Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [sssd]

System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for FreeIPA, LDAP, & Active Directory.

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

transient, intermittent "No user exists" errors with SSSD and LDAP

I'm using SSSD and Google LDAP. My users can log (via tailscale SSH, if that matters) in but after being logged in for a while they get errors like: No user exists for uid 61270005 (also any command ...
user162988's user avatar
0 votes
0 answers
17 views

Unable to open config database [duplicate]

[root@pc-1460 ~]# useradd Romain [sss_cache] [confdb_init] (0x0010): Unable to open config database [/var/lib/sss/db/config.ldb] Could not open available domains [sss_cache] [confdb_init] (0x0010): ...
Romain GUILLAUME's user avatar
1 vote
0 answers
22 views

Run a script when a user is created by SSSD

Basic setup: I'm running an Ubuntu VM which is joined to MS AD. SSSD handles user creation when people log in using their AD credentials. The only login method for the users is via xrdp. When a new ...
equinsu_ocha's user avatar
1 vote
1 answer
97 views

sssd allows switching via su to users blocked from ldap_access_filter for users that can log in

My department is switching to using sssd with ldap for logins on all of our linux hosts. I've got it all working, but there was one issue I was hoping to resolve before continuing testing in our dev ...
user23497333's user avatar
0 votes
0 answers
244 views

Ubuntu/sssd/Active Directory suddenly broke

Windows Server 2022 domain controller, Ubuntu 22.04, sssd 2.6.3. System joined to AD via 'realm join'. /etc/sssd/sssd.conf: [sssd] domains = dev.domain.com config_file_version = 2 services = nss, pam, ...
Barmaglot's user avatar
0 votes
0 answers
112 views

user not able to login remotely to sssd configured linux host

I have a RHEL host. I have configured sssd to connect to ldap server. The ldap user are not able to connect remotely to the host. However ever if i do su - username it work for me. but if the user ...
user2935688's user avatar
0 votes
0 answers
31 views

Different LDAP Filters for Separate Services in SSSD

I'd like to use LDAP in SSSD for two separate services on the same server. Specifically, I'd like to use one LDAP group for SSH access and a separate LDAP group for access to a web portal. It only ...
Jonathan's user avatar
0 votes
0 answers
93 views

Include fields on an LDAP user search?

I am running an Authentik instance with an LDAP provider/outpost. To test it out, I've bound an Ubuntu server with sssd to the LDAP server. Everything is working great (...finally). But I am curious ...
iTim314's user avatar
0 votes
0 answers
394 views

SSH with LDAP authentication within a Docker container

Im trying to setup a ssh jumphost with docker that uses LDAP authentication. I'm running the container as rootless. Note: This is all currently as testing but would love to hear some feedback about ...
Janchy's user avatar
  • 1
0 votes
1 answer
756 views

Install FreeIPA on Amazon Linux 2023

The goal is to install "freeipa" on Amazon Linux 2023 AMI. Amazon Linux 2023 doesn't officially support the package by default, due to this AMI is made of Fedora 34, 35, 36, and CentOS 9 ...
Igor Ferretti's user avatar
1 vote
0 answers
362 views

Using sssd for local authentication and identification against /etc/passwd?

This question is about RedHat Enterprise Linux 7/8/9 and Ubuntu 22.04, but it is probably pretty universal for most distros. I have sssd working for authentication against both Active Directory and an ...
Kevin Keane's user avatar
0 votes
1 answer
391 views

FreeIPA on Amazon Linux 2023

I want to install the FreeIPA client on Amazon Linux 2023. Unfortunately, Amazon Linux 2023 doesn't officially support the package. As a workaround I installed the Fedora repositories and managed to ...
Michael Angel P.'s user avatar
0 votes
0 answers
112 views

nfs4 idmapping with sss

We have a Dell enterprise file server that implements NFS4 ACLs. I can mount a NFS4 directory and nfs4_setfacl and nfs4_getfacl work correctly. Unfortunately, I am unable to get an ls listing to work ...
gerard's user avatar
  • 323
0 votes
0 answers
825 views

Linux login from Active Directory domain with two-way trust

I don't have much experience in linux tools for infrastructure and authentication with Active Directory. I'm configuring authentication to AD on Ubuntu 22.04. The structure we use is as follows: we ...
Rafael Rodrigues Marquesi's user avatar
1 vote
1 answer
583 views

SSSD, openLDAP and nested groups

I am trying to figure out how to structure my ldap and/or configure sssd to read membership of nested groups. Something like this works for normal group membership: DN: cn=server-admins,ou=Groups,dc=...
fussedAs's user avatar
0 votes
0 answers
218 views

Using shadow password from LDAP while using SSSD for identity

I'd like to use SSSD ldap as a provider for shadow entries. It seems to be supported, given the default config with sssd installed adds sss to both passwd and shadow in nsswitch.conf, but I can't get ...
viraptor's user avatar
  • 1,166
0 votes
0 answers
407 views

How to synchronize OpenLDAP and Samba4?

