0

we have Active Directory authentication with SSSD on a CENTOS 7.5

Starting from today users are unable to log in. When they try, they get:

/usr/bin/id: cannot find name for group ID xxxxxxxxxx

I looked into /var/log/secure:

pam_sss(crond:session): Request to sssd failed. Public socket has wrong ownership or permissions.

Here's sssd.conf:

domains = xxxxxxxxx
config_file_version = 2
services = nss, pam

[domain/xxxxxxxx]
ad_domain = xxxxxxxx
krb5_realm = XXXXXXXXXX
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
#use_fully_qualified_names = True
use_fully_qualified_names = False
#fallback_homedir = /home/%u@%d
fallback_homedir = /home/%u
access_provider = ad

On another machine, with exactly the same configuration, everything works.

No changes at all, lately.

Thanks for your help.

Improve this question
8
  • So what are the ownership and permissions?
    – Michael Hampton
    Mar 11, 2021 at 19:15
  • Thank you @MichaelHampton. Of what precisely?
    – Alby11
    Mar 12, 2021 at 7:40
  • The error message says that pam is trying to connect to sssd via its public socket. Try something like systemctl cat sssd-pam.socket to find out where that is on your system.
    – Michael Hampton
    Mar 12, 2021 at 7:44
  • Why have you posted that listing? What relevance does it have to anything?
    – Michael Hampton
    Mar 12, 2021 at 8:34
  • These are my findings: [root@xxxxxxx ~]# systemctl cat sssd-pam.socket # /usr/lib/systemd/system/sssd-pam.socket [root@xxxxxxx ~]# ll /usr/lib/systemd/system/sssd-pam.socket -rw-r--r--. 1 root root 391 Sep 26 2018 /usr/lib/systemd/system/sssd-pam.socket
    – Alby11
    Mar 12, 2021 at 8:56

1 Answer 1

Reset to default
0

The issue has been solved.

The problem was, as stated by the error, a permission problem for the file:

srw-rw-r--+ 1 root root 0 Jun  1 14:30 pam

Fixed it by setting permissions to 0666:

chmod 0666 /var/log/secure
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .