Questions tagged [sssd]

System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for FreeIPA, LDAP, & Active Directory.

Filter by
Sorted by
Tagged with
1
vote
0answers
20 views

Ubuntu 18.04/20.04 SSSD Configuration Issues

I would like to first mention that I have more experience with the CentOS/RHEL world than I do with configuration of Ubuntu. Most of the Ubuntu systems that I have had to build use default ...
0
votes
0answers
19 views

AD joined Linux system: sss_override for uid and gid, group name reported as unknown

I have a Centos 8 server attached to an AD domain (added using 'realm' which configures the AD backend for SSSD) I want to use sss_override to override the uid for AD users, for backwards ...
2
votes
0answers
40 views

sssd credential chaching does not work

I set up an Centos7 using sssd as authentication system. The user identies are provided by files (passwd/group, managed by ansible), auth is done via krb5 (provided by active directory). The sssd.conf ...
1
vote
0answers
389 views

SSSD - Server does not see subdomains

Good morning, I have four servers in the same subnet, all running RHEL 7 and using SSSD to authenticate against an Active Directory domain controller. With one (and only one) of them I have an issue ...
0
votes
0answers
48 views

“VNC password failed, VNC error” (w/ AD linked user on SSSD-enabled linux server)?

I have someone trying to connect to a CenOS 7 server via Windows Remote Desktop (based on the instructions here: https://www.itzgeek.com/how-tos/linux/centos-how-tos/install-xrdp-remote-desktop-to-...
0
votes
0answers
83 views

pam_sss(crond:session): Request to sssd failed. Public socket has wrong ownership or permissions

we have Active Directory authentication with SSSD on a CENTOS 7.5 Starting from today users are unable to log in. When they try, they get: /usr/bin/id: cannot find name for group ID xxxxxxxxxx I ...
1
vote
0answers
49 views

NFS : permission denied - home dir NFS Qtree from Netapp

I have centos7 box NFS Qtree used for home dir from Netapp is able to mount just fine Export policy shows : any any any ...ie super user access as well is any When i am root user on client box , can ...
0
votes
1answer
303 views

SSSD integration with Ldap Error 'Could not start TLS encryption. TLS: hostname does not match CN in peer certificate'

We are currently using Wildcard certificate with SAN. I can successfully run ldapsearch from my client machine when I added TLS_REQSAN allow in openldap configuration. Now i'm trying to integrate SSSD ...
0
votes
0answers
13 views

Login via SSSD to root user

In my infrastructure, we're using SSSD with LDAP for authn/authz. Today, when a user attempts to SSH in, SSSD creates a new local user based on their username. Due to limitations in the infrastructure,...
0
votes
0answers
61 views

SSH SSSD and RADIUS PAM config

After successfully configuring SSSD and all the necessary steps to login into Ubuntu 18.04 host joined to Active Directory we found out that our MFA only works through RADIUS for SSH, there is no ...
0
votes
1answer
75 views

how to export permissions/ACLs from Samba share to clients?

I have a Synology NAS running Samba that serves up shares in my network. I've set up autofs, LDAP and sssd and can mount Samba home directories on the fly when I log into Linux and MacOS machines. My ...
0
votes
0answers
22 views

Authentication using two separate Kerberos realms

Scenario I run a FreeIPA server (v4.8.7) for identity and access management (IAM) to manage enrolled hosts on domain aaa.example.com (e.g. host1.aaa.example.com). IPA server is at ipa.aaa.example.com. ...
0
votes
1answer
66 views

RedHat 7: Is there a way to remove AD support from sssd?

We are a RedHat only shop. No Windows machines. All of our hosts authenticate with ldaps (636). Recently, there was a CVE about a Samba issue with Active Directory. CVE 2020-1472 We have absolutely no ...
2
votes
0answers
1k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
1
vote
1answer
543 views

adcli fails to join AD with LDAPS option

Having issues with the adcli on ubuntu 18.04 which was updated recently with the ldaps option. It can't seem to find the shortname for AD and also doesn't manage to connect to LDAP even when the CA is ...
1
vote
0answers
70 views

How can I authenticate users inside a docker container against the host system's SSSD which itsself retrieves user data via LDAP?

