Configuring authentication and authorization in RHEL
Configuring authentication and authorization in RHEL Red Hat Enterprise Linux 8 Using SSSD, authselect, and sssctl to configure authentication and authorization Red Hat Customer Content Services
authselect current Profile ID: sssd Enabled features: - with-sudo - with-mkhomedir - with-smartcard passwd: sss files group: sss files netgroup: sss files automount: sss files services: sss files authselect select sssd passwd: sss files group: sss files netgroup: sss files automount: sss files services: sss files Generated by authselect on Tue Sep 11 22:59:06 2018 Do not modify this file manually. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so authselect select sssd authselect apply-changes authselect create-profile user-profile -b sssd --symlink-meta --symlink-pam New profile was created at /etc/authselect/custom/user-profile authselect select custom/ user-profile hosts: files authselect create-profile user-profile -b sssd --symlink-meta --symlink-pam authselect select custom/ user-profile hosts: files dnf -y install openldap-clients sssd sssd-ldap oddjob-mkhomedir authselect select sssd with-mkhomedir cp core-dirsrv.ca.pem /etc/openldap/certs URI ldap://ldap-server.example.com/ BASE dc=example,dc=com When no CA certificates are specified the Shared System Certificates are in use. In order to have these available along with the ones specified by TLS_CACERTDIR one has to include them explicitly: TLS_CACERT /etc/openldap/certs/core-dirsrv.ca.pem [domain/default] id_provider = ldap autofs_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap-server.example.com/ ldap_search_base = dc=example,dc=com ldap_id_use_start_tls = True cache_credentials = True ldap_tls_cacertdir = /etc/openldap/certs ldap_tls_reqcert = allow [sssd] services = nss, pam, autofs domains = default [nss] homedir_substring = /home ... ... cache_credentials = True ldap_tls_cacert = /etc/openldap/certs/core-dirsrv.ca.pem ldap_tls_reqcert = hard ... chmod 600 /etc/sssd/sssd.conf systemctl restart sssd oddjobd systemctl enable sssd oddjobd update-crypto-policies --set LEGACY id ldap_user uid=17388(ldap_user) gid=45367(sysadmins) groups=45367(sysadmins),25395(engineers),10(wheel),1202200000(admins) (?P<name>[^@]+)@?(?P<domain>[^@]*USD) [sssd] [... file truncated ...] re_expression = (?P<domain>[^\\]*?)\\?(?P<name>[^\\]+USD) [domain/LDAP] [... file truncated ...] re_expression = (?P<domain>[^\\]*?)\\?(?P<name>[^\\]+USD) %1USDs@%2USDs [sssd] [... file truncated ...] full_name_format = %1USDs@%2USDs [domain/ad.domain] [... file truncated ...] full_name_format = %2USDs\%1USDs [domain/ad.domain] [... file truncated ...] full_name_format = %3USDs\%1USDs [domain/ your-domain-name ] cache_credentials = true [pam] offline_credentials_expiration = 3 [domain/ your-domain-name ] id_provider = ldap ldap_uri = _srv_ [domain/ your-domain-name ] id_provider = ldap ldap_uri = _srv_ chpass_provider = ldap ldap_chpass_dns_service_name = ldap _service._protocol._domain TTL priority weight port host_name [domain/ your-domain-name ] access_provider = simple [domain/ your-domain-name ] access_provider = simple simple_allow_users = user1, user2 simple_allow_groups = group1 [domain/ your-AD-domain-name ] access provider = ad [... file truncated ...] ad_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*)) ad_gpo_access_control = disabled [domain/example.com] access_provider = ldap ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com ldap_access_order = filter, host, authorized_service id username sss_override user-add username -n secondary-username systemctl restart sssd id secondary-username sss_override user-show user-name user@ldap.example.com: secondary-username :::::: id sjones uid=1001( sjones ) gid=6003 groups=6003,10(wheel) sss_override user-add sjones -n sarah id sarah uid=1001(sjones) gid=6003(sjones) groups=6003(sjones),10(wheel) sss_override user-show sjones user@ldap.example.com: sarah :::::: id -u user-name sss_override user-add