0

Just instaled SSSD using this guide to get active directory authentication working on Ubuntu 18.04.5 LTS.

It worked for our first server, but for whatever reason the one i'm trying to install on next will not allow domain users to login.

I'm new to this feature, so apologies if I'm not familiar with the logs that need to be provided. Please let me know what files I can provide if this is not helpful enough.

auth.log :

Jun 16 15:14:35 zoneminder su[2678]: pam_unix(su:auth): authentication failure; logname=razeth uid=1000 euid=0 tty=/dev/pts/1 ruser=razeth rhost=  user=prtg@domain.com
Jun 16 15:14:35 zoneminder su[2678]: pam_sss(su:auth): authentication failure; logname=razeth uid=1000 euid=0 tty=/dev/pts/1 ruser=razeth rhost= user=prtg@domain.com
Jun 16 15:14:35 zoneminder su[2678]: pam_sss(su:auth): received for user prtg@domain.com: 7 (Authentication failure)
Jun 16 15:14:37 zoneminder su[2678]: pam_authenticate: Authentication failure
Jun 16 15:14:37 zoneminder su[2678]: FAILED su for prtg@domain.com by razeth
Jun 16 15:14:37 zoneminder su[2678]: - /dev/pts/1 razeth:prtg@domain.com

sudo realm list :

domain.com
  type: kerberos
  realm-name: domain.com
  domain-name: domain.com
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U@domain.com
  login-policy: allow-realm-logins

/etc/sssd/sssd.conf :

[sssd]
domains = domain.com
config_file_version = 2
services = nss, pam

[domain/domain.com]
ad_domain = domain.com
krb5_realm = DOMAIN>COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
ad_gpo_access_control = permissive

sssctl config-check shows no errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.