Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [sssd]

System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for FreeIPA, LDAP, & Active Directory.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
22 views

How to setup a school/university/company-like SSO

I would like to setup a client-server system such that the end product is similar to taht used by universities, schools, and businesses. That is, I'd like to be able to sit down at any (properly setup)...
user avatar
0 votes
1 answer
102 views

Nested AD group is not respected with SSSD

I have a domain joined server, configured with sssd. In sssd.conf I use ad_access_filter = (memberof=CN=CustomGroup,OU=Security Group,DC=company,DC=com) This works well for users in CustomGroup but ...
user avatar
0 votes
0 answers
38 views

Using ssh with sssd for password or publickey and extending with MFA support through PAM

So after some extensive testing and discussing I can no longer wrap my head around this problem on my own. Goal: Authenticating over ssh with either publickey or password, and use PAM for MFA. System ...
user avatar
0 votes
0 answers
36 views

SSSD alternative for pam_authz_search option in nslcd

I have servers based on RHEL 7 and 8. RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD. For RHEL 7 I can provide access for users to allowed hosts only. This functions is covered ...
user avatar
0 votes
1 answer
81 views

Kerberos credentials not renewed on ipa ubuntu client

When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the ...
user avatar
  • 153
0 votes
0 answers
90 views

Problems sudoing using a host connected to Active Directory (sssd, kerberos local sudoers file)

I am configuring Active Directory authentication for an Alma 8 box using SSSD, Kerberos, and initial SSH key for log in stored in an Active Directory object, and a local sudoers file that lists groups ...
user avatar
0 votes
1 answer
62 views

Enforce TLS1.2 in sssd client

In one of our environments Linux servers are set up with sssd / OpenLDAP for OS login. To support older servers our OpenLDAP server has to support TLSv1.0 and TLSv1.1 still. RedHat 8 does no longer ...
user avatar
  • 352
1 vote
1 answer
77 views

LDAP finds user, but "permission denied" when logging in

I am setting up an LDAP client in Red Hat 8. After setting up the config files I did an LDAP user test and it came back successfully: # id myusername uid=666(myusername) gid=510(active_users) groups=...
user avatar
  • 111
0 votes
0 answers
46 views

use sssd-simple to restrict access to certain group

I have configured sssd to authenticate against ldap however i want to restrict the group that can connect to the server. the sssd.conf below allows users that are not member of the mentioned group to ...
user avatar
  • 33
0 votes
2 answers
413 views

every LDAP user gives "permission denied" with LDAP and sssd (Centos7)

I am trying to limit LDAP logins to the "admin" group. This is my /etc/sssd/sssd.conf file: [domain/default] autofs_provider = ldap ldap_tls_reqcert = allow auth_provider = ldap ...
user avatar
  • 3
1 vote
0 answers
55 views

pam_unix(sshd:auth): authentication failure because of encrypted password from PAM stack

To configure sssd to connect AD server. I set id_provider to ldap As AD server cannot accept TLS, so I closed it by: ldap_id_use_start_tls = false set ssl off in ldap.conf When I use login ftp via ...
user avatar
0 votes
1 answer
28 views

Is it possible to overlay local LDAP attributes on top of a replicated tree?

A central LDAP server provides user data as posixAccount, whereby the attributes homeDirectory and loginShell are empty. I want allow users in this central LDAP server to access a Linux system. If I ...
user avatar
  • 198
0 votes
0 answers
122 views

Configuring SSSD to do SSH SSO using Active directory

I am currently thinking about a solution to be able to SSH via kerberos using SSSD linked to an active directory without joining the machine to the domain. The main constraint is not to join the ...
user avatar
  • 1
0 votes
0 answers
71 views

Ubuntu Kerberos Parent Domain Auth Fails

We have an Ubuntu 18.4 server joined to the child domain. I'm able to ssh to the server with child domain account but not with parent domain account. Here is my krb5.conf [libdefaults] ...
user avatar
  • 3
0 votes
1 answer
232 views

What am I missing to setup sudo access with openldap?

I'm using lxd/lxc containers (Oracle Linux 8) to rapidly deploy the environment (so if you have lxd setup, you can modify the ip scheme to match lxd's bridge subnet / DNS and then paste the code into ...
user avatar
0 votes
1 answer
392 views

idmap range on Ubuntu 20.04 (sssd) does not match CentOS 7 winbind idmaps (kinda)

My Active Directory maps in Ubuntu systems are very long compared to my CentOS IDs The last 4 digits match but Ubunutu seems to be adding a lot more to the beginning. In CentOS winbind/samba I used a ...
user avatar
0 votes
1 answer
410 views

Ubuntu SSSD Auth Error with child/sub AD Domain

Need help authenticating linux (Ubuntu) server that is joined to child domain. I can see the server name on the Domain Controller and able to run authentication test successfully however I am not ...
user avatar
  • 3
0 votes
1 answer
177 views

I can su as an [open]ldap user on an sssd, but I can't ssh or login directly as the same user, what am I missing?

On sssd client authselect select sssd --force systemctl enable --now sssd [root@ldap-sssd ~]# id adam uid=16859(adam) gid=100(users) groups=100(users) [root@ldap-sssd ~]# su adam bash-4.4$ su adam ...
user avatar
0 votes
0 answers
99 views

Linux server joined to child AD domain unable to authenticate users from parent domain

I have an Ubuntu 20.04 server that I have successfully joined to my domain using realm, US.EXAMPLE.COM. The way our AD is structured is that all machines are joined to the child domain for their ...
user avatar
  • 1
0 votes
0 answers
184 views

Issues getting sssd, PAM, and faillock to play along on RHEL7

I am having an issue that I'm almost certainly is tied to how I have faillock configured in my PAM system-auth and password-auth on some RHEL7 servers. We are required to use STIGs, so I have to use ...
user avatar
0 votes
0 answers
150 views

Using active directory group as netgroup in sssd

I have an active directory domain with a handful of linux servers that interact with AD through sssd. I want to have a different sudoers configuration on different servers, and I know this can be ...
user avatar
1 vote
1 answer
217 views

Linux: Converting from NIS to AD auth, how to associate old UID/GID to "new" users?

Background: Our org has used NIS for 20+ years for UNIX/Linux authentication, continuing thru the present time. Windows and Active Directory came on the scene in our org sometime around 16 years ago, ...
user avatar
3 votes
1 answer
941 views

The memcache was not invalidated by NSS responder

I was deleting a user. # userdel u1 The memcache was not invalidated by nss responder. But finally the user was deleted. What does "The memcache was not invalidated by nss responder" means? ...
user avatar
0 votes
0 answers
27 views

realmd support for adcli --domain-controller parameter

I am trying to join Ubuntu 18.04 and 20.04 servers to Active Directory domain using realmd. Our network is segmented such a way that Ubuntu servers only have access to their local domain controllers. ...
user avatar
0 votes
0 answers
2k views

OEL 8.3 SSSD AD Login issue

I am running Oracle Enterprise LINUX 8.3 . I am able to join my AD domain with an admin account but when I try to login to the server using the same credentials that I used to join the server to the ...
user avatar
0 votes
0 answers
38 views

Linux AD domain client - access user Windows profile?

Linux client host joined to a Windows AD Domain with SSSD (Windows DC), users can login correctly with their AD credentials. I am looking for a way to mount the users Windows roaming profile on the ...
user avatar
  • 151
0 votes
0 answers
250 views

New SSSD Active Directory install does not allow logins

Just instaled SSSD using this guide to get active directory authentication working on Ubuntu 18.04.5 LTS. It worked for our first server, but for whatever reason the one i'm trying to install on next ...
user avatar
  • 1
0 votes
0 answers
458 views

Samba 4 with OpenLDAP: Cannot write to share

I have an OpenLDAP server running on ldap.mydomain.com and samba 4 running on samba.mydomain.com. Both Ubuntu 20.04 I want to be able to authenticate users via LDAP to enable them to write-access a ...
user avatar
1 vote
1 answer
362 views

Ubuntu 18.04/20.04 SSSD Configuration Issues

I would like to first mention that I have more experience with the CentOS/RHEL world than I do with configuration of Ubuntu. Most of the Ubuntu systems that I have had to build use default ...
user avatar
2 votes
0 answers
100 views

sssd credential chaching does not work

I set up an Centos7 using sssd as authentication system. The user identies are provided by files (passwd/group, managed by ansible), auth is done via krb5 (provided by active directory). The sssd.conf ...
user avatar
  • 21
0 votes
0 answers
1k views

pam_sss(crond:session): Request to sssd failed. Public socket has wrong ownership or permissions

we have Active Directory authentication with SSSD on a CENTOS 7.5 Starting from today users are unable to log in. When they try, they get: /usr/bin/id: cannot find name for group ID xxxxxxxxxx I ...
user avatar
  • 13
1 vote
0 answers
303 views

NFS : permission denied - home dir NFS Qtree from Netapp

I have centos7 box NFS Qtree used for home dir from Netapp is able to mount just fine Export policy shows : any any any ...ie super user access as well is any When i am root user on client box , can ...
user avatar
0 votes
1 answer
2k views

SSSD integration with Ldap Error 'Could not start TLS encryption. TLS: hostname does not match CN in peer certificate'

We are currently using Wildcard certificate with SAN. I can successfully run ldapsearch from my client machine when I added TLS_REQSAN allow in openldap configuration. Now i'm trying to integrate SSSD ...
user avatar
  • 11
0 votes
1 answer
456 views

how to export permissions/ACLs from Samba share to clients?

