8
votes
Accepted
Linux commands to add an Active Directory group in Sudoers file
Note: Messing with the sudoers file has some risk. Before starting, things to think about include:
System backups
A physical root shell (in a properly configured ssh environment root should be dis-...
- 1,230
8
votes
Accepted
Assignment of UID and GID from Active Directory
AD mapping in SSSD is determined using an algorithm (probably a hash function) in the daemon itself: because it's built-in, if you keep the defaults the same, every computer using SSSD should map the ...
- 4,107
6
votes
Accepted
sudo is not working on my Centos 7.3
The problem here is that when you joined your CentOS system to the Active Directory domain, the realm command also modified /etc/nsswitch.conf to take over the configuration of sudo:
grep sudo /etc/...
- 120k
6
votes
Accepted
What happens if a users default shell is not installed?
Let's try!
Shell changed on the server:
[myserver ~]% getent passwd myuser
myuser:x:150:150:myuser:/home/myuser:/foo
Let's log in:
[myclient ~]% ssh myserver
Received disconnect from myserver: 2: ...
- 8,470
4
votes
Configure SSSD (sudo and dyndns_update) with realmd
If you want Active Directory to manage sudoers, you have to load a specialized schema into AD and then create your rules using a tool like ADSI Edit. This walkthrough worked for me on Ubuntu 14.04. ...
- 161
4
votes
Join Redhat 7 without prompting the password
RE: There is not a workaround on the Red Hat side to get around someone entering a password either before or during the realm join.
There is always a work around in Linux/Unix:
echo $passwd| realm ...
- 41
4
votes
Accepted
Mapping AD groups to Linux groups - sssd and Windows server 2016
First, only the management console was removed from WS2016, but the UNIX schema is still there, I think it should still be accessible with e.g. ADSI edit. So you can still use the POSIX attributes, it'...
- 301
4
votes
Accepted
How nsswitch call sssd for credential?
Have a look into Anatomy of SSSD user lookup for an overview of the lookup process or Troubleshooting Guide for how to get logs to see what might be wrong in the daemon.
For quick reference, you may ...
- 301
4
votes
Accepted
What must be added to nsswitch.conf to show AD users and groups?
As suggested by @Doug O'Neal in a comment, it was necessary to set
enumerate = true
in /etc/sssd/sssd.conf.
Now getent passwd and getent group show all users and groups defined in the AD.
Note ...
- 30.3k
4
votes
Accepted
sssd and Active Directory user does not exist in CentOS
Finally I followed these instructions and suddenly it started working, its weird I still dont understand fully what was wrong:
Manually Connecting an SSSD Client to an Active Directory Domain
https://...
- 199
4
votes
Allowing Active Directory groups to sudo on Ubuntu 20.04
I'm not doing this on Ubuntu, so I don't know if there is something special there, but in CentOS I don't have to specify the domain in sudoers, so the syntax I use is:
%domain_group ALL=(ALL) ...
- 41
4
votes
Is it possible to have a local user with the same name as a domain user
If you are using sssd to authenticate with your AD, then users are created with a domain in the name by default. This is controlled by default_domain_suffix in sssd.conf.
Normally, I would add my ...
- 14.4k
4
votes
Accepted
How to troubleshoot a LDAP error 53 (WILL_NOT_PERFORM)?
The error you are encountering is coming from the Active Directory server itself. So the verbose error message, if it exists, is likely to be in the "Event Log" on the Active Directory ...
- 19.4k
3
votes
Accepted
Linux and Azure AD sync possible?
I don't believe there is a tool "right now" that will allow you to synchronise accounts from a Samba DC to Azure Active Directory. You should be able to set up your spare Windows Server as a secondary ...
- 120k
3
votes
Accepted
Every AD SSH login starts with a failure in audit.log
By default, the OpenSSH client will attempt Public Key authentication if you have previously created keys. My guess is that if you do ls ${HOME}/.ssh/ you'll see a keypair - id_rsa and id_rsa.pub. ...
