System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

2
votes
0answers
46 views
+50

ipa users cannot sudo on some machines only, including the ipa server

I'm having trouble with freeipa on a few machines. It's been very frustrating to debug so far. Here's the details of the issue; How it manifests: The user can login just fine to any host, but on ...
1
vote
1answer
26 views

SELinux rules in CentOS 7 with Samba and SSSD on Kerberos Ticket generation

I've built a simple File Server with Samba and Netatalk running on CentOS 7.2. Everything is working as expected except for SELinux that's denying Samba to authenticate due to a policy of denying ...
1
vote
2answers
99 views

SSSD Kerberos AD Centos troubleshooting

I followed the Configuration 3 from the RedHat AD integration (https://access.redhat.com/sites/default/files/attachments/rhel-ad-integration-deployment-guidelines-v1.5.pdf); but I am stuck. I am on ...
1
vote
0answers
31 views

Domain User home directory upon first login

I'm having some trouble setting up default files in the user home directory. The setup is a Centos 7, and I've successfully let it join the company's domain and authenticate through our AD. I'm able ...
1
vote
1answer
18 views

FreeIPA AD Trust based Integration using SunLDAP to store Policies

If we want to use the FreeIPA Active Directory Trust Integration Option, can we use an existing implementation of SunLDAP to store the Policies (e.g. sudo, hbac etc.) Essentially we don't to create ...
1
vote
1answer
26 views

Is there a way to configure sudo to not need to lookup group names / or speed up sssd group name resolution?

I've got a large number of Linux hosts that are connected using sssd to a windows active directory domain for user/group lookup. That mostly works fine except for one problem; sudo From what I'...
4
votes
0answers
54 views

Q: RHEL, SSSD, Active Directory

Good afternoon folks. I've been perusing various posts already about getting linux systems to authenticate using AD, but haven't seen anything approaching what I'm beating my head against. There's a ...
1
vote
2answers
39 views

id command is not showing secondary groups

During some days I've been working on a LDAP integration. Now, after configure almost everything that I needed, I came up with this last wall: The need of use secondary groups which are taken from the ...
0
votes
1answer
53 views

How to restrict user access via SSSD AD provider?

I'm trying to configure a Redhat 6.x server for Authorization and Authentication to Active Directory (AD) via SSSD- after joining the server I'm able to login with any valid domain credentials. How ...
4
votes
2answers
190 views

Do Linux servers using AD/Kerberos for authentication/authorization need computer accounts?

I am confused about whether Linux servers using Active Directory (AD) and Kerberos need computer accounts created? Does the Linux server as a machine need to join and AD domain and in doing so have a ...
1
vote
1answer
26 views

Detect SSSD authenticating domain programmatically in multi-domain environment

We have some servers in a mixed RH5/RH6 enthat need to authenticate to one of two LDAP services. This is implemented in SSSD and is running fine. Users from either domain can login successfully and ...
0
votes
1answer
105 views

OpenLDAP/SSSD Automatically Add User to Local Group

I've got a host of servers running various flavors of Linux all setup as OpenLDAP clients via SSSD. I added an LDAP group (sysadmins). I also added a sysadmins group on all of my servers. The members ...
6
votes
1answer
161 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
196 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
2
votes
2answers
570 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...
1
vote
2answers
38 views

How to confirm that IPA+SSSD is using only encrypted channels?

Simply put: I want to ensure that my authentication path is encrypted along the entire path. (e.g. encrypted from laptop->SSH host; from SSH host->authentication server; and from SSH host->other ...
3
votes
2answers
94 views

sssd active directory username same as local user

Hi have a Ubuntu box setup to login to AD. I can login to AD using usernames that do not match local usernames however I have a local username that also exists in AD and I want to be able to login to ...
1
vote
1answer
118 views

sss_cache keeps looking for a LOCAL domain, not purging LDAP records

I've added a user to a group in LDAP. The user shows up in ldapsearch. However, the user does not show up when I list group members on my RHEL instance using getent group my_group. Am I correct in ...
1
vote
2answers
69 views

Issue authenticating to AD-joined Centos 7 server

Using this link, I have set up a server that is properly joined to an Active Directory server, but for some reason I can not authenticate to that server with a kerberos ticket on several test-users ...
7
votes
2answers
496 views

SSSD rejects LDAP login with su: incorrect password

I've set up an LDAP server with user accounts. I've successfully configured a Rails application to authenticate against this LDAP server. I'm now trying to configure SSSD to authenticate against LDAP, ...
1
vote
3answers
1k views

Unable to join domain using samba tool net or realm/sssd

On a rhel7 server I am trying to join the server to a domain, but I am getting the following failure: net ads join -S domain.example.org -U name Enter name's password: Failed to join domain: failed ...
0
votes
2answers
198 views

SSSD for LDAP user authentication only (just bind) on Ubuntu, local databases for uid and groups

Every guide to using SSSD for LDAP authentication I've found thus far shows you how to do more than just authenticate a user, such as provide their shell, groups, etc. I don't know how to remove ...
0
votes
1answer
67 views

Login in Active Directory Domain (Samba 4) and mount -t cifs on debian

I've configured Samba 4 with bind and kerberos to work as an Active Directory authentication server. I've also configured "home share" so I can login to any Windows machine in my Domain and work with ...
1
vote
3answers
40 views

How can I verify which DC my ubuntu server is authenticating to?

