Questions tagged [sssd]

System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for FreeIPA, LDAP, & Active Directory.

Filter by
Sorted by
Tagged with
0
votes
1answer
19 views

Failing getent groups fail but getent passwd works

I have an AD server running on server 2019. I just setup a linux box and configured samba for some reason i can't get getent group "domain admins" to show anything. if i do getent passwd Administrator ...
0
votes
0answers
33 views

Obtain TGT at logon from ubuntu machine using PKINIT against Active Directory

I am trying to configure AD integration of an Ubuntu 18.04 machine on which members of the domain should login using their smart card logon certificates and automatically get a TGT from the KDC server....
0
votes
1answer
38 views

what is the difference between sssd (realm join) and net ads join?

I have been using ubuntu 18.04 with sssd to join my servers to my active directory domain for a while now. This worked quite nicely, enabling me to ssh to the servers with AD users and create samba ...
0
votes
1answer
43 views

Linux/Ubuntu - Use AD groups in Ansible before the computer is on the domain

TL;DR How do I reference an AD group for folder permissions before my computer has joined the domain? I'm setting up an Ubuntu system to interface with the orgs Active Directory. I've read that ...
0
votes
0answers
13 views

It is possible to map LDAP user to local linux user?

We have running a LDAP server and SSSD on client side. Is it possible to configure that, for example, the LDAP user "bob" is mapped to the local user "john" when logging on to the client? I have ...
0
votes
1answer
37 views

How to prevent other domanin users from accessing users home directory in Ubuntu?

We have linux (Ubuntu) desktops that are join to a domain using SSSD, i want to restrict users from accessing other users home directory and files for old and new users. It is possible set this ...
3
votes
0answers
98 views

SSSD procedure for staying joined when renaming AD computer object

Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
0
votes
1answer
54 views

Error: KDC reply did not match expectations

I was facing issues while joining a machine to domain using below command. the server has OS as Almazon Linux 2 server which has to join to example.com. I have done all the prerequisites which are ...
1
vote
1answer
37 views

Active Directory as uid/gid provider within a cluster

I have a CentOS 8 HPC cluster setup with a login node that is connected to an active directory via sssd/kerberos. Only the login node is accessible from the user network. Users use their normal domain ...
1
vote
1answer
127 views

autofs with samba, sssd, openldap, kerberos

I want to mount a samba share with autofs. srv.xxxxxxx.net is the samba server (proxmox container, Debian 10) ldap2.xxxxxxx.net is the openldap (proxmox container, Debian 10) gui.xxxxxxx.net is the ...
1
vote
0answers
25 views

Is it possible to use sssd to login to the samba domain controller

We use sssd for user management with the account information from a Samba AD Domain Controller. The sssd-configuration on linux clients looks as follows: [sssd] services = nss, pam,ssh ...
0
votes
1answer
236 views

Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI

Authentication against Kerberos and authorization against an LDAP directory is working for me. Now I'm looking for the client setup on Debian Buster using sssd. I started with LDAP authentication ...
3
votes
1answer
37 views

How to change Fedora hostname while being AD-member

i#m using a Fedora Workstation in our company Active Directory Domaine. The fedora box is member of the ActiveDirectory (Server 2012 R2). Now my hardware died and i moved my harddisk to a new ...
0
votes
0answers
17 views

SSSD not stable

we have Linux instances joined to AD server to make centralize authentication in AD server. We are using SSSD and Realmd to join our linux server to AD. However, after several days we will not be able ...
1
vote
1answer
33 views

Why does realmd list multiples of the same realm?

I'm setting up an Ubuntu server so that users can authenticate against a Windows AD server. Not knowing about realmd, I used Samba Winbind's net join command to join the machine to the domain. ...
2
votes
1answer
248 views

sssd active directory password integration not working

We are in the process of setting up sssd to be used with active directory using the config below. We do not use attribute mapping as we want to use attributes defined in the AD ldap objects such as ...
0
votes
0answers
40 views

How can I force users to update an expired (ppolicy) password when they log in with SSH keys?