I have a container host on which users are authenticated against a company Active Directory using SSSD with LDAP. On this host I have several docker containers running. Some of these containers just ...
0
votes
1answer
294 views

CentOS 8.2 LDAP client configuration

I'm trying to configure an LDAP client on a CentOS 8.2 machine, using SSSD. The server doesn't use TLS or SSL. I have modified the following configuration files : /etc/sssd/sssd.conf [sssd] ...
0
votes
0answers
20 views

Logrotate order and include

Can someone confirm if the main logrotate conf is ignored, used or partly used when an application (in my case sssd) is included and has it's own conf in logrotate.d main conf contains create, daily ...
0
votes
0answers
29 views

SSSD & Slow response to basic cmd like w or ls

Anyone observed slow response to basic cmds like w or ls ( in a dir where files are owned by AD group ) ? What i have seen the 1st time said cmd takes time & later the speed is good. Any ...
1
vote
0answers
152 views

What realmd_tags parameter in sssd config is used for?

I have multiples linux workstations using sssd to authenticated with ad. To avoid misconfiguration ansible is used to maintain homogeneous setup of sssd. There come my interrogation what is the ...
0
votes
1answer
307 views

Wrong LDAP user ID is mapped into Slurm account management service

I configured a Slurm head node as follows: sssd to contact openLDAP slurmctld/slurmdbd/slurmd/munged to act as the Slurm controller and compute node ...where ray.williams is an LDAP user. Its UID ...
1
vote
0answers
237 views

Using SSSD with multiple LDAP servers/domains

I need to authenticate users using two separate LDAP servers. Have configured SSSD with two domains but only one seems to be working. I ran the command authconfig --enablemkhomedir --enablesssd --...
0
votes
1answer
91 views

How can I disable users in “domain admins” group from running sudo?

Hi we have a large company and have some Domain Admins who belong to the id myadminuser groups=101010(domain admins), "domain admins" group. I was surprised by default that the sudoers %...
1
vote
2answers
85 views

Why can users just not login with SSH while everything else seems to work?

I have set up a pair of OpenLDAP servers on Ubuntu 20 with directional failover using Syncrepl. Things that an LDAP user can successfully do include: login su - <uid> remote bind from ...
0
votes
0answers
21 views

How would you configure sssd to allow any user provided that it can get an authorized key entry from AuthorizedKeysCommand?

Similar to AuthorizedKeysCommand in OpenSSH without user but specifically configuring the sssd so that any user provided that it can get an authorized key entry from AuthorizedKeysCommand will work. ...
0
votes
0answers
182 views

Samba SSSD authentication via userPrincipalName does not work because samba claims that the username does not exist. Is that even possible?

i'm investigating the issue that I can't authenticate against a Samba (as Active-Directory Member) using the userPrincipalName (UPN). (Using Samba and sAMAccountName works fine.) After some research I'...
0
votes
0answers
32 views

Can I use RADIUS or TACACS+ with SSS?

As I look over the documentation for SSS, e.g., sssd.conf(5), I see lots of references and support for LDAP and, to a lesser degree, Kerberos. However, I need my clients to authenticate against RADIUS ...
0
votes
0answers
12 views

Any way to map groups returned by SSSD to a different name?

I have an AD domain which I've joined a linux host to using realm. The group info from id seems to be using the objectSID attribute from AD and not the sAMAccountName as I've configured it (...
0
votes
0answers
1k views

Using Samba with sssd

I have an OpenSUSE Tumbleweed server that is part of a Windows domain and uses sssd for user authentication. For ssh this is working fine but I cannot get it to work with Samba. When accessing a Samba ...
0
votes
0answers
76 views

CentOS sssd: How to allow specific AD security group with space in the name to login while deny everything else?

People, In CentOS v8 sssd: How to allow specific AD security group with space in the name to log in while denying everything else? The AD security group is Domain Admins I have tested the id but ...
0
votes
1answer
256 views

how do I change realm login format in sssd?

I'm trying to figure out how to change my realm login format to allow for lowercase but currently it just seems to work with uppercase? realm list domain type: kerberos realm-name: domain domain-...
0
votes
2answers
283 views

Why does sssd return SID numbers instead of group names on Ubuntu?