I have a samba 4 domain with internal LDAP. Now the need arose to copy OpenLDAP users and passwords to this domain. This copy must be made synchronously every time there is a change in OpenLDAP. ...
campos's user avatar
  • 115
0 votes
0 answers
139 views

SSSD LDAP CONFIGURATION

I am trying to configure ldap on port 636 on a redhat server. Right now, when I try the following command : netstat -antup | grep -i 636 I get tcp 0 132 IP_ADDRESS_1:40670 XX.XX.XX.XX:...
el sparrow's user avatar
0 votes
0 answers
630 views

SSSD Active Directory login on Ubuntu server closes connection on first login

We have configured some new Ubuntu VMs to use our Active Directory via sssd, but I am experiencing problems: When logging in via ssh with password-based authentication, it asks for my password, then ...
Taxel's user avatar
  • 111
2 votes
1 answer
956 views

Privilege escalation prevent root directly

I think this is going to be my first post on StackExchange side of the house. However, I know that this has to be able to be configured cause I have seen it implemented previously but I don't actually ...
Maxs728's user avatar
  • 121
0 votes
1 answer
435 views

ldap_group_search_base is not working as intented

I've used the below-given sssd.conf file to authorize the users to a server. The issue is some users who are not listed under the DN: cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com still ...
user11482797's user avatar
-1 votes
1 answer
548 views

Domain user directory being created as /home/username@domain instead of /home/username

I am using an amazon linux 2023 box and i joined the instance to domain using realmd. The issue is that when i try to login with my AD credentials, the user directory is being created as /home/...
Mervin Hemaraju's user avatar
1 vote
1 answer
2k views

List kerberos tickets, expiration details with SSSD/realm

tl;dr - how do I check details of users' kerberos tickets to confirm they are being renewed as I've sought to configure, using realm or sssd (no klist installed)? Hi - I'm on a Debian 11 system which ...
bikeactuary's user avatar
0 votes
1 answer
687 views

Failed to join a computer to samba domain (Zentyal) - Couldn't join realm: Insufficient permissions to join the domain

I'm relatively new Zentyal user (few months), and I love it! But I've ran into a problem I hope someone can help me with. In my deployment I have two Zentyal servers (zentyal-1.mydomain.com and ...
Aleksandar Pesic's user avatar
0 votes
1 answer
588 views

sssd.service restarting every 1 minute 50 seconds

I have 5 workstations that have been joined to a freeipa domain. I've noticed some weird authentication related issues on 3 of the workstations. I've discovered that all 3 workstations will restart ...
dutsnekcirf's user avatar
0 votes
1 answer
864 views

Filter groups that SSSD receives from AD server

We've got two Ubuntu 22.04 servers that use Kerberos and SSSD to authenticate users against an AD server. This works great. The servers also have a GlusterFS volume that holds the user's home ...
user7037's user avatar
0 votes
1 answer
4k views

Authenticating via SSSD but Unix Auth logs a failure

I have WinAD authentication working on all 20+ of our Debian 11 servers. We also have a handful of CentOS/Rocky servers working correctly. Login to one of the Debian machines causes the following logs:...
ross's user avatar
  • 1
0 votes
1 answer
1k views

Nsswitch - sudoers sss vs ldap what am I missing

I'm trying to configure nsswitch to use sudoers: files sss which is default for rhel9 system, however this does not work for me, but the following sudoers: files ldap does indeed work. What am I ...
N. J's user avatar
  • 125
0 votes
0 answers
299 views

Automatically add LDAP users to a local group

I manage about 100 servers running Alma Linux 9.1, each with multiple users. Historically we've had a single account "admin" that everyone logs into when working on a server. I'm moving us ...
miken32's user avatar
  • 974
0 votes
1 answer
5k views

SSSD is not creating a krb5.conf file after realm join, not able to `id` domain users, why?

The main problem is after I join the domain, I cannot id a domain user. Be aware I am not rebooting the host, do I need to? I would think I wouldn't need to. After doing some basic troubleshooting I ...
Dave's user avatar
  • 346
0 votes
1 answer
384 views

Realmd / SSSD Sudo performance issues

I have bunch of RHEL8.6 machines and i need user authentication via Active Directory. I got machines added to AD-domain with Realmd, made user groups, restricted access to user groups and enabled Sudo ...
unix_ike's user avatar
0 votes
0 answers
256 views

sssd password update not working, AD behind firewall

I have a centos server in a DMZ joined to my AD with sssd, minimum ports are open in the corporate firewall to allow the authentication but if the password of a user is updated on the AD, the Centos ...
mickg's user avatar
  • 1
1 vote
0 answers
501 views

Docker container cannot use its host's /etc/hosts file

After I joined some of my Ubuntu servers (mostly 20.02) to an AD domain(using realmd and sssd), they're unable to use their host's /etc/hosts file! Which they could do before they were a part of AD. ...
Milad Zahmatkesh's user avatar
0 votes
1 answer
2k views

