System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

1
vote
1answer
14 views

Detect SSSD authenticating domain programmatically in multi-domain environment

We have some servers in a mixed RH5/RH6 enthat need to authenticate to one of two LDAP services. This is implemented in SSSD and is running fine. Users from either domain can login successfully and ...
0
votes
1answer
15 views

OpenLDAP/SSSD Automatically Add User to Local Group

I've got a host of servers running various flavors of Linux all setup as OpenLDAP clients via SSSD. I added an LDAP group (sysadmins). I also added a sysadmins group on all of my servers. The members ...
6
votes
1answer
84 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
76 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
1
vote
0answers
40 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...
1
vote
2answers
26 views

How to confirm that IPA+SSSD is using only encrypted channels?

Simply put: I want to ensure that my authentication path is encrypted along the entire path. (e.g. encrypted from laptop->SSH host; from SSH host->authentication server; and from SSH host->other ...
3
votes
2answers
35 views

sssd active directory username same as local user

Hi have a Ubuntu box setup to login to AD. I can login to AD using usernames that do not match local usernames however I have a local username that also exists in AD and I want to be able to login to ...
1
vote
1answer
44 views

sss_cache keeps looking for a LOCAL domain, not purging LDAP records

I've added a user to a group in LDAP. The user shows up in ldapsearch. However, the user does not show up when I list group members on my RHEL instance using getent group my_group. Am I correct in ...
0
votes
2answers
31 views

Issue authenticating to AD-joined Centos 7 server

Using this link, I have set up a server that is properly joined to an Active Directory server, but for some reason I can not authenticate to that server with a kerberos ticket on several test-users ...
7
votes
2answers
156 views

SSSD rejects LDAP login with su: incorrect password

I've set up an LDAP server with user accounts. I've successfully configured a Rails application to authenticate against this LDAP server. I'm now trying to configure SSSD to authenticate against LDAP, ...
1
vote
2answers
160 views

Unable to join domain using samba tool net or realm/sssd

On a rhel7 server I am trying to join the server to a domain, but I am getting the following failure: net ads join -S domain.example.org -U name Enter name's password: Failed to join domain: failed ...
0
votes
2answers
59 views

SSSD for LDAP user authentication only (just bind) on Ubuntu, local databases for uid and groups

Every guide to using SSSD for LDAP authentication I've found thus far shows you how to do more than just authenticate a user, such as provide their shell, groups, etc. I don't know how to remove ...
0
votes
1answer
36 views

Login in Active Directory Domain (Samba 4) and mount -t cifs on debian

I've configured Samba 4 with bind and kerberos to work as an Active Directory authentication server. I've also configured "home share" so I can login to any Windows machine in my Domain and work with ...
1
vote
3answers
36 views

How can I verify which DC my ubuntu server is authenticating to?

I have some intermittent authentication issues on my Ubuntu 15.04 servers. I have asked about this issue directly here: Kerberos encryption type error My Windows DCs are mixed versions for now (we're ...
1
vote
1answer
160 views

Error: KDC has no support for encryption type

I have intermittent authentication issues on my ubuntu 15.04 servers. Periodically, authentication will just stop working. Eventually it will start working again on its own. Or, if I restart both smbd ...
1
vote
1answer
31 views

SSSD - start LDAP-search with logging-in user

Situation today: we've got a functional sssd-config on multiple Ubuntu-clients. This config contains authenticating against a LDAP-server. The SASL-Mech is as "gssapi" specified and uses a ...
0
votes
1answer
64 views

Windows ACE Does Not Modify Unix ACL

Using a CentOS 7 Samba 4 file server, I am not able to modify "Security" permissions on a directory from the standard windows directory properties dialog. I used realmd to join the CentOS VM to the ...
1
vote
1answer
48 views

Limiting SSH users in LDAP to only one command on an SSH bastion

I have a private network of Centos 7 servers. Each of the servers can only be reached via an SSH bastion. Furthermore, all of these servers use SSSD to authenticate SSH users' keys against an LDAP ...
1
vote
1answer
47 views

Setting shell for SSH directory users on a per-group basis in SSSD

I have a network of Centos 7 machines hosting sshd, each of which is configured to lookup a user's public keys in an LDAP directory for ssh authentication. Furthermore, all ssh users that have access ...
0
votes
0answers
45 views

pam_access nisnetgroup with nested posixgroup

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups + : @hostname-granted : ALL Putting tuples in ldap work for ...
0
votes
0answers
158 views

Users need several tries to SSH to a system

It is taking several attempts for users to SSH to several 64-bit Ubuntu machines which are using sssd to authenticate. The following will happen from 0-6 times in a row before the user is allowed to ...
5
votes
5answers
146 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
327 views

Centos AD Authentication with SSSD, How to add Samba Shares

I've been trying to get this to work reliable for some time. Heres the breakdown: Centos 7 with SSSD auth to Active Directory (fully functional) here is the sssd.conf file: [sssd] domains = example ...
0
votes
0answers
104 views

sudoers file not working

I cannot for the life of me figure out why the sudoers file is not working. Anytime a user tries to login and elevate, they are give the error <name> is not in the sudoers file. This incident ...
0
votes
2answers
97 views

/var/log/secure reporting false positives

I have my CentOS 6 system configured to use sssd with ldap provider. I am able to login and use sudo, however /var/log/secure always reports authentication failure: Sep 18 07:09:52 serverA sudo: ...
0
votes
1answer
493 views

