System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

0
votes
2answers
13 views

Apply changes to PAM changes

Does the server or a specific service needs to be restarted to let changes to pam files (/etc/pam.d/system-auth) take effect? longer version - I'm working on configuring SSSD to connect with LDAP for ...
0
votes
1answer
17 views

'realm join --client-software sssd' on centos-7 joins two realms (one with sssd and one with winbind)

On clean installed centos-7 host: realm join -U foo --client-software sssd AD.EXAMPLE.COM After running realm list output looks initially like this: AD.EXAMPLE.COM type: kerberos realm-name: ...
0
votes
1answer
20 views

ubuntu 12.04 sssd sudo not working

This is for Ubuntu 12.04.5 LTS I am trying to implement SSSD as a client and everything works all right BUT SUDO I cannot see anything happening in the sssd_sudo.log file at all but the usual file ...
2
votes
2answers
70 views

Linux: sssd cache not being cleaned upon server reboot, what could be the cause and how can it be changed?

I'm using sssd in order to work with LDAP users and groups within our Linux environment. I had to rename the LDAP group of one of my Linux users and I noticed that after I finished editing the group, ...
1
vote
1answer
26 views

sssd one ldap server for authentication and one for automounting, is this possible?

Says it all in the title really :) I am looking into SSSD but have a requirement that it must use ldap-1 for user authentication and then get the home directory automount information from ldap-2. ...
1
vote
2answers
36 views

Multiple Domain realmd/sssd Configuration on RHEL7?

I've configured our RHEL7 instance to support Active Directory login integration by using the documentation HERE. This describes using the "realm" command to configure the "sssd" service allowing for ...
3
votes
3answers
68 views

home dir and shell for Active Directory authenticated users

I have successfully configured sssd and can ssh into a system with AD credentials what I am missing is the creation of a home directory and bash set as the shell. My assumption is that if I log on to ...
2
votes
1answer
146 views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
2
votes
5answers
112 views

Pursuit of True Active Directory Integration

Before you laugh at me and say, "If you want Active Directory, use Windows" or tell me to use Google, hear me out. My company relies very heavily on AD. Nay, we are married to it at this point, and ...
3
votes
0answers
66 views

SSSD process won't die

Thanks for taking the time to check out my problem. I'm currently working on an issue that has only appeared once before. Back on Jan 3rd when this first appeared we were able to reboot the server ...
0
votes
0answers
74 views

OpenLDAP client certificate giving “Unable to find the certificate or key necessary for authentication”

Initial setup of system I have an OpenLDAP server running on SLC6.5 and a client running Fedora 20. The server and client are both running OpenLDAP 2.4.39 which is built with Mozilla NSS as its SSL ...
0
votes
2answers
137 views

Make sssd respect Acctive Directory nested groups

I have managed to get sssd working and getent passwd *username* as well as getent group returns AD data. I am now facing a problem with nested groups in Active Directory. In the AD i have supergroup ...
0
votes
1answer
126 views

sssd can't save user. Missing uid

I am trying to sync my Debian server using sssd. When i run the getent passwd username@domain, the user is not returned. The log says it's because i am missing an uid from the ldap lookup. However, i ...
1
vote
3answers
132 views

Linux / AD integration with SSSD: how to choose what systems a user can log into?

We are trying out ActiveDirectory integration on some linux systems with SSSD. So far so good we joined the linux systems to the domain and we can log into linux systems with AD-defined users. Right ...
1
vote
2answers
97 views

vsFTPd authenticating with SSSD

I am currently trying to setup an FTP sever that authenticates through Active Directory using SSSD. My config files are as follows: /etc/vsftpd/vsftpd: [root@StudentOrgFTP vsftpd]# cat vsftpd.conf ...
0
votes
2answers
91 views

SSSD Authentication to Windows Domain without @domain.com everywhere

We're trialling using a Ubuntu 14.04 desktop environment for a few of our developers and I've hooked the machines into the domain with SSSD. This has been working fine. However the system recognises ...
6
votes
1answer
282 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
1
vote
1answer
101 views

Using sssd ldap access filter DENY based on group?

I am currently using sssd.conf to only allow login for ldap users that are in a specific group. I would like to do the opposite and DENY login based on group membership of a user, while allowing all ...
2
votes
0answers
79 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
42 views

How do I use simple_allow_groups with AD groups that have no GID in CENTOS 7

We just built a few test CentOS 7 boxes, and the configuration that we were using for 6.5 is not working for us. As best we can tell, it comes down to using simple_allow_groups and using AD groups ...
0
votes
2answers
1k views

How do i get centos 7 to use uids and gids from active directory?

I'm preparing for an eventual upgrade from CentOS 6 to CentOS 7. Right now, in version 6, we just use LDAP mapped to AD for authentication. This then uses the UID and GID from the Active Directory ...
0
votes
1answer
194 views

389-ds and openldap client setup

I am working towards a proof concept: I have installed 389-dc on centos and enabled ssl via a self-signed certificate. (after a lot of reading) I can see the port 636 is listening on the centos ...
0
votes
1answer
169 views

Can sssd-ldap authenticate non-posix users?

