For the forum,
After working with Daniel through his issues with the Leap system and SSSD I can offer the following summary (hoping to help others, obviously):
The fact that the SSSD software stack had already been installed and a configuration attempt(s) already made the logical path to resolution here was:
- Agreement on the desired use case and result
- Discover the current system configuration and make corrections where necessary
- Rejoin the system to the target domain
- Configure the SSSD
- Reconfigure Samba
The system was previously joined to the target domain and using “winbindd” for authentication. This, and the PAM stack configuration in general, was verified using “pam-config”.
~# pam-config --query --ldap
~# pam-config --query --krb5
~# pam-config --query --winbind
~# pam-config --query --sss
~# pam-config --query --mkhomedir
The following changes were made:
~# pam-config --delete --winbind
~# pam-config --add --mkhomedir
The following lined in the /etc/nsswitch.conf were changed from:
passwd compat winbind sss
group compat winbind sss
to:
passwd compat sss
group compat sss
Ensured the Name Service Caching Daemon (nscd) is shut down and disabled. The SSSD will perform session caching and all other user and group caching services.
~# systemctl stop nscd.service
~# systemctl disable nscd.service
Ensured the desired SSSD software stack/providers was installed:
~# zypper install sssd sssd-tools python-sssd-config sssd-ad sssd-ldap
The Leap system was re-configured to use the same time source and participate in the name space as the domain controllers in the target domain.
Server participation in those services was tested:
~# ntpq -p
~# host -t SRV _ldap._tcp.<DOMAIN_FQDN>
~# host -t SRV _kerberos._tcp.<DOMAIN_FQDN>
~# host -t SRV _gc._tcp.<DOMAIN_FQDN>
The existing computer object for the Leap server was deleted, and attempts were made to rejoin the system to the domain using the YaST Domain Membership module, unsuccessfully.
The openLDAP and Kerberos clients were installed and configured to facilitate addition troubleshooting and error capture.
~# zypper install krb5-client openldap2-client
Backup the /etc/krb5.conf and /etc/openldap/ldap.conf files if they exist and implement the following ones:
/etc/krb5.conf:
[libdefaults]
default_realm = <DOMAIN_FQDN>
default_ccache_name = /tmp/krb5cc_%{uid}
[realms]
<DOMAIN_FQDN> = {
kdc = <DC_FQDN>
default_domain = <DOMAIN_FQDN>
admin_server = <DC_FQDN>
}
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[domain_realm]
cantrexnw.local = <DOMAIN_FQDN>
.cantrexnw.local = <DOMAIN_FQDN>
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 10000
clockskew = 300
external = sshd
use_shmem = sshd
}
/etc/openldap/ldap.conf
LDAP Defaults
See ldap.conf(5) for details
This file should be world readable but not world writable.
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
URI ldap://<DC_FQDN>
BASE dc=<DOM_LEV_2>,dc=<DOM_LEV_1>
REFERRALS OFF
Attempted to join the system manually using the samba “net” utility:
~# net ads join -U administrator
Enter administrator’s password:
Failed to join domain: failed to lookup DC info for domain ‘<DOMAIN_FQDN>’ over rpc: Undetermined error
It was verified that there were intermittent DNS issues preventing a DC from being located to perform the join, so the DC’s referenced were added to the /etc/hosts file temporarily to facilite a successful join.
The SSSD was configured and started successfully:
[sssd]
config_file_version = 2
services = nss,pam
domains = <DOMAIN_FQDN>
[nss]
reconnection_retries = 3
filter_users = root,sync,shutdown,halt,pvm
filter_groups = root,utmp,pvm,nscd,nslcd,rpc,rpcuser,gopher,tape,utempter,ntp,video,apache,ftp,lock,ldap,audio,haldaemon,vcsa,tcpdump,sshd,saslauth,dbus,screen,postfix,postdrop,hsqldb,nobody,nfsnobody,mock,stapusr,stapsys,stapdev,abrt,cgred
[pam]
reconnection_retries = 3
[domain/<DOMAIN_FQDN>]
enumerate = false
cache_credentials = true
The Global Catalog provides a subset of object information, which will work in most cases, but if custom attributes
or non-indexed attributes are used disregarding the GC could optimise searches in large environments
ad_enable_gc = false
If dymanic DNS functionality is not configured, consider disabling it for optimisation reasons as well.
dyndns_update = false
id_provider = ad
auth_provider = ad
If no access filter is specified (see below) this directive alone will prevent expired and disabled accounts from logging in
access_provider = ad
Specify filters to use to authorise access to the server, such as group membership or other LDAP filters
ad_access_filter = DOM:<DOMAIN_FQDN>:(memberOf=CN=SOME_AD_GROUP,CN=Users,dc=<DOM_LEV_2>,dc=<DOM_LEV_1>)
ad_access_filter = DOM:<DOMAIN_FQDN>:(&(objectclass=user)(employeeNumber=1234))
When using ID mapping defaults for some POSIX attributes are not specified and left to daemon and the Linux system defaults
default_shell = /bin/bash
Creates a dedicated home directory root for AD user home directories (%d - SSSD domain name), and creates the directory on
login if it doesn’t exist or is not mounted (%u - user name)
override_homedir =/home/%d/%u
The samba file is being adjusted by removing the winbindd directives and modifying group references used for share access control to utilise UPN’s (GROUP@<DOMAIN_FQDN> as opposed to legacy NetBios syntax (DOMAIN/GROUP).
– lawrence