SSSD & LDAP authentication

I’m currently working on deploying openldap and SSSD for authentication. When I try to id a user that is stored within ldap I get the response no such user. The user has been added to LDAP correctly ...
0
votes
1answer
59 views

sssd using remote ad servers instead of local ad servers

I am using sssd to join Redhat servers to a windows server 2008 r2 domain. Most of the time things work fine but I have noticed that sssd is trying to reach remote domain servers instead of being ...
1
vote
1answer
80 views

automate kinit while login using sssd

I'm searching and trying this for a few weeks. What I've done so far: I'm authenticating for login using sssd with ldap. This works actually great! We need to authenticate via sssd with ldap, ...
1
vote
3answers
279 views

SL7.1 (EL7.1) realm discover not discovering

Dabbling with joining an SciLinux 7.1 (EL7.1) box to an AD domain running on windows 2008R2 64bit. Following the Red Hat Enterprise Linux 7 Windows Integration Guide: $ sudo realm discover -v ...
4
votes
2answers
112 views

rpm2cpio skips files from RPM

These steps are from a box running CentOS 6.5. I merely tried converting a RPM package to a CPIO archive and was surprised to find files listed in the RPM but absent from the archive. Here are the ...
1
vote
1answer
208 views

Sudo Access for Active Directory Groups

I have my Linux machine connected to AD but I am unable to get sudo privileges. I can sign on using AD credentials, but sudo doesn't work. I have looked at everything I can find and everyone says to ...
0
votes
0answers
604 views

Join Ubuntu 14.04 LTS with Active Directory using realm, sssd and adcli

I'm setting up a new network with a Windows 2012 machine running AD DS. I have several Ubuntu 14.04 I want to join in the domain for authentication. I've managed to do so on one of these servers using ...
1
vote
1answer
282 views

How to authenticate to CentOS7 using LDAP if the posixAccount objectClass is unavailable?

Aim: authenticate to CentOS7 using LDAP Problems 1) User cannot be found calling ldap_search_ext with ...
3
votes
2answers
100 views

List of packages for RH 5.x

I need to install SSSD onto some of my client's servers, but a few of them are pretty old. Is there a list of all of the packages in the repository for a specific release of redhat? Specifically I ...
2
votes
1answer
483 views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
1
vote
0answers
125 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 ...
1
vote
1answer
169 views

Samba4 share permissions not resolving correctly on server

I'm a bit new to Samba4 and using it as an AD DC. I have a functioning server but seem to be having permissions issues. Currently, if I create a folder (from Windows) in a Samba share, the ...
2
votes
2answers
1k views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
1
vote
1answer
154 views

Filter getent passwd output with SSSD

I am using ldap_access_filter in sssd.conf in order to limit access to users that are in a specific ldap group. However, when I do a "getent passwd" I still get a full list of the ldap users. How can ...
1
vote
0answers
1k views

LDAP with SSSD: force user to change password - 'ShadowLastChange' not working

I have CentOS6, with LDAP user authentication, using OpenLDAP and SSSD. I'm trying to force user to change the password. According to this ServerFault question I tried to set ShadowLastChange to 0, ...
2
votes
1answer
246 views

LDAP authentication - avoid duplicate uidNumber

I have just successfully configured OpenLDAP Users authentication in a single CentOS6 box, based on SSSD. Took some time and many trials, but it's working. Now, I want to start adding users. I'm ...
0
votes
1answer
65 views

Creating AD SPNs with realmd/sssd on Cent7

Is it possible to use the system tools provided by realmd/sssd on a CentOS7 system to create and write out service principals for Apache and other servers? Or are we still reliant on other tools, ...
4
votes
4answers
1k views

Which ports are required in order to authenticate against a ldap server in another domain which is behind a firewall?

I have a Linux domain running with sssd, let's call this domain NJ. I'd like machines on the NJ domain to be able to authenticate against an Active Directory ldap server which resides on a different ...
1
vote
2answers
626 views

Linux-SSSD: always getting incorrect password when su'ing to domain users, but why?

I've built a new Linux environment at my work place. I've configured sssd and bound it to one of the Active Directory domains of the company. I can tell that the sssd is partially working, let me ...
0
votes
1answer
333 views

how to translate an Active Directory group into a NIS netgroup?

The goal is to be able to add + : @DL-MyCompany-MyTeam : ALL to /etc/security/access.conf and have it work as expected. This is my sssd.conf: [domain/default] cache_credentials = True [sssd] ...
0
votes
2answers
67 views

Apply changes to PAM changes

Does the server or a specific service needs to be restarted to let changes to pam files (/etc/pam.d/system-auth) take effect? longer version - I'm working on configuring SSSD to connect with LDAP for ...
0
votes
1answer
989 views

'realm join --client-software sssd' on centos-7 joins two realms (one with sssd and one with winbind)

On clean installed centos-7 host: realm join -U foo --client-software sssd AD.EXAMPLE.COM After running realm list output looks initially like this: AD.EXAMPLE.COM type: kerberos realm-name: ...
0
votes
1answer
440 views

ubuntu 12.04 sssd sudo not working

This is for Ubuntu 12.04.5 LTS I am trying to implement SSSD as a client and everything works all right BUT SUDO I cannot see anything happening in the sssd_sudo.log file at all but the usual file ...
3
votes
2answers
711 views

Linux: sssd cache not being cleaned upon server reboot, what could be the cause and how can it be changed?

I'm using sssd in order to work with LDAP users and groups within our Linux environment. I had to rename the LDAP group of one of my Linux users and I noticed that after I finished editing the group, ...
1
vote
1answer
138 views

sssd one ldap server for authentication and one for automounting, is this possible?

Says it all in the title really :) I am looking into SSSD but have a requirement that it must use ldap-1 for user authentication and then get the home directory automount information from ldap-2. ...