happens on a successful login in a linux based network that uses all of these services? In ...
1
vote
1answer
400 views

ldap netgroup refresh interval in SSSD

sssd has the following config to set the interval for the sudo rules refresh: ldap_sudo_full_refresh_interval What is the configuration to set the interval for the netgroup definition retrieval from ...
0
votes
1answer
213 views

What problems could I have if I use the same keytab for all Linux servers authenticating against Active Directory?

Today I use the same keytab for all Linux servers (hundreds). I'm considering using a different keytab for each machine because I suppose that if I use the same keytab the Active Directory thinks I ...
2
votes
1answer
396 views

Sending sssd.log to syslog

How do I configure SSSD to send logs to syslog? I would like to include the SSSD debug logs as well. We would like to feed the sssd logs to Splunk. Our systems are already configured to send syslog to ...
4
votes
1answer
652 views

How to debug authentication failures?

I have a Raspberry Pi that I have connected to our AD domain using realm. It is using sssd-ad to perform user authentication. All accounts in the child domain to which the Pi is joined worked. However ...
0
votes
1answer
492 views

SSSD not authenticating to AD

I have a cluster of 23 machines. CentOS 6.7 They have been successfully authenticating to AD via SSSD for over a year. Unbeknownst to me, someone moved one computer out of the search base OU and ...
2
votes
2answers
3k views

pam_faillock and AD/CentOS 7.2

So, I have a CentOS 7.2 system and I used realmd to join the AD domain. I can do a # id {username}@{domain} which perfectly lists all of the AD information for that user. Awesome! Using stock pam.d/...
4
votes
3answers
9k views

Join Redhat 7 without prompting the password

I am trying to automate domain join on RedHat 7 using the following command: realm join -U serviceaccount --client-software=sssd abc.com The problem is this command prompts for password which stops ...
0
votes
2answers
2k views

Is SSSD supported on AIX and Solaris?

Is SSSD supported on AIX and Solaris? If so, any good setup guide?
3
votes
1answer
1k views

Get sudoers through LDAP (SUSE Linux Enterprise Server 12)

I have a problem with my LDAP configuration on SUSE Linux Enterprise Server 12. As many of you know, the ldap.conf file has been replaced with sssd.conf and a couple of other conf files like nsswitch....
4
votes
2answers
2k views

Configure SSSD (sudo and dyndns_update) with realmd

I'm trying to join a Ubuntu 16.04 to a Windows domain (active directory) using realmd + sssd. Basically I was following this post which worked pretty well and I was able to join my server and could ...
0
votes
1answer
753 views

Samba does not perform reverse mapping for sssd users

I have configured the users through SSSD native AD support. However when I try to access the share it's mapped as "Unix User\username@domain" instead of "domain\username". My sssd: [sssd] ...
1
vote
1answer
406 views

“map passwd uid” equivalent in sssd

nslcd.conf has "map passwd uid" to map attributes that will be used as the Login username. What is the sssd.conf equivalent of that?
4
votes
1answer
4k views

Force authentication to use sssd not nslcd

What I did was: vim /etc/sysconfig/authconfig USESSSDAUTH=yes USESSSD=yes FORCELEGACY=no Then: authconfig --enablesssd --enablesssdauth --enablelocauthorize --update ...
2
votes
1answer
13k views

Trouble Joining an Active Directory Domain

I'm trying to join an Ubuntu 14.04 server to a Windows 2003 R2 domain. My admin says that from the controller side, it is part of the domain. But SSSD can't seem to start and DNS update fails. I've ...
2
votes
1answer
951 views

Login not chdir()ing to correct home directory (AD/realmd/sssd)

I'm forced (ugh) to join several linux machines to a domain. I'm currently using debian stable, and am joining the machines using a join script I wrote (at https://rbmj.github.io/join.sh for ...
2
votes
0answers
351 views