- 654
3
votes
What happens if a users default shell is not installed?
There is no fallback. There would be an error message such as...
Cannot execute /does/not/exist: No such file or directory.
You could add the invocation of zsh without modifying AD.
echo 'exec zsh' ...
- 16k
3
votes
Accepted
Authentication mechanism to connect to Windows AD in Linux?
sssd and realmd was by far the easiest way to get this done. The below steps are what I did to get my CentOS machine on the domain and able to restrict access to only the specific users in the ...
- 318
3
votes
Setting login shell in SSS configuration for users from Active Directory
This should work with newer versions of sssd:
[sssd]
domains = MYDOMAIN_ADMINS,MYDOMAIN_LIMITED,MYDOMAIN_ALL
config_file_version = 2
services = nss, pam
[nss]
default_shell = /bin/bash
[domain/...
- 4,257
3
votes
Accepted
Setting login shell in SSS configuration for users from Active Directory
Thanks to the sssd maintainers I found the answer. Here's a working config which does what I needed, i.e. allow SSH tunneling but not SSH login to the AD users which are members of the AD LimitedGroup....
- 30.3k
3
votes
Linux clients can't login on samba share while windows and mac can (active directory env)
I found this article which may help you mount the SMB shares.
https://askubuntu.com/questions/1026316/cifs-mounts-and-kerberos-permissions-on-access-or-best-practice
I believe that the issue is ...
- 392
3
votes
Use AD Groups Instead of Linux Groups
chgrp can deal with numeric GIDs as well as symbolic group names. You'll want to be 100% sure that your name-to-name group matchup is exactly correct. Depending on how you attack the problem, it may ...
- 8,322
3
votes
Accepted
How can i list a user's groups when their names contain spaces?
Although groups doesn't appear to have an option to null-delimit entries, id does - at least in the GNU CoreUtils implementation that should apply on Ubuntu 18.041
-z, --zero
delimit ...
- 82.2k
3
votes
SUDO successful for Active Directory admin group member using wrong password
Here is your problem, "the system file was modified to include pam_winbind, and to change the pam_unix module from required to sufficient".
It would be well worth taking the time to read ...
- 120k
3
votes
How can I get the current time as an LDAP timestamp in Unix?
In the terminal:
echo $((($(date +%s) + 11644473600) * 10000000))
Detailed explanation:
date +%s gets the current time in seconds since 1970.
11644473600 seconds elapsed from 1601 to 1970.
10000000 ...
- 131
2
votes
Accepted
Configure SSSD (sudo and dyndns_update) with realmd
Sadly there doesn't seem to be an option to add custom configuration parameters to the sssd.conf file generated by realmd.
I had to adjust the generated config to contain my needed settings after ...
- 423
2
votes
Accepted
Active Directory UID Mapping to Specific Unix UIDs
Winbind/Samba stores the Windows SID ids in a tdb (simple LDAP database) and creates a key pair that matches the translated sid-2-uid. If a user on the Linux side doesn't already exist, it makes up a ...
- 2,653
2
votes
How to debug authentication failures?
In sssd.conf, under your domain block, add a debug_level statement. Debug levels range from 1 to 9, where 1 is the least verbose logging level and 9 is the most verbose. I like to use 6 for ...
- 8,470
2
votes
Join Redhat 7 without prompting the password
I know this post is kind of old, but there is an option available that doesn't necessarily require an AD account with password. Both realm and adcli commands support the --one-time-password argument, ...
- 21
2
votes
Join Redhat 7 without prompting the password
From a Red Hat perspective, you can run the realm join without a password, but it first requires you doing a kinit serviceaccount assuming Kerberos is properly configured. See documentation here. ...
- 785
2
votes
PBIS auth.log requirement "user ingroup nopasswdlogin" not met by user "[email protected]"
I solved the same issue. I had
pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "xxxxxxx"
in an environment with
AD authentification,
...
- 29
Only top scored, non community-wiki answers of a minimum length are eligible