user-name -u new-UID sss_cache --users systemctl restart sssd id -u user-name sss_override user-show user-name user@ldap.example.com:: new-UID ::::: id -u sarah 1001 sss_override user-add sarah -u 6666 sss_cache --users systemctl restart sssd id sarah 6666 sss_override user-show sarah user@ldap.example.com::6666::::: id -g user-name sss_override user-add user-name -g new-GID sss_cache --users systemctl restart sssd id -g user-name sss_override user-show user-name user@ldap.example.com::: 6666 :::: id -g sarah 6003 sss_override user-add sarah -g 6666 sss_cache --users systemctl restart sssd id -g sarah 6666 sss_override user-show sarah user@ldap.example.com::6666::::: getent passwd user-name user-name :x:XXXX:XXXX::/home/ home-directory :/bin/bash sss_override user-add user-name -h new-home-directory systemctl restart sssd getent passwd user-name user-name :x:XXXX:XXXX::/home/ new-home-directory :/bin/bash sss_override user-show user-name user@ldap.example.com::::::: new-home-directory :: getent passwd sarah sarah :x:1001:6003:: sarah :/bin/bash sss_override user-add sarah -h admin systemctl restart sssd getent passwd sarah sarah :x:1001:6003:: admin :/bin/bash sss_override user-show user-name user@ldap.example.com::::::: admin :: getent passwd user-name user-name :x:XXXX:XXXX::/home/home-directory: /bin/bash sss_override user-add user-name -s new-shell systemctl restart sssd getent passwd user-name user-name :x:XXXX:XXXX::/home/home-directory: new-shell sss_override user-show user-name user@ldap.example.com:::::: new-shell : getent passwd sarah sarah :x:1001:6003:: sarah : /bin/bash sss_override user-add sarah -s /sbin/nologin systemctl restart sssd getent passwd sarah sarah :x:1001:6003:: sarah : /sbin/nologin sss_override user-show user-name user@ldap.example.com:::::: /sbin/nologin : sss_override user-find user1@ldap.example.com::8000::::/bin/zsh: user2@ldap.example.com::8001::::/bin/bash: sss_override group-find group1@ldap.example.com::7000 group2@ldap.example.com::7001 sss_override user-del user-name sss_override group-del group-name systemctl restart sssd sss_override user-export /var/lib/sss/backup/sssd_user_overrides.bak sss_override group-export /var/lib/sss/backup/sssd_group_overrides.bak sss_override user-import /var/lib/sss/backup/sssd_user_overrides.bak sss_override group-import /var/lib/sss/backup/sssd_group_overrides.bak dnf install sssd-proxy useradd AD_user passwd: sss files systemd group: sss files systemd shadow: files sss To opt out of the system crypto-policies configuration of krb5, remove the symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt spake_preauth_groups = edwards25519 default_realm = EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { kdc = ad.example.com admin_server = ad.example.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [sssd] services = nss, pam domains = EXAMPLE.COM [domain/EXAMPLE.COM] id_provider = proxy proxy_lib_name = files auth_provider = krb5 krb5_realm = EXAMPLE.COM krb5_server = ad.example.com chmod 600 /etc/sssd/sssd.conf systemctl start sssd systemctl enable sssd Generated by authselect on Wed May 8 08:55:04 2019 Do not modify this file manually. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so cp /etc/pam.d/system-auth /etc/pam.d/password-auth cp: overwrite '/etc/pam.d/password-auth'? yes kinit AD_user Password for AD_user@EXAMPLE.COM: klist Ticket cache: KEYRING:persistent:0:0 Default principal: AD_user@EXAMPLE.COM Valid starting Expires Service principal 11/02/20 04:16:38 11/02/20 14:16:38 krbtgt/EXAMPLE.COM@EXAMPLE.COM renew until 18/02/20 04:16:34 sssctl access-report idm.example.com 1 rule cached Rule name: example.user Member users: example.user Member services: sshd sssctl user-checks -a acct -s sshd example.user user: example.user action: acct service: sshd . sssctl --help . sssctl domain-list implicit_files idm.example.com ad.example.com sub1.ad.example.com sssctl --help sssctl domain-status idm.example.com Online status: Online Active servers: IPA: