Configuring authentication and authorization in RHEL Red Hat Enterprise Linux 9 Using SSSD, authselect, and sssctl to configure authentication and authorization Red Hat Customer Content Services

Commands:
authselect current Profile ID: sssd Enabled features: - with-sudo - with-mkhomedir - with-smartcard
passwd: sss files group: sss files netgroup: sss files automount: sss files services: sss files
authselect select sssd
passwd: sss files group: sss files netgroup: sss files automount: sss files services: sss files
Generated by authselect on Tue Sep 11 22:59:06 2018 Do not modify this file manually. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so
authselect select sssd
authselect apply-changes
authselect create-profile user-profile -b sssd --symlink-meta --symlink-pam New profile was created at /etc/authselect/custom/user-profile
authselect select custom/ user-profile
hosts: files
authselect create-profile user-profile -b sssd --symlink-meta --symlink-pam
authselect select custom/ user-profile
hosts: files
dnf -y install openldap-clients sssd sssd-ldap oddjob-mkhomedir
authselect select sssd with-mkhomedir
cp core-dirsrv.ca.pem /etc/openldap/certs
URI ldap://ldap-server.example.com/ BASE dc=example,dc=com
When no CA certificates are specified the Shared System Certificates are in use. In order to have these available along with the ones specified by TLS_CACERTDIR one has to include them explicitly: TLS_CACERT /etc/openldap/certs/core-dirsrv.ca.pem
[domain/default] id_provider = ldap autofs_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap-server.example.com/ ldap_search_base = dc=example,dc=com ldap_id_use_start_tls = True cache_credentials = True ldap_tls_cacertdir = /etc/openldap/certs ldap_tls_reqcert = allow [sssd] services = nss, pam, autofs domains = default [nss] homedir_substring = /home ...
... cache_credentials = True ldap_tls_cacert = /etc/openldap/certs/core-dirsrv.ca.pem ldap_tls_reqcert = hard ...
chmod 600 /etc/sssd/sssd.conf
systemctl restart sssd oddjobd systemctl enable sssd oddjobd
update-crypto-policies --set LEGACY
id ldap_user uid=17388(ldap_user) gid=45367(sysadmins) groups=45367(sysadmins),25395(engineers),10(wheel),1202200000(admins)
(?P<name>[^@]+)@?(?P<domain>[^@]*USD)
[sssd] [... file truncated ...] re_expression = (?P<domain>[^\\]*?)\\?(?P<name>[^\\]+USD)
[domain/LDAP] [... file truncated ...] re_expression = (?P<domain>[^\\]*?)\\?(?P<name>[^\\]+USD)
%1USDs@%2USDs
[sssd] [... file truncated ...] full_name_format = %1USDs@%2USDs
[domain/ad.domain] [... file truncated ...] full_name_format = %2USDs\%1USDs
[domain/ad.domain] [... file truncated ...] full_name_format = %3USDs\%1USDs
[domain/ your-domain-name ] cache_credentials = true
[pam] offline_credentials_expiration = 3
[domain/ your-domain-name ] id_provider = ldap ldap_uri = _srv_
[domain/ your-domain-name ] id_provider = ldap ldap_uri = _srv_ chpass_provider = ldap ldap_chpass_dns_service_name = ldap
_service._protocol._domain TTL priority weight port host_name
[domain/ your-domain-name ] access_provider = simple
[domain/ your-domain-name ] access_provider = simple simple_allow_users = user1, user2 simple_allow_groups = group1
[domain/ your-AD-domain-name ] access provider = ad [... file truncated ...] ad_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*)) ad_gpo_access_control = disabled
[domain/example.com] access_provider = ldap ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com ldap_access_order = filter, host, authorized_service
id username
sss_override user-add username -n secondary-username
systemctl restart sssd
id secondary-username
sss_override user-show user-name user@ldap.example.com: secondary-username ::::::
id sjones uid=1001( sjones ) gid=6003 groups=6003,10(wheel)
sss_override user-add sjones -n sarah
id sarah uid=1001(sjones) gid=6003(sjones) groups=6003(sjones),10(wheel) sss_override user-show sjones user@ldap.example.com: sarah ::::::
id -u user-name
sss_override user-add user-name -u new-UID
sss_cache --users
systemctl restart sssd
id -u user-name
sss_override user-show user-name user@ldap.example.com:: new-UID :::::
id -u sarah 1001
sss_override user-add sarah -u 6666
sss_cache --users
systemctl restart sssd
id sarah 6666 sss_override user-show sarah user@ldap.example.com::6666:::::
id -g user-name
sss_override user-add user-name -g new-GID
sss_cache --users
systemctl restart sssd
id -g user-name
sss_override user-show user-name user@ldap.example.com::: 6666 ::::
id -g sarah 6003
sss_override user-add sarah -g 6666
sss_cache --users
systemctl restart sssd
id -g sarah 6666 sss_override user-show sarah user@ldap.example.com::6666:::::
