System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

3
votes
1answer
64 views

rpm2cpio skips files from RPM

These steps are from a box running CentOS 6.5. I merely tried converting a RPM package to a CPIO archive and was surprised to find files listed in the RPM but absent from the archive. Here are the ...
1
vote
0answers
27 views

Sudo Access for Active Directory Groups

I have my Linux machine connected to AD but I am unable to get sudo privileges. I can sign on using AD credentials, but sudo doesn't work. I have looked at everything I can find and everyone says to ...
0
votes
0answers
51 views

Join Ubuntu 14.04 LTS with Active Directory using realm, sssd and adcli

I'm setting up a new network with a Windows 2012 machine running AD DS. I have several Ubuntu 14.04 I want to join in the domain for authentication. I've managed to do so on one of these servers using ...
1
vote
1answer
37 views

How to authenticate to CentOS7 using LDAP if the posixAccount objectClass is unavailable?

Aim: authenticate to CentOS7 using LDAP Problems 1) User cannot be found calling ldap_search_ext with ...
3
votes
2answers
55 views

List of packages for RH 5.x

I need to install SSSD onto some of my client's servers, but a few of them are pretty old. Is there a list of all of the packages in the repository for a specific release of redhat? Specifically I ...
1
vote
1answer
44 views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
0
votes
0answers
39 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 ...
1
vote
1answer
55 views

Samba4 share permissions not resolving correctly on server

I'm a bit new to Samba4 and using it as an AD DC. I have a functioning server but seem to be having permissions issues. Currently, if I create a folder (from Windows) in a Samba share, the ...
2
votes
1answer
99 views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
1
vote
1answer
59 views

Filter getent passwd output with SSSD

I am using ldap_access_filter in sssd.conf in order to limit access to users that are in a specific ldap group. However, when I do a "getent passwd" I still get a full list of the ldap users. How can ...
1
vote
0answers
180 views

LDAP with SSSD: force user to change password - 'ShadowLastChange' not working

I have CentOS6, with LDAP user authentication, using OpenLDAP and SSSD. I'm trying to force user to change the password. According to this ServerFault question I tried to set ShadowLastChange to 0, ...
2
votes
1answer
71 views

LDAP authentication - avoid duplicate uidNumber

I have just successfully configured OpenLDAP Users authentication in a single CentOS6 box, based on SSSD. Took some time and many trials, but it's working. Now, I want to start adding users. I'm ...
0
votes
1answer
29 views

Creating AD SPNs with realmd/sssd on Cent7

Is it possible to use the system tools provided by realmd/sssd on a CentOS7 system to create and write out service principals for Apache and other servers? Or are we still reliant on other tools, ...
4
votes
4answers
342 views

Which ports are required in order to authenticate against a ldap server in another domain which is behind a firewall?

I have a Linux domain running with sssd, let's call this domain NJ. I'd like machines on the NJ domain to be able to authenticate against an Active Directory ldap server which resides on a different ...
0
votes
2answers
168 views

Linux-SSSD: always getting incorrect password when su'ing to domain users, but why?

I've built a new Linux environment at my work place. I've configured sssd and bound it to one of the Active Directory domains of the company. I can tell that the sssd is partially working, let me ...
0
votes
1answer
153 views

how to translate an Active Directory group into a NIS netgroup?

The goal is to be able to add + : @DL-MyCompany-MyTeam : ALL to /etc/security/access.conf and have it work as expected. This is my sssd.conf: [domain/default] cache_credentials = True [sssd] ...
0
votes
2answers
32 views

Apply changes to PAM changes

Does the server or a specific service needs to be restarted to let changes to pam files (/etc/pam.d/system-auth) take effect? longer version - I'm working on configuring SSSD to connect with LDAP for ...
0
votes
1answer
385 views

'realm join --client-software sssd' on centos-7 joins two realms (one with sssd and one with winbind)

On clean installed centos-7 host: realm join -U foo --client-software sssd AD.EXAMPLE.COM After running realm list output looks initially like this: AD.EXAMPLE.COM type: kerberos realm-name: ...
0
votes
1answer
153 views

ubuntu 12.04 sssd sudo not working

This is for Ubuntu 12.04.5 LTS I am trying to implement SSSD as a client and everything works all right BUT SUDO I cannot see anything happening in the sssd_sudo.log file at all but the usual file ...
2
votes
2answers
187 views

Linux: sssd cache not being cleaned upon server reboot, what could be the cause and how can it be changed?

I'm using sssd in order to work with LDAP users and groups within our Linux environment. I had to rename the LDAP group of one of my Linux users and I noticed that after I finished editing the group, ...
1
vote
1answer
72 views

sssd one ldap server for authentication and one for automounting, is this possible?

Says it all in the title really :) I am looking into SSSD but have a requirement that it must use ldap-1 for user authentication and then get the home directory automount information from ldap-2. ...
1
vote
2answers
295 views

Multiple Domain realmd/sssd Configuration on RHEL7?