server.idm.example.com Discovered IPA servers: - server.idm.example.com sssctl domain-status ad.example.com Unable to get online status auth required pam_sss.so domains= [sssd] domains = domain1, domain2, domain3 auth sufficient pam_sss.so forward_pass domains=domain1 account [default=bad success=ok user_unknown=ignore] pam_sss.so password sufficient pam_sss.so use_authtok module_type control_flag module_name module_arguments auth required pam_unix.so #%PAM-1.0 auth required pam_securetty.so 1 auth required pam_unix.so nullok 2 auth required pam_nologin.so 3 account required pam_unix.so 4 password required pam_pwquality.so retry=3 5 password required pam_unix.so shadow nullok use_authtok 6 session required pam_unix.so 7 authselect apply-changes -b --backup=ldap-configuration-backup yum install sssd-ldap sssd-ad sssd-client sssd-common sssd-common-pac sssd-krb5 sssd-krb5-common systemctl stop nslcd nscd systemctl disable nslcd nscd authselect select sssd with-mkhomedir --force chown root:root /etc/sssd/sssd.conf chmod 600 /etc/sssd/sssd.conf [sssd] config_file_version = 2 services = nss, pam domains = EXAMPLE.COM debug_level = 6 [domain/EXAMPLE.COM] id_provider = ldap auth_provider = ldap ldap_uri = ldap://server.example.com/ ldap_search_base = dc=example,dc=com ldap_default_bind_dn = CN=binddn,DC=example,DC=com ldap_default_authtok_type = password ldap_default_authtok = <bind_account_password> cache_credentials = True ldap_schema = rfc2307bis ldap_schema = ad systemctl enable sssd systemctl start sssd id ldapuser uid=100424(ldapuser) gid=100424(ldapuser) groups=100424(ldapuser) getent passwd ldapuser ldapuser:*: 100424: 100424:User, LDAP:/home/ldapuser:/bin/bash ssh -l ldapuser localhost ldapuser@localhost's password: Last login: Tue Dec 07 19:34:35 2021 from localhost -sh-4.2USD authselect backup-restore=ldap-configuration-backup systemctl stop sssd && systemctl disable sssd systemctl start nslcd nscd systemctl enable nslcd nscd sssctl config-check Issues identified by validators: 1 [rule/allowed_domain_options]: Attribute 'ldap_search' is not allowed in section 'domain/example1'. Check for typos. Messages generated during configuration merging: 0 Used configuration snippet files: 0 [...] [domain/example1] ldap_search_base = dc=example,dc=com [...] systemctl restart sssd sssctl config-check Issues identified by validators: 0 Messages generated during configuration merging: 0 Used configuration snippet files: 0 auth sufficient pam_sss.so pstree -a | grep sssd |-sssd -i --logger=files | |-sssd_be --domain implicit_files --uid 0 --gid 0 --logger=files | |- sssd_be --domain example.com --uid 0 --gid 0 --logger=files | |-sssd_ifp --uid 0 --gid 0 --logger=files | |- sssd_nss --uid 0 --gid 0 --logger=files | |-sssd_pac --uid 0 --gid 0 --logger=files | |- sssd_pam --uid 0 --gid 0 --logger=files | |- sssd_ssh --uid 0 --gid 0 --logger=files | `-sssd_sudo --uid 0 --gid 0 --logger=files |-sssd_kcm --uid 0 --gid 0 --logger=files [user@client ~]USD ping <IP_address_of_the_database_server> [user@client ~]USD dig -t SRV _ldap._tcp.example.com @<name_server> [user@client ~]USD ping <fully_qualified_host_name_of_the_server> [user@client ~]USD kinit -k 'host/client.example.com@EXAMPLE.COM' [user@client ~]USD ldapsearch -LLL -Y GSSAPI -h server.example.com -b "dc=example,dc=com" uid= <user_name> [user@client ~]USD kinit -k 'CLIENTUSD@AD.EXAMPLE.COM' [user@client ~]USD ldapsearch -LLL -Y GSSAPI -h server.ad.example.com -b "dc=example,dc=com" sAMAccountname= <user_name> [user@client ~]USD ldapsearch -xLLL -D "cn=ldap_default_bind_dn_value" -W -h ldapserver.example.com -b "dc=example,dc=com" uid= <user_name> [user@client ~]USD kinit <user_name> [user@client ~]USD kinit <user_name@AD.EXAMPLE.COM> [user@client ~]USD getent passwd <user_name> [user@client ~]USD id <user_name> [user@client ~]USD sudo sssctl user-checks -a auth -s ssh <user_name> ls -l /var/log/sssd/ total 620 -rw-------. 1 root root 0 Mar 29 09:21 krb5_child.log -rw-------. 1 root root 14324 Mar 29 09:50 ldap_child.log -rw-------. 