System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the ...

learn more… | top users | synonyms

30
votes
2answers
69k views

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less ...
11
votes
6answers
30k views

CentOS 6 + LDAP + NFS. File ownership is stuck on “nobody”

I've been trying to get LDAP authentication and NFS exported home directories on CentOS 6 working for a few days now. I've gotten to the point that I can now login to the client machine using the ...
9
votes
3answers
629 views

IPA dynamic DNS updates only the AAAA record. Where are my A records?

I'm setting up a FreeIPA domain. In my lab are three virtual machines: the domain controller ipadc1, and two clients puppet and wordpress (creative, yes, I know). All three VMs are running freshly ...
6
votes
1answer
326 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
5
votes
3answers
6k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
5
votes
2answers
969 views

Overriding Parameters in Previously Declared Puppet Resource

I'm attempting to rebuild nwaller's sssd puppet module to be entirely LDAP based and to be a little cleaner. In it we have a resource defined for each authentication domain of the form define ...
5
votes
4answers
437 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source based on this question: Managing access to multiple linux system One problem I ran into is that if a ...
4
votes
4answers
247 views

Which ports are required in order to authenticate against a ldap server in another domain which is behind a firewall?

I have a Linux domain running with sssd, let's call this domain NJ. I'd like machines on the NJ domain to be able to authenticate against an Active Directory ldap server which resides on a different ...
4
votes
1answer
7k views

How to use realmd in Ubuntu 14.04 LTS to join an Active Directory domain?

I want to use realmd to join an Active Directory domain from Ubuntu 14.04 LTS. To do that I just installed realmd and some dependencies with this command: aptitude install realmd sssd sssd-tools ...
3
votes
1answer
315 views

What to do when local usernames conflict with network usernames

We use Puppet to manage our Linux desktop machines and SSSD to authenticate our users against a central authentication system. Recently when setting up a few new machines we found that puppet was ...
3
votes
3answers
4k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
3
votes
3answers
103 views

home dir and shell for Active Directory authenticated users

I have successfully configured sssd and can ssh into a system with AD credentials what I am missing is the creation of a home directory and bash set as the shell. My assumption is that if I log on to ...
3
votes
1answer
878 views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
3
votes
2answers
5k views

sssd and ldap authentication cache

On our box running OpenSUSE 12.2 we have installed OpenLDAP and sssd daemon. We are using these two services for user authentication. Recently we created a script which creates new web-users for our ...
3
votes
1answer
3k views

Troubles with sssd and Active Directory Integration

I have Debian Squeeze and sssd installed. When I try to login to server by user 'alexwinner' by ssh I see in the log: (Fri May 11 18:56:03 2012) [[sssd[krb5_child[26281]]]] [get_and_save_tgt] (1): ...
3
votes
1answer
1k views

Refresh ldap client configuration Centos

Recently we change the ip address (and add some groups) of our LDAP server (running in Suse Enterprise) so should change also the ldap authenthication configurations for all the servers that we have. ...
3
votes
0answers
95 views

SSSD process won't die

Thanks for taking the time to check out my problem. I'm currently working on an issue that has only appeared once before. Back on Jan 3rd when this first appeared we were able to reboot the server ...
2
votes
2answers
111 views

Linux: sssd cache not being cleaned upon server reboot, what could be the cause and how can it be changed?

I'm using sssd in order to work with LDAP users and groups within our Linux environment. I had to rename the LDAP group of one of my Linux users and I noticed that after I finished editing the group, ...
2
votes
1answer
37 views

LDAP authentication - avoid duplicate uidNumber

I have just successfully configured OpenLDAP Users authentication in a single CentOS6 box, based on SSSD. Took some time and many trials, but it's working. Now, I want to start adding users. I'm ...
2
votes
5answers
154 views

Pursuit of True Active Directory Integration

Before you laugh at me and say, "If you want Active Directory, use Windows" or tell me to use Google, hear me out. My company relies very heavily on AD. Nay, we are married to it at this point, and ...
2
votes
1answer
341 views

What is LDAP enumeration?

I have been working with implementing LDAP in our servers. We are using SSSD instead of nscd/nslcd to communicate with the LDAP server. One of the options in SSSD is enumeration. Enabling it solved ...
2
votes
1answer
557 views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
2
votes
1answer
467 views

Identity Management for UNIX Password synchronisation gives warning

I installed "Identity Management for UNIX" on win 2008 r2 active directory. I did this because I wanted to have the unix attributes, so I can link linux computers via ldap to the active directory. I ...
2
votes
1answer
699 views

SSSD installation directory is empty

When I try to install SSSD using yum install sssd terminal writes that installation completed fine, but when I try to service sssd start it writes sssd: unrecognized service Then when I attemp ...
2
votes
2answers
3k views

SSSD ignoring ldap_access_filter

I've setup sssd and LDAP. Users authenticate and login. My problem is that sssd seems to ignore the ldap_access_filter option and allows all users to login. I've examined the logs/debug and pam_sss ...
2
votes
0answers
95 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
2
votes
1answer
233 views

Login with Enterprise Principal Name using sssd AD backend in Ubuntu 14.04 LTS

I’m running sssd version 1.11 with the AD backend in Ubuntu 14.04 LTS (1.11.5-1ubuntu3) to authenticate users from Active Directory running on Windows Server 2012 R2, and I’m trying to achieve logins ...
1
vote
4answers
16k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
1
vote
2answers
2k views

Cannot authenticate in Active Directory using security/sssd from FreeBSD ports

I'm trying to implement security/sssd port in a FreeBSD 10.0 system. My main goal is to authenticate users from Active Directory running on Windows Server 2012 R2. I would like to know if anyone had ...
1
vote
1answer
2k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
2answers
588 views

sssd: Is there a way to force a specific shell for some group members?