OpenLDAP server is Ubuntu 18.04 running slapd package version 2.4.45+dfsg-1ubuntu1.4 Client is Ubuntu 18.04 using sssd 1.16.1-1ubuntu1.4 with an LDAP backend. I am not using SSH public keys within ...
0
votes
1answer
33 views

Failure to access AD in Linux EC2

I have a EC2 instance called EC2-B and I configured it to use AD Connector. This is instance is in the VPC B while the AD Connector EC2 is in VPC A. I have another instance EC2-A in the VPC-A and ...
0
votes
1answer
31 views

Home directory for Active Directory authenticated users based on parsed username

I have an NFS share with user home directories mounted on a web server. I want to enable UserDir in apache, but the home directories are not a straight-forward "/home/username" path. Instead, they're ...
0
votes
0answers
93 views

realmd SSSD ssh no login possible

I want to login with a AD account to a Linux VM that is domain member. I am failed hard by this issue. I have installed a new Domain Controller 2019 without any changes. Bootet up an new Ubuntu 18.04, ...
1
vote
2answers
93 views

SSSD, openLDAP, MIT Kerberos: “id username” doesn't find enty in LDAP, but ldapsearch does

I have installed openLDAP, MIT Kerberos and SSD on Debian 10 Systems based on this tutorial Integrated Kerberos-OpenLDAP provider on Debian squeeze. Each of the three components is on its own Proxmox ...
0
votes
0answers
42 views

SSSD Certificate-Based Client Authentication against LDAP

We use a (Open)LDAP database to authenticate clients in our network utilizing SSSD on the client side. Currently, the users have to enter their password to log-in. We wanted to change the ...
0
votes
1answer
239 views

What is the difference between samba and sssd? [closed]

In my ubuntu workstation I use /etc/samba/smb.conf and /etc/sssd/sssd.conf with /etc/krb5.conf in order to join active directory on a corporate network. sudo service samba-ad-dc status # inactive ...
0
votes
0answers
33 views

Active Directory Username alias, or alternate user ID

I've configured sssd and realmd correctly on CentOS7.7 so that users can authenticate against Active Directory. Our sAMAccountName is of the form sherlock.holmes, and our userPrincipalName is of the ...
0
votes
0answers
112 views

Slow ssh login - dbus connection has not authenticated soon enough

I open this question because I have trouble on two RHEL 7.7 / CentOS7.7 servers. When I try to connect to them via ssh or when I do an su - myuser it takes 30sec to accomplish. When I do su - myuser ...
0
votes
1answer
94 views

Login limited to a LDAP group using SSD and Kerberos

I'm trying to learn how PAM, SSSD and nsswitch works. I think these services are so useful although all the documentation over there is a little bit outdated and "esoteric". So I'm here asking for ...
0
votes
0answers
61 views

How to have a dynamic ldap_default_bind_dn value in sssd.conf?

I'm using a LDAP server for authentication/identification of users. I've set its ACIs so that every user just can access to its own data But now I have a problem in sssd clients: I should put the ...
0
votes
1answer
217 views

LDAP PAM client error “cannot find name for user ID”

I had ldap authentication working great last night, then today it doesn't seem to work. I can authenticate as a user, but the client can't seem to look up info about the user: Example logging in as ...
0
votes
0answers
100 views

Postgres/PAM/SSSD “Authentication Failed” followed by “connection authorized”

Previously I've been using LDAP authentication with postgres, but now as a result of security improvements all the machines are domain-joined via SSSD, and this is a great opportunity to get another ...
0
votes
1answer
143 views

Configuring sudo on CentOS with LDAP run by Synology Diskstation

I am trying to set up a CentOS 8 workstation to authenticate against a LDAP server run by a Synology DiskStation. I have been able to successfully configure SSSD to authenticate users against the ...
0
votes
0answers
56 views

RHEL 7 Samba server tied into AD with POSIX attributes

We have a RHEL7 server running Samba which hosts a media library application. We have over 8TB of media files archived on this system. In the past (when we were on RHEL5) we had Samba configured to ...
0
votes
0answers
183 views

User homes on CIFS with kerberos authentication

I have a CIFS share, which is presenting the share of the users homes on the same UNC path for every user. For authentication a kerberos ticket is used, which the user forwardes thorough his SSH ...
0
votes
0answers
177 views

sssd cache preventing users from logging in

I use sssd to authenticate against RedHat IdM. Most of the time it works fine, but sometimes users become unable to log into hosts. We've found that, most of the time, what is required is that we stop ...
0
votes
1answer
159 views

<unknown client> for <unknown server>, Cannot decrypt ticket

After reinstalling FreeIPA server and client(s), one client refuses to authenticate. $ ipa user-find properly list users I can kinit user successfully. ipa server krb5krc.log krb5kdc[4425](info): ...
0
votes
1answer
59 views

Can't authenticate against a 389DS server. I suspect it's a SSSD issue on client side

I'm running a 389DS LDAPS server (with self-signed certificates) on a Fedora 30 remote machine called "miservidor.midominio.local". There I have a typical directory containing user and group entries. ...
0
votes
1answer
331 views

Authenticate with SSSD in multiple domains in Ubuntu 18.04

I was able to successfully follow this document to get sssd to work with my Active Directory domain, but I was sad to learn that sssd does not support authenticating with external trusts. I read that ...
4
votes
2answers
156 views

SSSD storing wrong shell in cache

I am using SSSD to authenticate users on Linux against a local Active Directory server (Windows). It works fine, this is my config: [sssd] domains = my.domain config_file_version = 2 services = nss, ...
0
votes
2answers
526 views

sssd No domains configured, fatal error

sssd runnig one client but fails another, any idea? system is Centos 7 x64, running on proxmox VM # journalctl -xe -- Unit sssd.service has begun starting up. Ağu 20 09:20:17 slreport.linktera.lan ...
1
vote
1answer
68 views

ldapclient authentication with sssd

All, i'm stuck with ldap client and sssd authentication. i started sssd in debug mode and it says [sdap_get_users_done] (0x0040): Failed to retrieve users is posix account mandate for linux ...
0
votes
1answer
141 views

Why do all groups show all users as members with Google Secure LDAP?

After enabling and configuring SSSD to use Google's Secure LDAP service, when queried via getent group, all G-Suite groups show all G-Suite users as members: $ getent group admin admin:*:202851646:...
0
votes
1answer
71 views

Use shell if defined in LDAP, otherwise default

How should /etc/sssd/sssd.conf file be configured to use the shell defined in LDAP and the default one if the variable is not defined in LDAP?
0
votes
0answers
18 views

How to test failover in Red Hat identity management system setup across different geographical locations?

We are working on seting up an IDM. We have a master-replica setup in different geographical locations. In each location, we have configured an IDM server and its replica. The goal is to achieve the ...
0
votes
0answers
139 views

using FreeIPA sudo rules, `sudo --validate` never asks for a password

I have a system that is both a FreeIPA client and has local users. I have noted that the behavior of sudo --validate is different for users that are local or FreeIPA users, even given the same ...
0
votes
0answers
49 views

Apache 2.4, impersonate authenticated user for file-system access

I've configured mod_authnz_pam to validate user passwords on my CentOS server. The server accesses Active Directory through sssd, so users from my domain can log in onto the server. The following ...
1
vote
0answers
161 views

Ubuntu 18.04 Server Join Domain LDAP DNS Confusion

I have a domain setup with mixed systems. It's running Win2k16 server. Some clients are Windows and some are Linux. Most Linux clients are Ubuntu servers, in this case an 18.04. The Ubuntu 16s I have ...
0
votes
2answers
377 views

sssd dynamically update DNS

I am trying to figure out how to get SSSD to dynamically update DNS for different domains on a per NIC basis. For instance if I have a server named host.corp.example.com that has 2 NIC's. I would ...
1
vote
1answer
103 views

Centos 7 joined to AWS simple ad but can't query users

For the love of all that is holy - been at this for a solid 12 hours straight. I've added my centos machine to my simple AD service in AWS. Following the steps outlined here https://docs.aws.amazon....
0
votes
1answer
519 views

Authenticating Linux Login against Active Directory (AD) without Joining Linux Machine to AD Domain

I have a conventional Active Directory Infra deployed on Windows VMs on Azure. There is no Integration of this convention AD with Azure AD. I want Linux VMs on Azure with SLES 12 SP3 to authenticate ...
0
votes
0answers
75 views

pam_mkhomedir silently failing in Ubuntu 18

I'm attempting to set up a workstation Ubuntu machine for use in our domain. Everything we need is working quite well (sssd is configured and the net ads join worked fine). I can authenticate using ...
0
votes
0answers
134 views

ad_gpo_map_interactive disappeared from sssd?

A corporate windows active directory :-( is responsible of user credentials on an Ubuntu 18.04 LTS. It's using samba and sssd on the Linux side. I had to add ad_gpo_map_interactive = +cron in the ...

1
2 3 4 5 6