1 root root 212870 Mar 29 09:50 sssd_example.com.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_ifp.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_implicit_files.log -rw-------. 1 root root 0 Mar 29 09:21 sssd.log -rw-------. 1 root root 219873 Mar 29 10:03 sssd_nss.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_pac.log -rw-------. 1 root root 13105 Mar 29 09:21 sssd_pam.log -rw-------. 1 root root 9390 Mar 29 09:21 sssd_ssh.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_sudo.log [domain/example.com] debug_level = 6 id_provider = ipa [sssd] debug_level = 6 services = nss, pam, ifp, ssh, sudo domains = example.com [nss] debug_level = 6 [pam] debug_level = 6 [sudo] debug_level = 6 [ssh] debug_level = 6 [pac] debug_level = 6 [ifp] debug_level = 6 systemctl restart sssd sssctl debug-level 6 sssctl debug-level 6 sssctl cache-expire -u idmuser sssctl logs-remove date; su idmuser ; date Mon Mar 29 15:33:48 EDT 2021 su: user idmuser does not exist Mon Mar 29 15:33:49 EDT 2021 sssctl debug-level 2 (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][ name=idmuser@example.com ] (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=idmuser)(objectclass=posixAccount)(uid= )(&(uidNumber= )(!(uidNumber=0))))][cn=accounts,dc=example,dc=com]. (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sysdb_search_by_name] (0x0400): No such entry (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sysdb_search_by_name] (0x0400): No such entry (Mon Mar 29 15:33:49 2021) [sssd[be[example.com]]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request sssctl logs-fetch sssd-logs-Mar29.tar date; id idmuser; date Mon Mar 29 15:33:48 EDT 2021 id: 'idmuser': no such user Mon Mar 29 15:33:49 EDT 2021 [domain/example.com] ipa_server = server.example.com systemctl restart sssd sssctl debug-level 6 sssctl debug-level 6 sssctl cache-expire -u idmuser sssctl cache-expire -u idmuser sssctl logs-remove sssctl logs-remove date; su idmuser; date Mon Mar 29 16:20:13 EDT 2021 su: user idmuser does not exist Mon Mar 29 16:20:14 EDT 2021 sssctl debug-level 0 sssctl debug-level 0 sssctl logs-fetch sssd-logs-server-Mar29.tar sssctl logs-fetch sssd-logs-client-Mar29.tar date; su idmuser ; date Mon Mar 29 16:20:13 EDT 2021 su: user idmuser does not exist Mon Mar 29 16:20:14 EDT 2021 less /var/log/sssd/sssd_example.com.log (2021-07-26 18:26:37): [be[testidm.com]] [dp_req_destructor] (0x0400): [RID#3] Number of active DP request: 0 (2021-07-26 18:26:37): [be[testidm.com]] [dp_req_reply_std] (0x1000): [RID#3] DP Request AccountDomain #3: Returning [Internal Error]: 3,1432158301,GetAccountDomain() not supported (2021-07-26 18:26:37): [be[testidm.com]] [dp_attach_req] (0x0400): [RID#4] DP Request Account #4: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-07-26 18:26:37): [be[testidm.com]] [dp_attach_req] (0x0400): [RID#4] Number of active DP request: 1 (2021-10-29 13:24:16): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#5] DP Request [Account #5]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:16): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#6] DP Request [AccountDomain #6]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:16): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#7] DP Request [Account #7]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#8] DP Request [Initgroups #8]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#9] DP Request [Account #9]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#10] DP Request [Account #10]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#11] DP Request [Account #11]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#12] DP Request [Account #12]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#13] DP Request [Account #13]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. sssctl analyze request list -v sssctl analyze request show 20 sssctl analyze request --logdir=/tmp/var/log/sssd [jsmith@host ~] USD kinit Password for jsmith@EXAMPLE.COM: