System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

0
votes
0answers
21 views

SSSD Authentication to Windows Domain without @domain.com everywhere

We're trialling using a Ubuntu 14.04 desktop environment for a few of our developers and I've hooked the machines into the domain with SSSD. This has been working fine. However the system recognises ...
4
votes
0answers
114 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
1
vote
1answer
33 views

Using sssd ldap access filter DENY based on group?

I am currently using sssd.conf to only allow login for ldap users that are in a specific group. I would like to do the opposite and DENY login based on group membership of a user, while allowing all ...
2
votes
0answers
31 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
21 views

How do I use simple_allow_groups with AD groups that have no GID in CENTOS 7

We just built a few test CentOS 7 boxes, and the configuration that we were using for 6.5 is not working for us. As best we can tell, it comes down to using simple_allow_groups and using AD groups ...
0
votes
1answer
390 views

How do i get centos 7 to use uids and gids from active directory?

I'm preparing for an eventual upgrade from CentOS 6 to CentOS 7. Right now, in version 6, we just use LDAP mapped to AD for authentication. This then uses the UID and GID from the Active Directory ...
0
votes
1answer
126 views

389-ds and openldap client setup

I am working towards a proof concept: I have installed 389-dc on centos and enabled ssl via a self-signed certificate. (after a lot of reading) I can see the port 636 is listening on the centos ...
0
votes
0answers
85 views

Can sssd-ldap authenticate non-posix users?

I am migrating a sealed MSA from using pam_ldap to pam_sss (sssd-ldap). However, pam_sss seems to have having trouble authenticating users without uidNumbers. I had thought changing ...
1
vote
2answers
457 views

Is anyone using access.conf and netgroup authentication with sssd?

I want to be able to authenticate users (via ssh) to specific groups of hosts based on the users' LDAP netgroup membership. The LDAP server is dsee7. The distro is OEL 6.5 with openldap as the client. ...
0
votes
1answer
895 views

restrict ssh access to host using sssd and LDAP

I need to restrict ssh access to hosts based on the user's LDAP group membership. I want to do this using sssd's ldap_access_filter feature. Here's my sssd.conf file: [sssd] config_file_version = 2 ...
1
vote
0answers
148 views

need help writing puppet module for sssd.conf using Hiera

I need to build a module to manage /etc/sssd/sssd.conf on our Red Hat VMs. The sssd modules published on the forge don't seem to do what I want, nor do I feel like forking any of them. I want to keep ...
4
votes
3answers
3k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
0
votes
1answer
709 views

CentOS/Redhat: Systemwide aliases when logging in through LDAP/sssd

I've asked this question in the Centos Support forum, but we didn't found a solution for it (https://www.centos.org/forums/viewtopic.php?f=13&t=46101#p196728) When logging in through LDAP/sssd, ...
2
votes
1answer
189 views

Login with Enterprise Principal Name using sssd AD backend in Ubuntu 14.04 LTS

I’m running sssd version 1.11 with the AD backend in Ubuntu 14.04 LTS (1.11.5-1ubuntu3) to authenticate users from Active Directory running on Windows Server 2012 R2, and I’m trying to achieve logins ...
3
votes
1answer
5k views

How to use realmd in Ubuntu 14.04 LTS to join an Active Directory domain?

I want to use realmd to join an Active Directory domain from Ubuntu 14.04 LTS. To do that I just installed realmd and some dependencies with this command: aptitude install realmd sssd sssd-tools ...
3
votes
1answer
469 views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
1
vote
2answers
968 views

Cannot authenticate in Active Directory using security/sssd from FreeBSD ports

I'm trying to implement security/sssd port in a FreeBSD 10.0 system. My main goal is to authenticate users from Active Directory running on Windows Server 2012 R2. I would like to know if anyone had ...
1
vote
0answers
96 views

Groups with local and LDAP users

I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group. How can ...
4
votes
3answers
264 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system One problem I ran into is that if a user is given local root ...
1
vote
1answer
200 views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...
0
votes
1answer
276 views

Where do I specify the Bind DN and password for sss+ldap?

I'm trying sssd for LDAP authentication, and while it can show user IDs with the id command, getent group and getent passwd do not show LDAP names, and while I can chown files to ldap users, they ls ...
0
votes
1answer
947 views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
2answers
926 views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
1
vote
2answers
335 views

sssd: Is there a way to force a specific shell for some group members?

The context I'd like to restrict some AD users to a specific script, limiting what they can do on this particular machine. So, instead of connecting them with /bin/bash (for instance), I'd like to ...
0
votes
1answer
638 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
2
votes
2answers
1k views

SSSD ignoring ldap_access_filter

I've setup sssd and LDAP. Users authenticate and login. My problem is that sssd seems to ignore the ldap_access_filter option and allows all users to login. I've examined the logs/debug and pam_sss ...
1
vote
1answer
188 views

Prevent sssd from using ldap to authenticate or id specific users for chef

I'm trying to use chef to add/modify a few local user accounts. For whatever reason there are duplicate accounts in LDAP. Since the system uses sssd/pam/ldap, it sees the user as existing, but is ...
5
votes
2answers
565 views

Overriding Parameters in Previously Declared Puppet Resource

I'm attempting to rebuild nwaller's sssd puppet module to be entirely LDAP based and to be a little cleaner. In it we have a resource defined for each authentication domain of the form define ...
1
vote
2answers
10k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
0
votes
0answers
58 views

Samba Server needs to have AD authentication

My Linux server is connected to AD via Bind DN and password (without domain joining). It is using sssd for authentication. I am able to ssh and login without any issue. I have a proper setup of uid ...
-1
votes
1answer
247 views

What are the dependencies of sssd/nscd to function?

What are the dependencies of sssd to function as an LDAP-client? What are the dependencies of nscd to function as an LDAP-client? Does sssd need openldap to function as an LDAP-client? Does nscd?
2
votes
1answer
240 views

What is LDAP enumeration?

I have been working with implementing LDAP in our servers. We are using SSSD instead of nscd/nslcd to communicate with the LDAP server. One of the options in SSSD is enumeration. Enabling it solved ...
2
votes
3answers
3k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
1answer
361 views

Identity Management for UNIX Password synchronisation gives warning

I installed "Identity Management for UNIX" on win 2008 r2 active directory. I did this because I wanted to have the unix attributes, so I can link linux computers via ldap to the active directory. I ...
0
votes
1answer
757 views

Moving from nslcd to sssd on Red Hat to solve NSS MD5 issue

I have a problem with the latest version of Red Hat, nss/nscd does not accept MD5 certificates. Because of recommendations I am replacing nscd with sssd with this howto ...
0
votes
2answers
2k views

Can't add local user on system using ldap auth for samba [closed]

Trying to add a local user to a CentOS 6.3 system that is using ldap for Samba authentication, but being stymied by the user's existing entry in ldap. [root@samba ~]# adduser wchandy adduser: user ...
9
votes
3answers
511 views

IPA dynamic DNS updates only the AAAA record. Where are my A records?

I'm setting up a FreeIPA domain. In my lab are three virtual machines: the domain controller ipadc1, and two clients puppet and wordpress (creative, yes, I know). All three VMs are running freshly ...
1
vote
1answer
200 views

linux ldap authentication set gid to uid

I'm setting up ldap authentication with sssd for a linux server. everything works fine. however, the users from the ldap server have a default group User. which is, uid=10001 (larry), gid= 20001 ...
1
vote
1answer
2k views

CentOS 6 SSSD SSH/Console Login Issues

I'm new to SSSD but I think I've configured it correctly considering id {ldap user} returns the expected uid and gid values for multiple test users. I'm using two CentOS 6.4 servers as test machines. ...
0
votes
1answer
441 views

CentOS 6.4 SSSD + GDM problems

I'm having an issue where using SSSD it will not bring up a full desktop when using GDM. It seems to get to where it appears to be loading the desktop, then X crashes/stops then reloads GDM. If i ...
3
votes
2answers
3k views

sssd and ldap authentication cache

On our box running OpenSUSE 12.2 we have installed OpenLDAP and sssd daemon. We are using these two services for user authentication. Recently we created a script which creates new web-users for our ...
3
votes
1answer
255 views

What to do when local usernames conflict with network usernames

We use Puppet to manage our Linux desktop machines and SSSD to authenticate our users against a central authentication system. Recently when setting up a few new machines we found that puppet was ...
0
votes
1answer
185 views

Fedora 389 ds sasl mapping issue?

I have a fedora client that is authenticating to a centos server running 389 ds and kerberos I can run kinit <my-user-principal> on the fedora client successfully and get a ticket, but no ...
0
votes
1answer
4k views

LDAP Client Authentication using SSSD: Groups issue

I have been able to setup 389 LDAP server and SSSD client authentication. However, whenever I login using ldap user after each login it displays the error ttt@dsl's password: Last login: Thu Dec 6 ...
2
votes
1answer
543 views

SSSD installation directory is empty

When I try to install SSSD using yum install sssd terminal writes that installation completed fine, but when I try to service sssd start it writes sssd: unrecognized service Then when I attemp ...
3
votes
1answer
2k views

Troubles with sssd and Active Directory Integration

I have Debian Squeeze and sssd installed. When I try to login to server by user 'alexwinner' by ssh I see in the log: (Fri May 11 18:56:03 2012) [[sssd[krb5_child[26281]]]] [get_and_save_tgt] (1): ...
1
vote
1answer
125 views

How to poll the username, when having the UID?

we're using ldap with sssd for the usermanagement, so our users are not in the "/etc/passwd" Unfortunately, ps just shows the UIDs: [root@xyz ~]# id jmw uid=1582(jmw) gid=1582(jmw) groups=1582(jmw), ...
11
votes
6answers
27k views

CentOS 6 + LDAP + NFS. File ownership is stuck on “nobody”

I've been trying to get LDAP authentication and NFS exported home directories on CentOS 6 working for a few days now. I've gotten to the point that I can now login to the client machine using the ...
1
vote
2answers
8k views

SSSD Authentication

I just built a test server running OpenSuSE 12.1 and am trying to learn how configure sssd, but am not sure where to begin to look for why my config cannot allow me to authenticate. server:/etc/sssd ...
28
votes
2answers
64k views

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less ...