I'm running a CentOS 7 VirtualBox instance. I have LDAP authentication set up through our company Active Directory server.
Note: The AD server DOES NOT have Unix extensions installed.
What I'm seeing is this: When I log in via SSH I get an error:
$ ssh [email protected]@linuxboxip
[email protected]@linuxboxip's password:
/usr/bin/id: cannot find name for group ID 1316
I can log in, and the error does not seem to cause a problem, but is annoying
group ID 1316 refers to the numberical ID assigned to my AD user:
$ getent passwd [email protected]
[email protected]:*:1316:1316:First Last:/home/[email protected]:/bin/bash
However:
$ getent group 1316
returns nothing
If added manually, the error goes away:
sudo groupadd -g 1316 1316
sudo usermod -a -G 1316 1316
There has to be a setting or process I'm missing that maps the generated Group IDs or creates the new groups, But I'm not finding it.
Thoughts?
Setup:
I'm running CentOS 7-1611(64bit) from osboxes.org
I have nss-pam-ldapd installed The nslcd and nscd services are set to run at startup
/etc/nsswitch.conf has been edited to add ldap:
passwd: files ldap sss
shadow: files ldap sss
group: files ldap sss
hosts: files ldap dns myhostname
bootparams: nisplus [NOTFOUND=return] files ldap
ethers: files ldap
netmasks: files ldap
networks: files ldap
protocols: files ldap
rpc: files ldap
services: files ldap sss
netgroup: files ldap sss
automount: files ldap sss
aliases: files ldap nisplus
/etc/pam.d/password-auth edited like so:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth sufficient pam_ldap.so minimum_uid=1000 use_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_ldap.so minimum_uid=1000
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so minimum_uid=1000 try_first_pass
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so minimum_uid=1000
session required pam_mkhomedir.so skel=/etc/skel umask=0022
/etc/pam.d/system-auth edited like so:
auth required pam_env.so
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok try_first_pass
auth sufficient pam_ldap.so minimum_uid=1000 use_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_ldap.so minimum_uid=1000
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so minimum_uid=1000 try_first_pass
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so minimum_uid=1000
/etc/nslcd.conf edited:
uid nslcd
gid nslcd
uri ldap://myserver.com/
base dc=myserver,dc=com
binddn CN=My Name,OU=Users,OU=DV,DC=myserver,DC=com
bindpw PASSWORDHERE
# Alternative mappings for Active Directory
pagesize 1000
referrals off
idle_timelimit 800
filter passwd (&(objectClass=user)(!(objectClass=computer)))
map passwd uid userPrincipalName
map passwd uidNumber objectSid:CorrectSID
map passwd gidNumber objectSid:CorrectSID
map passwd homeDirectory "/home/$userPrincipalName"
map passwd gecos displayName
map passwd loginShell "/bin/bash"
filter group (objectClass=group)
map group gidNumber objectSid:CorrectSID
ssl no
/etc/openldap/ldap.conf edited to add:
URI ldap://myserver.com/
BASE dc=myserver,dc=com