Override local sudo defaults using sss or ldap

I'm trying to to configure an IPA domain to use the following sudo options for a specific command group: !authenticate !requiretty visiblepw Locally, the following defaults are set in /etc/sudoers: ...
2
votes
1answer
2k views

SSSD Centos 7 AD Binding - only some users are able to login

I have been trying to nail down the process of binding a Centos 7 install to a Windows domain but am struggling. I have managed to successfully do this in the past on a couple of boxes but I am now ...
2
votes
0answers
456 views

ldap 389 server with sssd client, cannot modify password

I setup the 389 ldap server on a fedora system. I can authenticate against the system, but I cannot update/modify a password neither as root nor as user. user root gets a "Password reset by root is ...
2
votes
1answer
7k views

sssd realm discover: Not authorized to perform this action

I am testing sssd on CentOS and am unable to progress as per the error below: [root@sssd-testing ~]# realm discover realm: Couldn't discover realms: Not authorized to perform this action [root@sssd-...
4
votes
0answers
3k views

SSSD For Authentication & SAMBA For File Sharing [duplicate]

As an alternative to winbindd, I have setup SSSD on a machine so that it can authenticate AD domain accounts, which is working great. However, this same machine also needs to act as a file server, so ...
0
votes
1answer
1k views

Enable sssd caching and linux to honor that cache on CentOS 5

I wanted to enable sssd caching on CentOs and not to use nscd caching, because sssd itself is giving that option. However, authconfig is not giving the option for --enablecachecreds even on the ...
1
vote
0answers
4k views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...
0
votes
0answers
98 views

How Can I Set Up DNS Server on Virtual Network w/out Internet?

I'm trying to set up a virtual network populated with 4 CentOS 7 servers for testing purposes. I have successfully configured a Kerberos server and a secondary Kerberos server. However, when it ...
3
votes
2answers
5k views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional pam_oddjob_mkhomedir....
1
vote
1answer
328 views

Authentication token type [(null)] is not supported

I have configured sssd on my servers (some RHEL and CentOS 6), but on some of them, I get the following error in /var/log/sssd/sssd_example.com.log: [sssd[be[example.com]]] [sdap_auth_send] (1): ...
2
votes
0answers
6k views

How do I view multiple users groups using sssd?

SETUP OS = RHEL 6.4 Workstation System is part of an LDAP domain and was originally configured to authenticate using nscd. All recommended SSSD packages have been installed. [root@sssd_system]#...
1
vote
2answers
1k views

getent passwd does not return AD users Centos 7 SSSD

I'm used to joining windows 2008 r2 AD with Krb5.conf/ldap.conf/smb.conf and pam.d/authconfig_ac and being able to list users with getent passwd but after joining a centos 7 system I can logon fine, ...
4
votes
0answers
5k views

sssd configuration with Active directory

I need to configure the sssd so that we can use Windows Active directory username to login to Redhat machine. I have below configuration file for sssd.conf file I get the following error in log. ...
6
votes
1answer
3k views

Adding a system user to an LDAP group with SSSD

Our LDAP server is running RFC 2307 groups (memberuid contains a username, not a DN). With our old nscd/nss_ldap/pam_ldap setup, you could list a non-LDAP user (a system user from /etc/passwd) in an ...
0
votes
1answer
3k views

sssd-ad in wheezy

I have a similar question running on serverfault, but i have a followup question that is more suited here, in my humble(likely uninformed) opinion. I have been trying to validate users in my Debian ...
2
votes
1answer
1k views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
4
votes
1answer
4k views

sudo and sssd not working with user groups

Having a problem getting sudo that is integrated with sssd to work correctly when we use ldap to store the groups that have the different sudo privs. This works just fine if we have sudo set to go to ...
0
votes
1answer
747 views

Authconfig doesn't find all ldap groups

My (soon to be) admin account is in two groups: # ldapsearch \ > -v \ > -H ldaps://localhost:636 \ > -D "${l_dirmgr}" \ > -w $(cat ${f_dirmgr_passphrase}) \ > -b "ou=groups,${l_basedn}...