The context I'd like to restrict some AD users to a specific script, limiting what they can do on this particular machine. So, instead of connecting them with /bin/bash (for instance), I'd like to ...
1
vote
1answer
343 views

Prevent sssd from using ldap to authenticate or id specific users for chef

I'm trying to use chef to add/modify a few local user accounts. For whatever reason there are duplicate accounts in LDAP. Since the system uses sssd/pam/ldap, it sees the user as existing, but is ...
1
vote
1answer
2k views

CentOS 6 SSSD SSH/Console Login Issues

I'm new to SSSD but I think I've configured it correctly considering id {ldap user} returns the expected uid and gid values for multiple test users. I'm using two CentOS 6.4 servers as test machines. ...
1
vote
1answer
131 views

How to poll the username, when having the UID?

we're using ldap with sssd for the usermanagement, so our users are not in the "/etc/passwd" Unfortunately, ps just shows the UIDs: [root@xyz ~]# id jmw uid=1582(jmw) gid=1582(jmw) groups=1582(jmw), ...
1
vote
2answers
9k views

SSSD Authentication

I just built a test server running OpenSuSE 12.1 and am trying to learn how configure sssd, but am not sure where to begin to look for why my config cannot allow me to authenticate. server:/etc/sssd ...
1
vote
1answer
52 views

sssd one ldap server for authentication and one for automounting, is this possible?

Says it all in the title really :) I am looking into SSSD but have a requirement that it must use ldap-1 for user authentication and then get the home directory automount information from ldap-2. ...
1
vote
2answers
119 views

Multiple Domain realmd/sssd Configuration on RHEL7?

I've configured our RHEL7 instance to support Active Directory login integration by using the documentation HERE. This describes using the "realm" command to configure the "sssd" service allowing for ...
1
vote
3answers
255 views

Linux / AD integration with SSSD: how to choose what systems a user can log into?

We are trying out ActiveDirectory integration on some linux systems with SSSD. So far so good we joined the linux systems to the domain and we can log into linux systems with AD-defined users. Right ...
1
vote
1answer
336 views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...
1
vote
1answer
238 views

linux ldap authentication set gid to uid

I'm setting up ldap authentication with sssd for a linux server. everything works fine. however, the users from the ldap server have a default group User. which is, uid=10001 (larry), gid= 20001 ...
1
vote
0answers
58 views

LDAP with SSSD: force user to change password - 'ShadowLastChange' not working

I have CentOS6, with LDAP user authentication, using OpenLDAP and SSSD. I'm trying to force user to change the password. According to this ServerFault question I tried to set ShadowLastChange to 0, ...
1
vote
2answers
179 views

vsFTPd authenticating with SSSD

I am currently trying to setup an FTP sever that authenticates through Active Directory using SSSD. My config files are as follows: /etc/vsftpd/vsftpd: [root@StudentOrgFTP vsftpd]# cat vsftpd.conf ...
1
vote
1answer
134 views

Using sssd ldap access filter DENY based on group?

I am currently using sssd.conf to only allow login for ldap users that are in a specific group. I would like to do the opposite and DENY login based on group membership of a user, while allowing all ...
1
vote
3answers
1k views

Is anyone using access.conf and netgroup authentication with sssd?

I want to be able to authenticate users (via ssh) to specific groups of hosts based on the users' LDAP netgroup membership. The LDAP server is dsee7. The distro is OEL 6.5 with openldap as the client. ...
1
vote
0answers
222 views

need help writing puppet module for sssd.conf using Hiera

I need to build a module to manage /etc/sssd/sssd.conf on our Red Hat VMs. The sssd modules published on the forge don't seem to do what I want, nor do I feel like forking any of them. I want to keep ...
1
vote
0answers
129 views

Groups with local and LDAP users

I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group. How can ...
1
vote
2answers
2k views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
1
vote
1answer
6k views

LDAP Client Authentication using SSSD: Groups issue

I have been able to setup 389 LDAP server and SSSD client authentication. However, whenever I login using ldap user after each login it displays the error ttt@dsl's password: Last login: Thu Dec 6 ...
0
votes
1answer
1k views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
0
votes
2answers
4k views

Can't add local user on system using ldap auth for samba [closed]

Trying to add a local user to a CentOS 6.3 system that is using ldap for Samba authentication, but being stymied by the user's existing entry in ldap. [root@samba ~]# adduser wchandy adduser: user ...