I have a Synology NAS running Samba that serves up shares in my network. I've set up autofs, LDAP and sssd and can mount Samba home directories on the fly when I log into Linux and MacOS machines. My ...
user avatar
0 votes
1 answer
128 views

RedHat 7: Is there a way to remove AD support from sssd?

We are a RedHat only shop. No Windows machines. All of our hosts authenticate with ldaps (636). Recently, there was a CVE about a Samba issue with Active Directory. CVE 2020-1472 We have absolutely no ...
user avatar
  • 227
3 votes
0 answers
4k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
user avatar
  • 31
1 vote
1 answer
1k views

adcli fails to join AD with LDAPS option

Having issues with the adcli on ubuntu 18.04 which was updated recently with the ldaps option. It can't seem to find the shortname for AD and also doesn't manage to connect to LDAP even when the CA is ...
user avatar
  • 341
1 vote
0 answers
199 views

How can I authenticate users inside a docker container against the host system's SSSD which itsself retrieves user data via LDAP?

I have a container host on which users are authenticated against a company Active Directory using SSSD with LDAP. On this host I have several docker containers running. Some of these containers just ...
user avatar
  • 11
0 votes
1 answer
798 views

CentOS 8.2 LDAP client configuration

I'm trying to configure an LDAP client on a CentOS 8.2 machine, using SSSD. The server doesn't use TLS or SSL. I have modified the following configuration files : /etc/sssd/sssd.conf [sssd] ...
user avatar
2 votes
1 answer
721 views

What realmd_tags parameter in sssd config is used for?

I have multiples linux workstations using sssd to authenticated with ad. To avoid misconfiguration ansible is used to maintain homogeneous setup of sssd. There come my interrogation what is the ...
user avatar
  • 21
1 vote
1 answer
934 views

Wrong LDAP user ID is mapped into Slurm account management service

I configured a Slurm head node as follows: sssd to contact openLDAP slurmctld/slurmdbd/slurmd/munged to act as the Slurm controller and compute node ...where ray.williams is an LDAP user. Its UID ...
user avatar
1 vote
0 answers
602 views

Using SSSD with multiple LDAP servers/domains

I need to authenticate users using two separate LDAP servers. Have configured SSSD with two domains but only one seems to be working. I ran the command authconfig --enablemkhomedir --enablesssd --...
user avatar
0 votes
1 answer
189 views

How can I disable users in "domain admins" group from running sudo?

Hi we have a large company and have some Domain Admins who belong to the id myadminuser groups=101010(domain admins), "domain admins" group. I was surprised by default that the sudoers %...
user avatar
1 vote
2 answers
159 views

Why can users just not login with SSH while everything else seems to work?

I have set up a pair of OpenLDAP servers on Ubuntu 20 with directional failover using Syncrepl. Things that an LDAP user can successfully do include: login su - <uid> remote bind from ...
user avatar
1 vote
1 answer
4k views

Using Samba with sssd

I have an OpenSUSE Tumbleweed server that is part of a Windows domain and uses sssd for user authentication. For ssh this is working fine but I cannot get it to work with Samba. When accessing a Samba ...
user avatar
  • 53
0 votes
0 answers
380 views

CentOS sssd: How to allow specific AD security group with space in the name to login while deny everything else?

People, In CentOS v8 sssd: How to allow specific AD security group with space in the name to log in while denying everything else? The AD security group is Domain Admins I have tested the id but ...
user avatar
0 votes
1 answer
687 views

how do I change realm login format in sssd?

I'm trying to figure out how to change my realm login format to allow for lowercase but currently it just seems to work with uppercase? realm list domain type: kerberos realm-name: domain domain-...
user avatar
  • 103
0 votes
3 answers
1k views

Why does sssd return SID numbers instead of group names on Ubuntu?

I'm trying out sssd to use krb5 for authentication on a Ubuntu 18.04 host and can't figure out how to show the actual user groups (groups shows some sort of Windows SID instead of human readable names)...
user avatar
  • 3,434
0 votes
1 answer
676 views

Using Samba as an AD domain member with consistent automatically generated POSIX attributes across Linux members

I am trying to join multiple Linux devices to a Windows Active Directory Domain with both Domain logon and Samba file sharing functionality. I am trying to avoid manually adding POSIX attributes to AD ...
user avatar
0 votes
1 answer
210 views

FreeIpa. How to setup specific shell only on 1 host for group of users

I'd like to set specific shell for group of users only in 1 host. In my environment already installed FreeIpa. In FreeIpa I can change shell for all my hosts, it is not my requirement.
user avatar

1
2 3 4 5
7