I have some intermittent authentication issues on my Ubuntu 15.04 servers. I have asked about this issue directly here: Kerberos encryption type error My Windows DCs are mixed versions for now (we're ...
1
vote
1answer
334 views

Error: KDC has no support for encryption type

I have intermittent authentication issues on my ubuntu 15.04 servers. Periodically, authentication will just stop working. Eventually it will start working again on its own. Or, if I restart both smbd ...
1
vote
1answer
39 views

SSSD - start LDAP-search with logging-in user

Situation today: we've got a functional sssd-config on multiple Ubuntu-clients. This config contains authenticating against a LDAP-server. The SASL-Mech is as "gssapi" specified and uses a krb5-keytab-...
0
votes
1answer
104 views

Windows ACE Does Not Modify Unix ACL

Using a CentOS 7 Samba 4 file server, I am not able to modify "Security" permissions on a directory from the standard windows directory properties dialog. I used realmd to join the CentOS VM to the ...
1
vote
1answer
88 views

Limiting SSH users in LDAP to only one command on an SSH bastion

I have a private network of Centos 7 servers. Each of the servers can only be reached via an SSH bastion. Furthermore, all of these servers use SSSD to authenticate SSH users' keys against an LDAP ...
1
vote
1answer
69 views

Setting shell for SSH directory users on a per-group basis in SSSD

I have a network of Centos 7 machines hosting sshd, each of which is configured to lookup a user's public keys in an LDAP directory for ssh authentication. Furthermore, all ssh users that have access ...
0
votes
0answers
66 views

pam_access nisnetgroup with nested posixgroup

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups + : @hostname-granted : ALL Putting tuples in ldap work for ...
0
votes
0answers
284 views

Users need several tries to SSH to a system

It is taking several attempts for users to SSH to several 64-bit Ubuntu machines which are using sssd to authenticate. The following will happen from 0-6 times in a row before the user is allowed to ...
5
votes
5answers
212 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
583 views

Centos AD Authentication with SSSD, How to add Samba Shares

I've been trying to get this to work reliable for some time. Heres the breakdown: Centos 7 with SSSD auth to Active Directory (fully functional) here is the sssd.conf file: [sssd] domains = example ...
0
votes
0answers
129 views

sudoers file not working

I cannot for the life of me figure out why the sudoers file is not working. Anytime a user tries to login and elevate, they are give the error <name> is not in the sudoers file. This incident ...
0
votes
2answers
130 views

/var/log/secure reporting false positives

I have my CentOS 6 system configured to use sssd with ldap provider. I am able to login and use sudo, however /var/log/secure always reports authentication failure: Sep 18 07:09:52 serverA sudo: ...
0
votes
1answer
1k views

SSSD & LDAP authentication

I’m currently working on deploying openldap and SSSD for authentication. When I try to id a user that is stored within ldap I get the response no such user. The user has been added to LDAP correctly ...
0
votes
1answer
94 views

sssd using remote ad servers instead of local ad servers

I am using sssd to join Redhat servers to a windows server 2008 r2 domain. Most of the time things work fine but I have noticed that sssd is trying to reach remote domain servers instead of being ...
1
vote
1answer
116 views

automate kinit while login using sssd

I'm searching and trying this for a few weeks. What I've done so far: I'm authenticating for login using sssd with ldap. This works actually great! We need to authenticate via sssd with ldap, ...
1
vote
3answers
681 views

SL7.1 (EL7.1) realm discover not discovering

Dabbling with joining an SciLinux 7.1 (EL7.1) box to an AD domain running on windows 2008R2 64bit. Following the Red Hat Enterprise Linux 7 Windows Integration Guide: $ sudo realm discover -v mems....
4
votes
2answers
139 views

rpm2cpio skips files from RPM

These steps are from a box running CentOS 6.5. I merely tried converting a RPM package to a CPIO archive and was surprised to find files listed in the RPM but absent from the archive. Here are the ...
1
vote
1answer
376 views

Sudo Access for Active Directory Groups

I have my Linux machine connected to AD but I am unable to get sudo privileges. I can sign on using AD credentials, but sudo doesn't work. I have looked at everything I can find and everyone says to ...
1
vote
0answers
1k views

Join Ubuntu 14.04 LTS with Active Directory using realm, sssd and adcli

I'm setting up a new network with a Windows 2012 machine running AD DS. I have several Ubuntu 14.04 I want to join in the domain for authentication. I've managed to do so on one of these servers using ...
1
vote
1answer
515 views

How to authenticate to CentOS7 using LDAP if the posixAccount objectClass is unavailable?

Aim: authenticate to CentOS7 using LDAP Problems 1) User cannot be found calling ldap_search_ext with [(&(uid=bla)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][dc=my-...
3
votes
2answers
145 views

List of packages for RH 5.x

I need to install SSSD onto some of my client's servers, but a few of them are pretty old. Is there a list of all of the packages in the repository for a specific release of redhat? Specifically I ...
2
votes
1answer
1k views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
1
vote
0answers
182 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 AD2:...
1
vote
1answer
246 views

Samba4 share permissions not resolving correctly on server

I'm a bit new to Samba4 and using it as an AD DC. I have a functioning server but seem to be having permissions issues. Currently, if I create a folder (from Windows) in a Samba share, the ...
2
votes
2answers
2k views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
1
vote
1answer
236 views

Filter getent passwd output with SSSD

I am using ldap_access_filter in sssd.conf in order to limit access to users that are in a specific ldap group. However, when I do a "getent passwd" I still get a full list of the ldap users. How can ...
1
vote
0answers
2k views

LDAP with SSSD: force user to change password - 'ShadowLastChange' not working

I have CentOS6, with LDAP user authentication, using OpenLDAP and SSSD. I'm trying to force user to change the password. According to this ServerFault question I tried to set ShadowLastChange to 0, ...