System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

1
vote
1answer
18 views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
2
votes
5answers
70 views

Pursuit of True Active Directory Integration

Before you laugh at me and say, "If you want Active Directory, use Windows" or tell me to use Google, hear me out. My company relies very heavily on AD. Nay, we are married to it at this point, and ...
3
votes
0answers
47 views

SSSD process won't die

Thanks for taking the time to check out my problem. I'm currently working on an issue that has only appeared once before. Back on Jan 3rd when this first appeared we were able to reboot the server ...
0
votes
0answers
35 views

OpenLDAP client certificate giving “Unable to find the certificate or key necessary for authentication”

Initial setup of system I have an OpenLDAP server running on SLC6.5 and a client running Fedora 20. The server and client are both running OpenLDAP 2.4.39 which is built with Mozilla NSS as its SSL ...
0
votes
2answers
77 views

Make sssd respect Acctive Directory nested groups

I have managed to get sssd working and getent passwd *username* as well as getent group returns AD data. I am now facing a problem with nested groups in Active Directory. In the AD i have supergroup ...
0
votes
1answer
80 views

sssd can't save user. Missing uid

I am trying to sync my Debian server using sssd. When i run the getent passwd username@domain, the user is not returned. The log says it's because i am missing an uid from the ldap lookup. However, i ...
1
vote
3answers
85 views

Linux / AD integration with SSSD: how to choose what systems a user can log into?

We are trying out ActiveDirectory integration on some linux systems with SSSD. So far so good we joined the linux systems to the domain and we can log into linux systems with AD-defined users. Right ...
0
votes
2answers
56 views

vsFTPd authenticating with SSSD

I am currently trying to setup an FTP sever that authenticates through Active Directory using SSSD. My config files are as follows: /etc/vsftpd/vsftpd: [root@StudentOrgFTP vsftpd]# cat vsftpd.conf ...
0
votes
2answers
71 views

SSSD Authentication to Windows Domain without @domain.com everywhere

We're trialling using a Ubuntu 14.04 desktop environment for a few of our developers and I've hooked the machines into the domain with SSSD. This has been working fine. However the system recognises ...
6
votes
1answer
234 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
1
vote
1answer
74 views

Using sssd ldap access filter DENY based on group?

I am currently using sssd.conf to only allow login for ldap users that are in a specific group. I would like to do the opposite and DENY login based on group membership of a user, while allowing all ...
2
votes
0answers
60 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
32 views

How do I use simple_allow_groups with AD groups that have no GID in CENTOS 7

We just built a few test CentOS 7 boxes, and the configuration that we were using for 6.5 is not working for us. As best we can tell, it comes down to using simple_allow_groups and using AD groups ...
0
votes
2answers
903 views

How do i get centos 7 to use uids and gids from active directory?

I'm preparing for an eventual upgrade from CentOS 6 to CentOS 7. Right now, in version 6, we just use LDAP mapped to AD for authentication. This then uses the UID and GID from the Active Directory ...
0
votes
1answer
176 views

389-ds and openldap client setup

I am working towards a proof concept: I have installed 389-dc on centos and enabled ssl via a self-signed certificate. (after a lot of reading) I can see the port 636 is listening on the centos ...
0
votes
1answer
145 views

Can sssd-ldap authenticate non-posix users?

I am migrating a sealed MSA from using pam_ldap to pam_sss (sssd-ldap). However, pam_sss seems to have having trouble authenticating users without uidNumbers. I had thought changing ...
1
vote
3answers
724 views

Is anyone using access.conf and netgroup authentication with sssd?

I want to be able to authenticate users (via ssh) to specific groups of hosts based on the users' LDAP netgroup membership. The LDAP server is dsee7. The distro is OEL 6.5 with openldap as the client. ...
0
votes
1answer
1k views

restrict ssh access to host using sssd and LDAP

I need to restrict ssh access to hosts based on the user's LDAP group membership. I want to do this using sssd's ldap_access_filter feature. Here's my sssd.conf file: [sssd] config_file_version = 2 ...
1
vote
0answers
184 views

need help writing puppet module for sssd.conf using Hiera

I need to build a module to manage /etc/sssd/sssd.conf on our Red Hat VMs. The sssd modules published on the forge don't seem to do what I want, nor do I feel like forking any of them. I want to keep ...
4
votes
3answers
4k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
0
votes
1answer
1k views

CentOS/Redhat: Systemwide aliases when logging in through LDAP/sssd

I've asked this question in the Centos Support forum, but we didn't found a solution for it (https://www.centos.org/forums/viewtopic.php?f=13&t=46101#p196728) When logging in through LDAP/sssd, ...
2
votes
1answer
208 views

Login with Enterprise Principal Name using sssd AD backend in Ubuntu 14.04 LTS

I’m running sssd version 1.11 with the AD backend in Ubuntu 14.04 LTS (1.11.5-1ubuntu3) to authenticate users from Active Directory running on Windows Server 2012 R2, and I’m trying to achieve logins ...
3
votes
1answer
6k views

How to use realmd in Ubuntu 14.04 LTS to join an Active Directory domain?

