Questions tagged [sssd]
System Security Services Daemon (SSSD) - This project provides a set of daemons to manage access to remote directories and authentication mechanisms, it provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for FreeIPA, LDAP, & Active Directory.
349
questions
2
votes
1
answer
50
views
Privilege escalation prevent root directly
I think this is going to be my first post on StackExchange side of the house. However, I know that this has to be able to be configured cause I have seen it implemented previously but I don't actually ...
- 121
0
votes
1
answer
27
views
ldap_group_search_base is not working as intented
I've used the below-given sssd.conf file to authorize the users to a server. The issue is some users who are not listed under the DN: cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com still ...
-1
votes
1
answer
18
views
Domain user directory being created as /home/username@domain instead of /home/username
I am using an amazon linux 2023 box and i joined the instance to domain using realmd.
The issue is that when i try to login with my AD credentials, the user directory is being created as /home/...
- 115
0
votes
0
answers
6
views
detect when sssd connects to the ladp server and finds a specific group in boot
I am looking to find a way so when system is booting , i can detect when sssd connect to LDAP server and finds a specific group then reload the systemd-udevd.
i actually want to automate all of these ...
- 1
0
votes
0
answers
43
views
ldap+sssd on SuSE shows only local users
Problem: Not able to list ldap users.
Hello,
I am setting up new LDAP authentication on our SuSE 12 test system. I am a LDAP newbie and following the instructions from the site https://www.port389.org/...
- 11
1
vote
1
answer
116
views
List kerberos tickets, expiration details with SSSD/realm
tl;dr - how do I check details of users' kerberos tickets to confirm they are being renewed as I've sought to configure, using realm or sssd (no klist installed)?
Hi - I'm on a Debian 11 system which ...
- 123
0
votes
1
answer
107
views
Failed to join a computer to samba domain (Zentyal) - Couldn't join realm: Insufficient permissions to join the domain
I'm relatively new Zentyal user (few months), and I love it! But I've ran into a problem I hope someone can help me with.
In my deployment I have two Zentyal servers (zentyal-1.mydomain.com and ...
- 261
0
votes
1
answer
64
views
sssd.service restarting every 1 minute 50 seconds
I have 5 workstations that have been joined to a freeipa domain. I've noticed some weird authentication related issues on 3 of the workstations. I've discovered that all 3 workstations will restart ...
- 239
1
vote
0
answers
21
views
SSSD versus direct ldap IPA
I'm trying to setup so my sudoers in nsswitch.conf is using sss and not ldap directly. However, when I try to switch this and run a sudo I get following error:
Error
userX is not allowed to run sudo ...
- 131
0
votes
1
answer
64
views
Filter groups that SSSD receives from AD server
We've got two Ubuntu 22.04 servers that use Kerberos and SSSD to authenticate users against an AD server. This works great.
The servers also have a GlusterFS volume that holds the user's home ...
- 1
0
votes
1
answer
205
views
Authenticating via SSSD but Unix Auth logs a failure
I have WinAD authentication working on all 20+ of our Debian 11 servers. We also have a handful of CentOS/Rocky servers working correctly.
Login to one of the Debian machines causes the following logs:...
- 1
0
votes
1
answer
145
views
Nsswitch - sudoers sss vs ldap what am I missing
I'm trying to configure nsswitch to use sudoers: files sss which is default for rhel9 system, however this does not work for me, but the following sudoers: files ldap does indeed work.
What am I ...
- 131
0
votes
0
answers
14
views
Why do users in the administrators group not show they are in the group from a sssd joined host?
Noticed that when running id usertocheck or groups usertocheck the users in the administrators group did not show that group listed.
Checking on the windows dc with net user usertocheck shows ...
- 209
0
votes
0
answers
60
views
Automatically add LDAP users to a local group
I manage about 100 servers running Alma Linux 9.1, each with multiple users. Historically we've had a single account "admin" that everyone logs into when working on a server. I'm moving us ...
- 914
0
votes
1
answer
480
views
SSSD is not creating a krb5.conf file after realm join, not able to `id` domain users, why?
The main problem is after I join the domain, I cannot id a domain user. Be aware I am not rebooting the host, do I need to? I would think I wouldn't need to.
After doing some basic troubleshooting I ...
- 209
0
votes
1
answer
38
views
Realmd / SSSD Sudo performance issues
I have bunch of RHEL8.6 machines and i need user authentication via Active Directory.
I got machines added to AD-domain with Realmd, made user groups, restricted access to user groups and enabled Sudo ...
- 3
0
votes
0
answers
120
views
samba - openLdap authentication issue - Ubuntu 20.04 server
i'll try and be concise:
i'm running a Ubuntu server 20.04 VM, i've installed OpenLDAP and Samba (this is an assignment, so i'm not worrying very much that those both are hosted on same server for the ...
- 1
0
votes
0
answers
120
views
sssd password update not working, AD behind firewall
I have a centos server in a DMZ joined to my AD with sssd, minimum ports are open in the corporate firewall to allow the authentication but if the password of a user is updated on the AD, the Centos ...
- 1
0
votes
0
answers
346
views
xrdp no login possible for AD-users
i have set up a Fedora 37 Gnome box, as well as Fedora 32 Gnome box and a Fedora 37 KDE box (this one upgraded since about 5 years)
All PCs are part of a AD-domain, login with AD-users on local ...
- 151
0
votes
0
answers
47
views
AD joined Linux machine with different suffix
I've been struggling for 4 days and according to the information I have stated below, I can't access the linux os (debian) joined in AD to users with different UPN suffixes.
What kind of config (sssd ...
1
vote
0
answers
424
views
Docker container cannot use its host's /etc/hosts file
After I joined some of my Ubuntu servers (mostly 20.02) to an AD domain(using realmd and sssd), they're unable to use their host's /etc/hosts file! Which they could do before they were a part of AD.
...
0
votes
1
answer
610
views
Ubuntu 22.04 ActiveDirectory Password Syncronisation
I have Ubuntu 22.04 clients witch login with activeDirectory Domain accounts. (joined domain)
A password policy is active to force a new password every 2 month. The password can be changed on multiple ...
- 103
1
vote
1
answer
35
views
Selective EXEC with LDAP-based sudo
I'm trying to translate this sudoers file into LDAP:
Defaults env_reset, env_keep="LESSSECURE SSH_CLIENT", !authenticate, noexec, requiretty, secure_path=/usr/local/bin:/usr/bin:/usr/sbin
...
- 914
0
votes
0
answers
458
views
sssd/ldap does not authenticate against LDAP
I have configured SSSD with AD as ID and Auth providers. I am not caching credentials, so I expect connections to AD for authentication when I ssh to the host, but I do not see any. The user account ...
- 101
0
votes
0
answers
93
views
Active Directory User Accounts not loading environment variables from /etc/profile and /etc/bashrc
I have Rocky Linux 8.6 server that is joined to Active Directory and I can login to it with AD accounts. I have also mounted a NFS drive to the server. The home directories for AD accounts have been ...
- 1
0
votes
0
answers
179
views
Debian with sssd to connect AD user doesn't restrict login against GPO
I'm stuck since 3 days, I try to integrate AD users from my Windows server to Debian Server.
For this purpose I installed on my debian server these package :
realmd libnss-sss libpam-sss sssd sssd-...
0
votes
0
answers
225
views
Password expiration with sssd
I'm trying to configure password expiration warnings and access rejection with SSSD+LDAP by setting the following:
[domain/LDAP]
ldap_access_order=filter,expire
ldap_pwd_policy = shadow
...
- 1
0
votes
0
answers
239
views
Kerberos ticket timeouts with sssd and cifs shares
We are integrating Linux machines into our Active Directory infrastructure. It works quite fine, users are logging in with their AD-credentials, and get access to cifs-network-shares via PAM-mount. ...
- 101
0
votes
2
answers
85
views
SSSD direct bind
I use openldap with the following structure:
dc=example,dc=org
├── ou=groups
│ ├── cn=wheel
│ └── cn=adm
└── ou=users
├── uid=firstname.lastname
└── uid=firstname.lastname
Every setup of ...
- 13
0
votes
0
answers
227
views
SSSD Linux passwd not working Windows Domain - Server does not support the requested control [1.3.6.1.4.1.42.2.27.8.5.1]
My linux box for some reason is not allowing to use the passwd command to change the user's Windows AD password. We can access the box using AD, run sudo using AD password, running id command I can ...
1
vote
1
answer
1k
views
ldapsearch finds my account/user, sssd does not
I am trying to setup a new Server(Ubuntu 22.04 LTS) and authenticate users using organization accounts.
This is the public Documentation provided:
https://www.hs-regensburg.de/supportwiki/doku.php?id=...
- 13
1
vote
0
answers
145
views
How to confgure multi realm Kerberos
Intention
I want to set up 2 Kerberos realms where one can authenticate the users in the other.
Current Setup
I have 2 Kerberos Servers (ad.somedomain.com and kerb.foo.bar)
I have my users on kerb.foo....
- 11
1
vote
1
answer
217
views
LDAP SSSD SHA-512 authentication failure
I have a server with helm-openldap and a debian client.
I can't login to a user who has a SHA-512 encrypted password. If i store it in clear or MD5, it works perfectly.
$ id tuser
uid=5000(tuser) gid=...
- 13
0
votes
1
answer
91
views
SSSD hangs servers
When I boot the image from the diskless server (it is an RHEL 8.6) it gets Call Trace:
It looks like that sssd:2076 task is blocked on 120 seconds. I am not able to find anything about that in the ...
- 15
0
votes
1
answer
226
views
Linux AD - Machine Account Name not updating on Domain Controller when Changing Hostname
I have some Alma 8 boxes which are integrated into Windows Active Directory (2012 R2) for user authentication using SSSD, using net ad (as opposed to realmd) for the domain join, for historic reasons. ...
- 53
0
votes
0
answers
116
views
Use alias for domain with SSSD
I have sssd working with Redhat 7.9. I can login with a local account or user@domain which is as I would like it to work. The problem I have is the domain is long and one of the apps that sits on top ...
- 336
1
vote
0
answers
1k
views
adcli update does not save Kerberos ticket with new kvno
New Kerberos ticket of computer account is found by adcli update but not saved in keytab file.
adcli update --domain=example.org -v
The output "Retrieved kvno '4' for computer account" ...
- 360
0
votes
0
answers
112
views
samba stops working periodically
I use smb for sharing files with Windows 10 machines.
Periodically sharing stops working, I tried to restart services (sssd, smb, winbind) but that not resolved the problem. I have to disconnect from ...
- 1
0
votes
0
answers
223
views
SSSD authentication with LDAP, refresh after failing authorization?
I have some Red Hat 8 servers which authenticate/authorize users via Active Directory, using realmd and sssd (with simple_allow_groups to determine who can log into the servers).
However, the ...
- 1
1
vote
1
answer
402
views
Can SSSD authenticate via LDAP with anonymous binding either forbidden in ACLs and with 'olcRequires: authc' enforced?
I manage a LAN with a list of users accessing their NFS-shared homes while being auhtenticated via NIS/YP (CentOS/Fedora-based clients and servers).
I'm in the painful process of migrating out of NIS/...
- 45
0
votes
1
answer
1k
views
Nested AD group is not respected with SSSD
I have a domain joined server, configured with sssd.
In sssd.conf I use
ad_access_filter = (memberof=CN=CustomGroup,OU=Security Group,DC=company,DC=com)
This works well for users in CustomGroup but ...
- 1
1
vote
0
answers
470
views
Using ssh with sssd for password or publickey and extending with MFA support through PAM
So after some extensive testing and discussing I can no longer wrap my head around this problem on my own.
Goal: Authenticating over ssh with either publickey or password, and use PAM for MFA.
System ...
- 11
0
votes
0
answers
283
views
SSSD alternative for pam_authz_search option in nslcd
I have servers based on RHEL 7 and 8.
RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD.
For RHEL 7 I can provide access for users to allowed hosts only.
This functions is covered ...
- 578
0
votes
1
answer
482
views
Kerberos credentials not renewed on ipa ubuntu client
When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the ...
- 153
0
votes
1
answer
654
views
Problems sudoing using a host connected to Active Directory (sssd, kerberos local sudoers file)
I am configuring Active Directory authentication for an Alma 8 box using SSSD, Kerberos, and initial SSH key for log in stored in an Active Directory object, and a local sudoers file that lists groups ...
- 53
0
votes
1
answer
1k
views
Enforce TLS1.2 in sssd client
In one of our environments Linux servers are set up with sssd / OpenLDAP for OS login.
To support older servers our OpenLDAP server has to support TLSv1.0 and TLSv1.1 still.
RedHat 8 does no longer ...
- 362
1
vote
1
answer
3k
views
LDAP finds user, but "permission denied" when logging in
I am setting up an LDAP client in Red Hat 8.
After setting up the config files I did an LDAP user test and it came back successfully:
# id myusername
uid=666(myusername) gid=510(active_users) groups=...
- 121
0
votes
0
answers
978
views
use sssd-simple to restrict access to certain group
I have configured sssd to authenticate against ldap
however i want to restrict the group that can connect to the server.
the sssd.conf below allows users that are not member of the mentioned group to ...
- 53
1
vote
3
answers
3k
views
every LDAP user gives "permission denied" with LDAP and sssd (Centos7)
I am trying to limit LDAP logins to the "admin" group.
This is my /etc/sssd/sssd.conf file:
[domain/default]
autofs_provider = ldap
ldap_tls_reqcert = allow
auth_provider = ldap
...
- 15
1
vote
1
answer
193
views
pam_unix(sshd:auth): authentication failure because of encrypted password from PAM stack
To configure sssd to connect AD server.
I set id_provider to ldap
As AD server cannot accept TLS, so I closed it by:
ldap_id_use_start_tls = false
set ssl off in ldap.conf
When I use login ftp via ...
- 11