I'm trying out sssd to use krb5 for authentication on a Ubuntu 18.04 host and can't figure out how to show the actual user groups (groups shows some sort of Windows SID instead of human readable names)...
0
votes
1answer
214 views

Using Samba as an AD domain member with consistent automatically generated POSIX attributes across Linux members

I am trying to join multiple Linux devices to a Windows Active Directory Domain with both Domain logon and Samba file sharing functionality. I am trying to avoid manually adding POSIX attributes to AD ...
0
votes
0answers
60 views

Consistent UIDs for Active Directory users between PBIS and SSSD

Is there a way to configure SSSD to generate the same UIDs for Active Directory users as PBIS Open would? I'm migrating my Linux AD clients from PBIS (who have stopped developing their free offering) ...
0
votes
1answer
63 views

FreeIpa. How to setup specific shell only on 1 host for group of users

I'd like to set specific shell for group of users only in 1 host. In my environment already installed FreeIpa. In FreeIpa I can change shell for all my hosts, it is not my requirement.
2
votes
1answer
471 views

centos 8 - sssd configuration not fetching shadow contents for ldap user

I have configured sssd on centos 8 and ldap on centos 7. I am able to get details about a testuser using getent passwd and getent group , but while testing it for getent shadow I am not getting any ...
0
votes
0answers
63 views

Removed dbus socket crashes sssd ssh component

I'll try to be as concise as I can but I'm not entirely knowledgeable yet as to how our infrastructure was set up. We use CentOS 7 machines with FreeIPA and the latest version of sssd (1.16.4-37) and ...
0
votes
1answer
43 views

ubuntu - sssd - unable to login when system partition is full

we have many ubuntu servers that are joined to active directory using sssd. However, domain users are unable to login when the root partition reaches full capacity. After some research I found the ...
1
vote
1answer
461 views

New users unable to ssh or su

All of a sudden, new users cannot ssh into our ubuntu servers. When attempting, the connection will just close. I tried doing an su with my test user who has never logged into the server before and I ...
0
votes
1answer
84 views

Superuser unable to change password of user on LDAP server

Just set up an LDAP server (sun) running Ubuntu 20.04 following the guide on Ubuntu Server Docs with TLS enabled with a bunch of users, groups, and automounts in database. Several clients (here: seca) ...
0
votes
1answer
297 views

Failing getent groups fail but getent passwd works

I have an AD server running on server 2019. I just setup a linux box and configured samba for some reason i can't get getent group "domain admins" to show anything. if i do getent passwd Administrator ...
1
vote
2answers
4k views

what is the difference between sssd (realm join) and net ads join?

I have been using ubuntu 18.04 with sssd to join my servers to my active directory domain for a while now. This worked quite nicely, enabling me to ssh to the servers with AD users and create samba ...
0
votes
1answer
166 views

Linux/Ubuntu - Use AD groups in Ansible before the computer is on the domain

TL;DR How do I reference an AD group for folder permissions before my computer has joined the domain? I'm setting up an Ubuntu system to interface with the orgs Active Directory. I've read that ...
0
votes
1answer
53 views

How to prevent other domanin users from accessing users home directory in Ubuntu?

We have linux (Ubuntu) desktops that are join to a domain using SSSD, i want to restrict users from accessing other users home directory and files for old and new users. It is possible set this ...
3
votes
0answers
464 views

SSSD procedure for staying joined when renaming AD computer object

Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
2
votes
1answer
2k views

Error: KDC reply did not match expectations

I was facing issues while joining a machine to domain using below command. the server has OS as Almazon Linux 2 server which has to join to example.com. I have done all the prerequisites which are ...
1
vote
1answer
131 views

Active Directory as uid/gid provider within a cluster

I have a CentOS 8 HPC cluster setup with a login node that is connected to an active directory via sssd/kerberos. Only the login node is accessible from the user network. Users use their normal domain ...
1
vote
1answer
899 views

autofs with samba, sssd, openldap, kerberos

I want to mount a samba share with autofs. srv.xxxxxxx.net is the samba server (proxmox container, Debian 10) ldap2.xxxxxxx.net is the openldap (proxmox container, Debian 10) gui.xxxxxxx.net is the ...
1
vote
0answers
49 views

Is it possible to use sssd to login to the samba domain controller

We use sssd for user management with the account information from a Samba AD Domain Controller. The sssd-configuration on linux clients looks as follows: [sssd] services = nss, pam,ssh ...
0
votes
1answer
812 views

Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI

Authentication against Kerberos and authorization against an LDAP directory is working for me. Now I'm looking for the client setup on Debian Buster using sssd. I started with LDAP authentication ...

1
2 3 4 5
7