I want to use realmd to join an Active Directory domain from Ubuntu 14.04 LTS. To do that I just installed realmd and some dependencies with this command: aptitude install realmd sssd sssd-tools ...
3
votes
1answer
644 views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
1
vote
2answers
1k views

Cannot authenticate in Active Directory using security/sssd from FreeBSD ports

I'm trying to implement security/sssd port in a FreeBSD 10.0 system. My main goal is to authenticate users from Active Directory running on Windows Server 2012 R2. I would like to know if anyone had ...
1
vote
0answers
111 views

Groups with local and LDAP users

I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group. How can ...
4
votes
4answers
323 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system One problem I ran into is that if a user is given local root ...
1
vote
1answer
275 views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...
0
votes
1answer
456 views

Where do I specify the Bind DN and password for sss+ldap?

I'm trying sssd for LDAP authentication, and while it can show user IDs with the id command, getent group and getent passwd do not show LDAP names, and while I can chown files to ldap users, they ls ...
0
votes
1answer
1k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
2answers
1k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
1
vote
2answers
428 views

sssd: Is there a way to force a specific shell for some group members?

The context I'd like to restrict some AD users to a specific script, limiting what they can do on this particular machine. So, instead of connecting them with /bin/bash (for instance), I'd like to ...
0
votes
1answer
804 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
2
votes
2answers
2k views

SSSD ignoring ldap_access_filter

I've setup sssd and LDAP. Users authenticate and login. My problem is that sssd seems to ignore the ldap_access_filter option and allows all users to login. I've examined the logs/debug and pam_sss ...
1
vote
1answer
250 views

Prevent sssd from using ldap to authenticate or id specific users for chef

I'm trying to use chef to add/modify a few local user accounts. For whatever reason there are duplicate accounts in LDAP. Since the system uses sssd/pam/ldap, it sees the user as existing, but is ...
5
votes
2answers
743 views

Overriding Parameters in Previously Declared Puppet Resource

I'm attempting to rebuild nwaller's sssd puppet module to be entirely LDAP based and to be a little cleaner. In it we have a resource defined for each authentication domain of the form define ...
1
vote
4answers
12k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
0
votes
0answers
61 views

Samba Server needs to have AD authentication

My Linux server is connected to AD via Bind DN and password (without domain joining). It is using sssd for authentication. I am able to ssh and login without any issue. I have a proper setup of uid ...
-1
votes
1answer
288 views

What are the dependencies of sssd/nscd to function?

What are the dependencies of sssd to function as an LDAP-client? What are the dependencies of nscd to function as an LDAP-client? Does sssd need openldap to function as an LDAP-client? Does nscd?
2
votes
1answer
294 views

What is LDAP enumeration?

I have been working with implementing LDAP in our servers. We are using SSSD instead of nscd/nslcd to communicate with the LDAP server. One of the options in SSSD is enumeration. Enabling it solved ...
3
votes
3answers
4k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
1answer
409 views

Identity Management for UNIX Password synchronisation gives warning

I installed "Identity Management for UNIX" on win 2008 r2 active directory. I did this because I wanted to have the unix attributes, so I can link linux computers via ldap to the active directory. I ...
0
votes
1answer
879 views

Moving from nslcd to sssd on Red Hat to solve NSS MD5 issue

I have a problem with the latest version of Red Hat, nss/nscd does not accept MD5 certificates. Because of recommendations I am replacing nscd with sssd with this howto ...
0
votes
2answers
3k views

Can't add local user on system using ldap auth for samba [closed]

Trying to add a local user to a CentOS 6.3 system that is using ldap for Samba authentication, but being stymied by the user's existing entry in ldap. [root@samba ~]# adduser wchandy adduser: user ...
9
votes
3answers
561 views

IPA dynamic DNS updates only the AAAA record. Where are my A records?

I'm setting up a FreeIPA domain. In my lab are three virtual machines: the domain controller ipadc1, and two clients puppet and wordpress (creative, yes, I know). All three VMs are running freshly ...
1
vote
1answer
219 views

linux ldap authentication set gid to uid

I'm setting up ldap authentication with sssd for a linux server. everything works fine. however, the users from the ldap server have a default group User. which is, uid=10001 (larry), gid= 20001 ...
1
vote
1answer
2k views

CentOS 6 SSSD SSH/Console Login Issues

I'm new to SSSD but I think I've configured it correctly considering id {ldap user} returns the expected uid and gid values for multiple test users. I'm using two CentOS 6.4 servers as test machines. ...
0
votes
1answer
494 views

CentOS 6.4 SSSD + GDM problems

I'm having an issue where using SSSD it will not bring up a full desktop when using GDM. It seems to get to where it appears to be loading the desktop, then X crashes/stops then reloads GDM. If i ...
3
votes
2answers
4k views

sssd and ldap authentication cache

On our box running OpenSUSE 12.2 we have installed OpenLDAP and sssd daemon. We are using these two services for user authentication. Recently we created a script which creates new web-users for our ...
3
votes
1answer
283 views

What to do when local usernames conflict with network usernames

We use Puppet to manage our Linux desktop machines and SSSD to authenticate our users against a central authentication system. Recently when setting up a few new machines we found that puppet was ...