2

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access.

The only issue is, authentication won't succeed unless there's a matching local user. For instance, if I attempt to login as [email protected]@xx.xxx.xxx.xx, it will accept my password and I will watch the auth.log confirm my kerberos authentication and then reject me due to a failure to find me in the /etc/shadow.

Then, if I run a sudo adduser wboynton on the remote machine and try logging in remotely the same way as before, it will succeed.

I looked around and found one suggestion on the internet to write a pam_script script which would create a user before testing auth on each kerberized login attempt, if it does not already exist. That seems kludgy to me, though. I haven't, as of yet, been able to track down a solid way to designate Kerberos as an authority and bypass /etc/passwd and /etc/shadow entirely. Does such a system exist?

Thanks!

5
  • 4
    Configure it to not only use the Kerberos part of AD, but the LDAP part as user database as well.
    – Sven
    Apr 13, 2016 at 17:24
  • Linux systems require the account attributes from /etc/passwd (uidnumber, home dir etc) to log in or run processes. As suggested, either pull them from AD via ldap or use something like sssd/samba to generate them.
    – Andy
    Apr 13, 2016 at 17:56
  • @Andy. Not necessarily. There is /etc/nsswitch.confwhich tells system where to find users.
    – Jakuje
    Apr 13, 2016 at 18:19
  • @Jakue - as usual, my response was poorly worded. Wherever a user is found, those attributes must be populated or generated for the OS to recognise it.
    – Andy
    Apr 13, 2016 at 18:46
  • 1
    Or put more simply, the user has to be in the passwd database, wherever NSS is getting it from. :P Remember, PAM is optional, but these databases are required. You can't have a user on a UNIX system without something defining what their UID is.
    – Andrew B
    Apr 13, 2016 at 20:15

0

You must log in to answer this question.

Browse other questions tagged .