9 votes
Accepted

Set default shell as bash for users not in /etc/passwd

Using PBIS you can define the default shell for all users: #/opt/pbis/bin/config LoginShellTemplate /bin/bash This as to be done as root, there is no possibility to change this setting by user or as ...
LilloX's user avatar
  • 1,226
8 votes
Accepted

Linux commands to add an Active Directory group in Sudoers file

Note: Messing with the sudoers file has some risk. Before starting, things to think about include: System backups A physical root shell (in a properly configured ssh environment root should be dis-...
John's user avatar
  • 1,200
8 votes
Accepted

Assignment of UID and GID from Active Directory

AD mapping in SSSD is determined using an algorithm (probably a hash function) in the daemon itself: because it's built-in, if you keep the defaults the same, every computer using SSSD should map the ...
ErikF's user avatar
  • 4,007
6 votes
Accepted

What happens if a users default shell is not installed?

Let's try! Shell changed on the server: [myserver ~]% getent passwd myuser myuser:x:150:150:myuser:/home/myuser:/foo Let's log in: [myclient ~]% ssh myserver Received disconnect from myserver: 2: ...
jayhendren's user avatar
  • 8,354
6 votes
Accepted

sudo is not working on my Centos 7.3

The problem here is that when you joined your CentOS system to the Active Directory domain, the realm command also modified /etc/nsswitch.conf to take over the configuration of sudo: grep sudo /etc/...
Chris Davies's user avatar
4 votes

Configure SSSD (sudo and dyndns_update) with realmd

If you want Active Directory to manage sudoers, you have to load a specialized schema into AD and then create your rules using a tool like ADSI Edit. This walkthrough worked for me on Ubuntu 14.04. ...
claytond's user avatar
  • 161
4 votes

Join Redhat 7 without prompting the password

RE: There is not a workaround on the Red Hat side to get around someone entering a password either before or during the realm join. There is always a work around in Linux/Unix: echo $passwd| realm ...
Isaac's user avatar
  • 41
4 votes
Accepted

Mapping AD groups to Linux groups - sssd and Windows server 2016

First, only the management console was removed from WS2016, but the UNIX schema is still there, I think it should still be accessible with e.g. ADSI edit. So you can still use the POSIX attributes, it'...
jhrozek's user avatar
  • 301
4 votes
Accepted

How nsswitch call sssd for credential?

Have a look into Anatomy of SSSD user lookup for an overview of the lookup process or Troubleshooting Guide for how to get logs to see what might be wrong in the daemon. For quick reference, you may ...
jhrozek's user avatar
  • 301
4 votes
Accepted

What must be added to nsswitch.conf to show AD users and groups?

As suggested by @Doug O'Neal in a comment, it was necessary to set enumerate = true in /etc/sssd/sssd.conf. Now getent passwd and getent group show all users and groups defined in the AD. Note ...
dr_'s user avatar
  • 29.4k
4 votes
Accepted

sssd and Active Directory user does not exist in CentOS

Finally I followed these instructions and suddenly it started working, its weird I still dont understand fully what was wrong: Manually Connecting an SSSD Client to an Active Directory Domain https://...
ebeb's user avatar
  • 199
4 votes

Allowing Active Directory groups to sudo on Ubuntu 20.04

I'm not doing this on Ubuntu, so I don't know if there is something special there, but in CentOS I don't have to specify the domain in sudoers, so the syntax I use is: %domain_group ALL=(ALL) ...
devons's user avatar
  • 41
4 votes
Accepted

How to troubleshoot a LDAP error 53 (WILL_NOT_PERFORM)?

The error you are encountering is coming from the Active Directory server itself. So the verbose error message, if it exists, is likely to be in the "Event Log" on the Active Directory ...
Philip Couling's user avatar
3 votes

What happens if a users default shell is not installed?

There is no fallback. There would be an error message such as... Cannot execute /does/not/exist: No such file or directory. You could add the invocation of zsh without modifying AD. echo 'exec zsh' ...
Christopher's user avatar
  • 15.9k
3 votes
Accepted

Every AD SSH login starts with a failure in audit.log

By default, the OpenSSH client will attempt Public Key authentication if you have previously created keys. My guess is that if you do ls ${HOME}/.ssh/ you'll see a keypair - id_rsa and id_rsa.pub. ...
Liczyrzepa's user avatar
3 votes
Accepted

Linux and Azure AD sync possible?

I don't believe there is a tool "right now" that will allow you to synchronise accounts from a Samba DC to Azure Active Directory. You should be able to set up your spare Windows Server as a secondary ...
Chris Davies's user avatar
3 votes
Accepted

Authentication mechanism to connect to Windows AD in Linux?

sssd and realmd was by far the easiest way to get this done. The below steps are what I did to get my CentOS machine on the domain and able to restrict access to only the specific users in the ...
Govna's user avatar
  • 318
3 votes

Setting login shell in SSS configuration for users from Active Directory

This should work with newer versions of sssd: [sssd] domains = MYDOMAIN_ADMINS,MYDOMAIN_LIMITED,MYDOMAIN_ALL config_file_version = 2 services = nss, pam [nss] default_shell = /bin/bash [domain/...
Christophe Drevet's user avatar
3 votes
Accepted

Setting login shell in SSS configuration for users from Active Directory

Thanks to the sssd maintainers I found the answer. Here's a working config which does what I needed, i.e. allow SSH tunneling but not SSH login to the AD users which are members of the AD LimitedGroup....
dr_'s user avatar
  • 29.4k
3 votes

Linux clients can't login on samba share while windows and mac can (active directory env)

I found this article which may help you mount the SMB shares. https://askubuntu.com/questions/1026316/cifs-mounts-and-kerberos-permissions-on-access-or-best-practice I believe that the issue is ...
Gordster's user avatar
  • 392
3 votes

Use AD Groups Instead of Linux Groups

chgrp can deal with numeric GIDs as well as symbolic group names. You'll want to be 100% sure that your name-to-name group matchup is exactly correct. Depending on how you attack the problem, it may ...
Jim L.'s user avatar
  • 7,922
3 votes
Accepted

How can i list a user's groups when their names contain spaces?

Although groups doesn't appear to have an option to null-delimit entries, id does - at least in the GNU CoreUtils implementation that should apply on Ubuntu 18.041 -z, --zero delimit ...
steeldriver's user avatar
  • 80.7k
3 votes

SUDO successful for Active Directory admin group member using wrong password

Here is your problem, "the system file was modified to include pam_winbind, and to change the pam_unix module from required to sufficient". It would be well worth taking the time to read ...
Chris Davies's user avatar
3 votes

Is it possible to have a local user with the same name as a domain user

If you are using sssd to authenticate with your AD, then users are created with a domain in the name by default. This is controlled by default_domain_suffix in sssd.conf. Normally, I would add my ...
Stewart's user avatar
  • 13.5k
3 votes

How can I get the current time as an LDAP timestamp in Unix?

In the terminal: echo $((($(date +%s) + 11644473600) * 10000000)) Detailed explanation: date +%s gets the current time in seconds since 1970. 11644473600 seconds elapsed from 1601 to 1970. 10000000 ...
BennyMcBenBen's user avatar
2 votes
Accepted

changes to domain group membership not showing for user in SLES 11 SP3

The issue is a timeout. Linux is caching the group memberships and not renewing them until the timeout expires. It's super annoying. The even more annoying part is that the only way I've found to ...
David King's user avatar
  • 3,147
2 votes
Accepted

Active Directory UID Mapping to Specific Unix UIDs

Winbind/Samba stores the Windows SID ids in a tdb (simple LDAP database) and creates a key pair that matches the translated sid-2-uid. If a user on the Linux side doesn't already exist, it makes up a ...
Jeight's user avatar
  • 2,603
2 votes

Can a Linux server that authenticates against an Active Directory accept public/private keys for passwordless login?

Yes, you can require both kerberos and public key authentication with AuthenticationMethods sshd option. man 5 sshd_config: AuthenticationMethods Specifies the authentication methods that ...
olmstad's user avatar
  • 198
2 votes
Accepted

Generating a keytab for Active Directory user?

See Creating Kerberos Keytab Files Compatible with Active Directory. On windows host: ktpass /princ [email protected] /pass password /ptype KRB5_NT_PRINCIPAL /out username.keytab Kinit using ...
olmstad's user avatar
  • 198

Only top scored, non community-wiki answers of a minimum length are eligible