SSSD - Revision history

Tgurr at 11:46, 13 May 2013

2013-05-13T11:46:09Z

← Older revision		Revision as of 13:46, 13 May 2013
Line 137:		Line 137:

	== Testing ==		== Testing ==

	{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.		{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.

	== Add additional user groups to existing users ==		== Add additional user groups to existing users ==
	{{Root\|usermod -a -G wheel,kvm <user>}}		{{Root\|usermod -a -G wheel,kvm <user>}}

			== Documentation ==
			https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ad2008-example.html

2013-05-13T11:31:03Z

Add addition user groups to existing users

← Older revision		Revision as of 13:31, 13 May 2013
Line 140:		Line 140:
	{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.		{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.

	== Add ~~addition~~ user groups to existing users ==		== Add additional user groups to existing users ==
	{{Root\|usermod -a -G wheel,kvm <user>}}		{{Root\|usermod -a -G wheel,kvm <user>}}

2013-05-13T11:30:56Z

Add User Permissions

← Older revision		Revision as of 13:30, 13 May 2013
Line 140:		Line 140:
	{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.		{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.

	== Add ~~User Permissions~~ ==		== Add addition user groups to existing users ==
	{{Root\|usermod -a -G wheel,kvm <user>}}		{{Root\|usermod -a -G wheel,kvm <user>}}

2013-05-13T11:30:21Z

← Older revision		Revision as of 13:30, 13 May 2013
Line 139:		Line 139:

	{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.		{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.

			== Add User Permissions ==
			{{Root\|usermod -a -G wheel,kvm <user>}}

2013-05-13T11:29:18Z

← Older revision		Revision as of 13:29, 13 May 2013
Line 1:		Line 1:
			SSSD obsoletes the old nss_ldap & pam_ldap combination and is also an successor to nss-pam-ldapd and pam_krb5.

	The following examples have been tested against Active Directory in 2003 mode.		The following examples have been tested against Active Directory in 2003 mode.

2013-05-13T10:58:31Z

← Older revision		Revision as of 12:58, 13 May 2013
Line 1:		Line 1:
	The following examples have been tested against Active Directory in 2003 mode.		The following examples have been tested against Active Directory in 2003 mode.

			== Basic configuration ==
	{{File\|/etc/nsswitch.conf\|		{{File\|/etc/nsswitch.conf\|
	<pre>		<pre>
Line 132:		Line 133:
	</pre>		</pre>
	}}		}}

			== Testing ==

			{{Root\|getent passwd domainuser}} has to return a full working passwd entry including uid/guid, home directory and shell to be able to login.

2013-05-13T10:56:21Z

← Older revision		Revision as of 12:56, 13 May 2013
Line 8:		Line 8:
	</pre>		</pre>
	}}		}}


	{{File\|/etc/pam.d/system-auth\|		{{File\|/etc/pam.d/system-auth\|
Line 33:		Line 34:
	</pre>		</pre>
	}}		}}

			{{Root\|/etc/init.d/sssd start}}

			{{Root\|rc-update add sssd default}}

	== LDAP (works without Samba) ==		== LDAP (works without Samba) ==

2013-05-13T10:54:19Z

← Older revision		Revision as of 12:54, 13 May 2013
Line 1:		Line 1:
	The following examples have been tested against Active Directory in 2003 mode.		The following examples have been tested against Active Directory in 2003 mode.

			{{File\|/etc/nsswitch.conf\|
			<pre>
			passwd: compat sss
			shadow: compat sss
			group: compat sss
			</pre>
			}}

			{{File\|/etc/pam.d/system-auth\|
			<pre>
			auth required pam_env.so
			auth sufficient pam_unix.so try_first_pass likeauth nullok
			auth sufficient pam_sss.so use_first_pass
			auth optional pam_permit.so

			account required pam_unix.so
			account [default=bad success=ok user_unknown=ignore] pam_sss.so
			account optional pam_permit.so

			password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
			password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow
			password sufficient pam_sss.so use_authtok
			password optional pam_permit.so

			session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 silent
			session required pam_limits.so
			session required pam_env.so
			session required pam_unix.so
			session optional pam_sss.so
			session optional pam_permit.so
			</pre>
			}}

	== LDAP (works without Samba) ==		== LDAP (works without Samba) ==

2013-05-13T10:51:45Z

← Older revision		Revision as of 12:51, 13 May 2013
Line 62:		Line 62:
	== AD (requires Samba) ==		== AD (requires Samba) ==

	First you need to setup [[Kerberos]] and [[Samba]].		First you need to setup [[Kerberos]], configure and join [[Samba]] to your domain.

	{{File\|/etc/sssd/sssd.conf\|		{{File\|/etc/sssd/sssd.conf\|

2013-05-13T10:50:53Z

← Older revision		Revision as of 12:50, 13 May 2013
Line 60:		Line 60:
	}}		}}

	== AD (~~required~~ Samba) ==		== AD (requires Samba) ==

			First you need to setup [[Kerberos]] and [[Samba]].

	{{File\|/etc/sssd/sssd.conf\|		{{File\|/etc/sssd/sssd.conf\|
	<pre>		<pre>