Difference between revisions of "SSSD"

From Nuclear Physics Group Documentation Pages
Jump to navigationJump to search
Line 24: Line 24:
 
   ldap_tls_reqcert = never
 
   ldap_tls_reqcert = never
 
   auth_provider = ldap
 
   auth_provider = ldap
   ldap_schema = rfc2307bis
+
   ldap_schema = rfc2307
 
   krb5_realm = EXAMPLE.COM
 
   krb5_realm = EXAMPLE.COM
 
   ldap_search_base = dc=physics,dc=unh,dc=edu
 
   ldap_search_base = dc=physics,dc=unh,dc=edu
Line 37: Line 37:
 
   ldap_network_timeout = 3
 
   ldap_network_timeout = 3
 
   ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount))
 
   ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount))
 +
  ldap_rfc2307_fallback_to_local_users = True
 +
  enumerate = True
  
  

Revision as of 23:54, 21 March 2014

Starting with CentOS6, remote account login authentication is performed using SSSD. Configuring SSSD to authenticate to an LDAP server can be tricky, but the following instructions work perfectly.

Configuring SSSD

1. Make sure the proper packages are installed

  yum install sssd libsss_sudo


2. Use authconfig to enable the proper settings to allow authentication via SSSD

  authconfig --enablesssd --enablesssdauth --enablelocauthorize --update


3. Modify /etc/sssd/sssd.conf to reflect the following settings:

  [sssd]
  config_file_version = 2
  services = nss, pam
  domains = default
  [nss]
  filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
  [domain/default]
  ldap_tls_reqcert = never
  auth_provider = ldap
  ldap_schema = rfc2307
  krb5_realm = EXAMPLE.COM
  ldap_search_base = dc=physics,dc=unh,dc=edu
  id_provider = ldap
  ldap_id_use_start_tls = False
  chpass_provider = ldap
  ldap_uri = ldaps://einstein.unh.edu
  krb5_kdcip = kerberos.example.com
  cache_credentials = True
  ldap_tls_cacertdir = /etc/openldap/cacerts
  entry_cache_timeout = 600
  ldap_network_timeout = 3
  ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount))
  ldap_rfc2307_fallback_to_local_users = True
  enumerate = True


4. Modify /etc/openldap/ldap.conf to point to the LDAP server:

  URI ldaps://einstein.unh.edu
  BASE dc=physics,dc=unh,dc=edu
  TLS_CACERTDIR /etc/openldap/cacerts

Note: If you are not able to get back proper information with the 'id' command try removing the ca certs from the /etc/openldap/cacerts/ directory and restarting the sssd service. Always back that directory up before removing the contents of it.

5. Modify /etc/nsswitch.conf to reflect the following settings:

  passwd     files sss
  shadow     files sss
  group      files sss
  sudoers    files sss


6. Restart the sssd service to enable changes:

  service sssd restart


7. To test the configuration, try requesting user information:

  id <username>

Notes

The command 'getent passwd' will not work by default, as SSSD disables user enumeration. Instead, if you specify the user you are looking for, i.e. 'getent passwd <USERNAME>', SSSD will give you the proper information as usual. You can always use the 'id' command for this purpose as well.

External Information