I am migrating a sealed MSA from using pam_ldap to pam_sss (sssd-ldap). However, pam_sss seems to have having trouble authenticating users without uidNumbers. I had thought changing ...
1
vote
3answers
876 views

Is anyone using access.conf and netgroup authentication with sssd?

I want to be able to authenticate users (via ssh) to specific groups of hosts based on the users' LDAP netgroup membership. The LDAP server is dsee7. The distro is OEL 6.5 with openldap as the client. ...
0
votes
1answer
2k views

restrict ssh access to host using sssd and LDAP

I need to restrict ssh access to hosts based on the user's LDAP group membership. I want to do this using sssd's ldap_access_filter feature. Here's my sssd.conf file: [sssd] config_file_version = 2 ...
1
vote
0answers
201 views

need help writing puppet module for sssd.conf using Hiera

I need to build a module to manage /etc/sssd/sssd.conf on our Red Hat VMs. The sssd modules published on the forge don't seem to do what I want, nor do I feel like forking any of them. I want to keep ...
4
votes
3answers
5k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
0
votes
1answer
1k views

CentOS/Redhat: Systemwide aliases when logging in through LDAP/sssd

I've asked this question in the Centos Support forum, but we didn't found a solution for it (https://www.centos.org/forums/viewtopic.php?f=13&t=46101#p196728) When logging in through LDAP/sssd, ...
2
votes
1answer
220 views

Login with Enterprise Principal Name using sssd AD backend in Ubuntu 14.04 LTS

I’m running sssd version 1.11 with the AD backend in Ubuntu 14.04 LTS (1.11.5-1ubuntu3) to authenticate users from Active Directory running on Windows Server 2012 R2, and I’m trying to achieve logins ...
3
votes
1answer
6k views

How to use realmd in Ubuntu 14.04 LTS to join an Active Directory domain?

I want to use realmd to join an Active Directory domain from Ubuntu 14.04 LTS. To do that I just installed realmd and some dependencies with this command: aptitude install realmd sssd sssd-tools ...
3
votes
1answer
741 views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
1
vote
2answers
2k views

Cannot authenticate in Active Directory using security/sssd from FreeBSD ports

I'm trying to implement security/sssd port in a FreeBSD 10.0 system. My main goal is to authenticate users from Active Directory running on Windows Server 2012 R2. I would like to know if anyone had ...
1
vote
0answers
122 views

Groups with local and LDAP users

I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group. How can ...
4
votes
4answers
367 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system One problem I ran into is that if a user is given local root ...
1
vote
1answer
302 views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...
0
votes
1answer
551 views

Where do I specify the Bind DN and password for sss+ldap?

I'm trying sssd for LDAP authentication, and while it can show user IDs with the id command, getent group and getent passwd do not show LDAP names, and while I can chown files to ldap users, they ls ...
1
vote
1answer
2k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
2answers
2k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
1
vote
2answers
481 views

sssd: Is there a way to force a specific shell for some group members?

The context I'd like to restrict some AD users to a specific script, limiting what they can do on this particular machine. So, instead of connecting them with /bin/bash (for instance), I'd like to ...
0
votes
1answer
888 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
2
votes
2answers
2k views

SSSD ignoring ldap_access_filter

I've setup sssd and LDAP. Users authenticate and login. My problem is that sssd seems to ignore the ldap_access_filter option and allows all users to login. I've examined the logs/debug and pam_sss ...
1
vote
1answer
285 views

Prevent sssd from using ldap to authenticate or id specific users for chef

I'm trying to use chef to add/modify a few local user accounts. For whatever reason there are duplicate accounts in LDAP. Since the system uses sssd/pam/ldap, it sees the user as existing, but is ...
5
votes
2answers
835 views

Overriding Parameters in Previously Declared Puppet Resource

I'm attempting to rebuild nwaller's sssd puppet module to be entirely LDAP based and to be a little cleaner. In it we have a resource defined for each authentication domain of the form define ...
1
vote
4answers
14k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
0
votes
0answers
61 views

Samba Server needs to have AD authentication

My Linux server is connected to AD via Bind DN and password (without domain joining). It is using sssd for authentication. I am able to ssh and login without any issue. I have a proper setup of uid ...
-1
votes
1answer
307 views

What are the dependencies of sssd/nscd to function?

What are the dependencies of sssd to function as an LDAP-client? What are the dependencies of nscd to function as an LDAP-client? Does sssd need openldap to function as an LDAP-client? Does nscd?
2
votes
1answer
317 views

What is LDAP enumeration?

I have been working with implementing LDAP in our servers. We are using SSSD instead of nscd/nslcd to communicate with the LDAP server. One of the options in SSSD is enumeration. Enabling it solved ...
3
votes
3answers
4k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
1answer
435 views

Identity Management for UNIX Password synchronisation gives warning

I installed "Identity Management for UNIX" on win 2008 r2 active directory. I did this because I wanted to have the unix attributes, so I can link linux computers via ldap to the active directory. I ...
0
votes
1answer
943 views

Moving from nslcd to sssd on Red Hat to solve NSS MD5 issue

I have a problem with the latest version of Red Hat, nss/nscd does not accept MD5 certificates. Because of recommendations I am replacing nscd with sssd with this howto ...