I've configured our RHEL7 instance to support Active Directory login integration by using the documentation HERE. This describes using the "realm" command to configure the "sssd" service allowing for ...
3
votes
3answers
183 views

home dir and shell for Active Directory authenticated users

I have successfully configured sssd and can ssh into a system with AD credentials what I am missing is the creation of a home directory and bash set as the shell. My assumption is that if I log on to ...
1
vote
1answer
1k views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
2
votes
5answers
239 views

Pursuit of True Active Directory Integration

Before you laugh at me and say, "If you want Active Directory, use Windows" or tell me to use Google, hear me out. My company relies very heavily on AD. Nay, we are married to it at this point, and ...
5
votes
1answer
160 views

SSSD process won't die

Thanks for taking the time to check out my problem. I'm currently working on an issue that has only appeared once before. Back on Jan 3rd when this first appeared we were able to reboot the server ...
0
votes
0answers
318 views

OpenLDAP client certificate giving “Unable to find the certificate or key necessary for authentication”

Initial setup of system I have an OpenLDAP server running on SLC6.5 and a client running Fedora 20. The server and client are both running OpenLDAP 2.4.39 which is built with Mozilla NSS as its SSL ...
0
votes
2answers
413 views

Make sssd respect Acctive Directory nested groups

I have managed to get sssd working and getent passwd *username* as well as getent group returns AD data. I am now facing a problem with nested groups in Active Directory. In the AD i have supergroup ...
0
votes
1answer
341 views

sssd can't save user. Missing uid

I am trying to sync my Debian server using sssd. When i run the getent passwd username@domain, the user is not returned. The log says it's because i am missing an uid from the ldap lookup. However, i ...
1
vote
3answers
396 views

Linux / AD integration with SSSD: how to choose what systems a user can log into?

We are trying out ActiveDirectory integration on some linux systems with SSSD. So far so good we joined the linux systems to the domain and we can log into linux systems with AD-defined users. Right ...
1
vote
2answers
260 views

vsFTPd authenticating with SSSD

I am currently trying to setup an FTP sever that authenticates through Active Directory using SSSD. My config files are as follows: /etc/vsftpd/vsftpd: [root@StudentOrgFTP vsftpd]# cat vsftpd.conf ...
1
vote
2answers
151 views

SSSD Authentication to Windows Domain without @domain.com everywhere

We're trialling using a Ubuntu 14.04 desktop environment for a few of our developers and I've hooked the machines into the domain with SSSD. This has been working fine. However the system recognises ...
6
votes
1answer
387 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
1
vote
1answer
162 views

Using sssd ldap access filter DENY based on group?

I am currently using sssd.conf to only allow login for ldap users that are in a specific group. I would like to do the opposite and DENY login based on group membership of a user, while allowing all ...
2
votes
0answers
106 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
62 views

How do I use simple_allow_groups with AD groups that have no GID in CENTOS 7

We just built a few test CentOS 7 boxes, and the configuration that we were using for 6.5 is not working for us. As best we can tell, it comes down to using simple_allow_groups and using AD groups ...
1
vote
2answers
2k views

How do i get centos 7 to use uids and gids from active directory?

I'm preparing for an eventual upgrade from CentOS 6 to CentOS 7. Right now, in version 6, we just use LDAP mapped to AD for authentication. This then uses the UID and GID from the Active Directory ...
0
votes
1answer
245 views

389-ds and openldap client setup

I am working towards a proof concept: I have installed 389-dc on centos and enabled ssl via a self-signed certificate. (after a lot of reading) I can see the port 636 is listening on the centos ...
0
votes
1answer
262 views

Can sssd-ldap authenticate non-posix users?

I am migrating a sealed MSA from using pam_ldap to pam_sss (sssd-ldap). However, pam_sss seems to have having trouble authenticating users without uidNumbers. I had thought changing ...
1
vote
3answers
1k views

Is anyone using access.conf and netgroup authentication with sssd?

I want to be able to authenticate users (via ssh) to specific groups of hosts based on the users' LDAP netgroup membership. The LDAP server is dsee7. The distro is OEL 6.5 with openldap as the client. ...
0
votes
1answer
2k views

restrict ssh access to host using sssd and LDAP

I need to restrict ssh access to hosts based on the user's LDAP group membership. I want to do this using sssd's ldap_access_filter feature. Here's my sssd.conf file: [sssd] config_file_version = 2 ...
1
vote
0answers
247 views

need help writing puppet module for sssd.conf using Hiera

I need to build a module to manage /etc/sssd/sssd.conf on our Red Hat VMs. The sssd modules published on the forge don't seem to do what I want, nor do I feel like forking any of them. I want to keep ...
5
votes
4answers
7k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
0
votes
1answer
1k views

CentOS/Redhat: Systemwide aliases when logging in through LDAP/sssd

I've asked this question in the Centos Support forum, but we didn't found a solution for it (https://www.centos.org/forums/viewtopic.php?f=13&t=46101#p196728) When logging in through LDAP/sssd, ...
2
votes
1answer
262 views

Login with Enterprise Principal Name using sssd AD backend in Ubuntu 14.04 LTS

I’m running sssd version 1.11 with the AD backend in Ubuntu 14.04 LTS (1.11.5-1ubuntu3) to authenticate users from Active Directory running on Windows Server 2012 R2, and I’m trying to achieve logins ...
4
votes
1answer
8k views

How to use realmd in Ubuntu 14.04 LTS to join an Active Directory domain?

I want to use realmd to join an Active Directory domain from Ubuntu 14.04 LTS. To do that I just installed realmd and some dependencies with this command: aptitude install realmd sssd sssd-tools ...
3
votes
1answer
1k views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
1
vote
2answers
2k views

Cannot authenticate in Active Directory using security/sssd from FreeBSD ports

I'm trying to implement security/sssd port in a FreeBSD 10.0 system. My main goal is to authenticate users from Active Directory running on Windows Server 2012 R2. I would like to know if anyone had ...
1
vote
0answers
158 views

Groups with local and LDAP users

I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group. How can ...
5
votes
4answers
524 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source based on this question: Managing access to multiple linux system One problem I ran into is that if a ...