1

We use sssd for user management with the account information from a Samba AD Domain Controller.

The sssd-configuration on linux clients looks as follows:

[sssd]
services = nss, pam,ssh
config_file_version = 2
domains = EXAMPLE.DOMAIN.EU 


[ssh]
debug_level = 3

[nss]
debug_level = 3
filter_users = root
filter_groups = root
default_shell = /bin/bash

[pam]
debug_level = 3

[domain/EXAMPLE.DOMAIN.EU]
debug_level = 3
id_provider = ad
access_provider = ad


override_homedir = /home/%u


ad_server = adserver


enumerate = true
cache_credentials = true
create_homedir = true
ldap_user_ssh_public_key = sshPublicKey
ad_gpo_access_control = disabled

For this to work, the client systems need need to join the domain. During the join process, they receive their kerberos ticket. The kerberos configuration looks the following:

[libdefaults]
    default = DOMAIN.EU
    default_realm = EXAMPLE.DOMAIN.EU
        dns_lookup_realm = true
        dns_lookup_kdc = true
    fcc-mit-ticketflags = true

[realms]
    EXAMPLE.DOMAIN.EU = {
        kdc = adserver 
        admin_server = adserver 
        default_domain = domain.eu
    }
    DOMAIN.EU = {
        kdc = adserver 
        admin_server = adserver
    }

[domain_realm]
    .domain.eu = EXAMPLE.DOMAIN.EU
    domain.eu = EXAMPLE.DOMAIN.EU

Using the same config files on the Samba AD Domain Controller results in a failure during startup of sssd, because kerberos can not find a the machine ticket:

[find_principal_in_keytab] (0x0020): krb5_kt_start_seq_get failed.

joining the server to the domain would probably be wrong.

How does the correct configuration for sssd look on the Samba AD Domain Controller?

0

You must log in to answer this question.

Browse other questions tagged .