Ubuntu 22.04 ActiveDirectory Password Syncronisation

I have Ubuntu 22.04 clients witch login with activeDirectory Domain accounts. (joined domain) A password policy is active to force a new password every 2 month. The password can be changed on multiple ...
M41DZ3N's user avatar
  • 103
1 vote
1 answer
57 views

Selective EXEC with LDAP-based sudo

I'm trying to translate this sudoers file into LDAP: Defaults env_reset, env_keep="LESSSECURE SSH_CLIENT", !authenticate, noexec, requiretty, secure_path=/usr/local/bin:/usr/bin:/usr/sbin ...
miken32's user avatar
  • 974
0 votes
0 answers
1k views

sssd/ldap does not authenticate against LDAP

I have configured SSSD with AD as ID and Auth providers. I am not caching credentials, so I expect connections to AD for authentication when I ssh to the host, but I do not see any. The user account ...
user2634153's user avatar
0 votes
0 answers
281 views

Active Directory User Accounts not loading environment variables from /etc/profile and /etc/bashrc

I have Rocky Linux 8.6 server that is joined to Active Directory and I can login to it with AD accounts. I have also mounted a NFS drive to the server. The home directories for AD accounts have been ...
Anas's user avatar
  • 1
1 vote
0 answers
418 views

Kerberos ticket timeouts with sssd and cifs shares

We are integrating Linux machines into our Active Directory infrastructure. It works quite fine, users are logging in with their AD-credentials, and get access to cifs-network-shares via PAM-mount. ...
Niels Jespersen's user avatar
0 votes
2 answers
148 views

SSSD direct bind

I use openldap with the following structure: dc=example,dc=org ├── ou=groups │ ├── cn=wheel │ └── cn=adm └── ou=users ├── uid=firstname.lastname └── uid=firstname.lastname Every setup of ...
ange's user avatar
  • 33
0 votes
0 answers
472 views

SSSD Linux passwd not working Windows Domain - Server does not support the requested control [1.3.6.1.4.1.42.2.27.8.5.1]

My linux box for some reason is not allowing to use the passwd command to change the user's Windows AD password. We can access the box using AD, run sudo using AD password, running id command I can ...
the-burgh's user avatar
1 vote
1 answer
3k views

ldapsearch finds my account/user, sssd does not

I am trying to setup a new Server(Ubuntu 22.04 LTS) and authenticate users using organization accounts. This is the public Documentation provided: https://www.hs-regensburg.de/supportwiki/doku.php?id=...
Sammy's user avatar
  • 13
1 vote
0 answers
1k views

How to confgure multi realm Kerberos

Intention I want to set up 2 Kerberos realms where one can authenticate the users in the other. Current Setup I have 2 Kerberos Servers (ad.somedomain.com and kerb.foo.bar) I have my users on kerb.foo....
WesAtWork's user avatar
1 vote
1 answer
503 views

LDAP SSSD SHA-512 authentication failure

I have a server with helm-openldap and a debian client. I can't login to a user who has a SHA-512 encrypted password. If i store it in clear or MD5, it works perfectly. $ id tuser uid=5000(tuser) gid=...
ange's user avatar
  • 33
0 votes
1 answer
175 views

SSSD hangs servers

When I boot the image from the diskless server (it is an RHEL 8.6) it gets Call Trace: It looks like that sssd:2076 task is blocked on 120 seconds. I am not able to find anything about that in the ...
sqr's user avatar
  • 15
0 votes
1 answer
1k views

Linux AD - Machine Account Name not updating on Domain Controller when Changing Hostname

I have some Alma 8 boxes which are integrated into Windows Active Directory (2012 R2) for user authentication using SSSD, using net ad (as opposed to realmd) for the domain join, for historic reasons. ...
motorleague's user avatar
1 vote
0 answers
3k views

adcli update does not save Kerberos ticket with new kvno

New Kerberos ticket of computer account is found by adcli update but not saved in keytab file. adcli update --domain=example.org -v The output "Retrieved kvno '4' for computer account" ...
phanaz's user avatar
  • 442
1 vote
1 answer
850 views

Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?

I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers). I'm in the painful process of migrating out of NIS/...
Francesco's user avatar
0 votes
1 answer
2k views

Nested AD group is not respected with SSSD

I have a domain joined server, configured with sssd. In sssd.conf I use ad_access_filter = (memberof=CN=CustomGroup,OU=Security Group,DC=company,DC=com) This works well for users in CustomGroup but ...
Norskyi's user avatar
1 vote
0 answers
777 views

Using ssh with sssd for password or publickey and extending with MFA support through PAM

So after some extensive testing and discussing I can no longer wrap my head around this problem on my own. Goal: Authenticating over ssh with either publickey or password, and use PAM for MFA. System ...
emollusion's user avatar
0 votes
0 answers
458 views

SSSD alternative for pam_authz_search option in nslcd

I have servers based on RHEL 7 and 8. RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD. For RHEL 7 I can provide access for users to allowed hosts only. This functions is covered ...
Aleksandr Makhov's user avatar

1
2 3 4 5
8