getent passwd user-name user-name :x:XXXX:XXXX::/home/ home-directory :/bin/bash
sss_override user-add user-name -h new-home-directory
systemctl restart sssd
getent passwd user-name user-name :x:XXXX:XXXX::/home/ new-home-directory :/bin/bash
sss_override user-show user-name user@ldap.example.com::::::: new-home-directory ::
getent passwd sarah sarah :x:1001:6003:: sarah :/bin/bash
sss_override user-add sarah -h admin
systemctl restart sssd
getent passwd sarah sarah :x:1001:6003:: admin :/bin/bash sss_override user-show user-name user@ldap.example.com::::::: admin ::
getent passwd user-name user-name :x:XXXX:XXXX::/home/home-directory: /bin/bash
sss_override user-add user-name -s new-shell
systemctl restart sssd
getent passwd user-name user-name :x:XXXX:XXXX::/home/home-directory: new-shell
sss_override user-show user-name user@ldap.example.com:::::: new-shell :
getent passwd sarah sarah :x:1001:6003:: sarah : /bin/bash
sss_override user-add sarah -s /sbin/nologin
systemctl restart sssd
getent passwd sarah sarah :x:1001:6003:: sarah : /sbin/nologin sss_override user-show user-name user@ldap.example.com:::::: /sbin/nologin :
sss_override user-find user1@ldap.example.com::8000::::/bin/zsh: user2@ldap.example.com::8001::::/bin/bash:
sss_override group-find group1@ldap.example.com::7000 group2@ldap.example.com::7001
sss_override user-del user-name
sss_override group-del group-name
systemctl restart sssd
sss_override user-export /var/lib/sss/backup/sssd_user_overrides.bak sss_override group-export /var/lib/sss/backup/sssd_group_overrides.bak
sss_override user-import /var/lib/sss/backup/sssd_user_overrides.bak sss_override group-import /var/lib/sss/backup/sssd_group_overrides.bak
dnf install sssd-proxy
useradd AD_user
passwd: sss files systemd group: sss files systemd shadow: files sss
To opt out of the system crypto-policies configuration of krb5, remove the symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt spake_preauth_groups = edwards25519 default_realm = EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { kdc = ad.example.com admin_server = ad.example.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM
[sssd] services = nss, pam domains = EXAMPLE.COM [domain/EXAMPLE.COM] id_provider = proxy proxy_lib_name = files auth_provider = krb5 krb5_realm = EXAMPLE.COM krb5_server = ad.example.com
chmod 600 /etc/sssd/sssd.conf
systemctl start sssd
systemctl enable sssd
Generated by authselect on Wed May 8 08:55:04 2019 Do not modify this file manually. auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so
cp /etc/pam.d/system-auth /etc/pam.d/password-auth cp: overwrite '/etc/pam.d/password-auth'? yes
kinit AD_user Password for AD_user@EXAMPLE.COM:
klist Ticket cache: KEYRING:persistent:0:0 Default principal: AD_user@EXAMPLE.COM Valid starting Expires Service principal 11/02/20 04:16:38 11/02/20 14:16:38 krbtgt/EXAMPLE.COM@EXAMPLE.COM renew until 18/02/20 04:16:34
sssctl access-report idm.example.com 1 rule cached Rule name: example.user Member users: example.user Member services: sshd
sssctl user-checks -a acct -s sshd example.user user: example.user action: acct service: sshd .
sssctl --help .
sssctl domain-list implicit_files idm.example.com ad.example.com sub1.ad.example.com
sssctl --help
sssctl domain-status idm.example.com Online status: Online Active servers: IPA: server.idm.example.com Discovered IPA servers: - server.idm.example.com
sssctl domain-status ad.example.com Unable to get online status
auth required pam_sss.so domains=
[sssd] domains = domain1, domain2, domain3
auth sufficient pam_sss.so forward_pass domains=domain1 account [default=bad success=ok user_unknown=ignore] pam_sss.so password sufficient pam_sss.so use_authtok
module_type control_flag module_name module_arguments
auth required pam_unix.so
#%PAM-1.0 auth required pam_securetty.so 1 auth required pam_unix.so nullok 2 auth required pam_nologin.so 3 account required pam_unix.so 4 password required pam_pwquality.so retry=3 5 password required pam_unix.so shadow nullok use_authtok 6 session required pam_unix.so 7
sssctl config-check Issues identified by validators: 1 [rule/allowed_domain_options]: Attribute 'ldap_search' is not allowed in section 'domain/example1'. Check for typos. Messages generated during configuration merging: 0 Used configuration snippet files: 0
[...] [domain/example1] ldap_search_base = dc=example,dc=com [...]
systemctl restart sssd
sssctl config-check Issues identified by validators: 0 Messages generated during configuration merging: 0 Used configuration snippet files: 0
auth sufficient pam_sss.so
pstree -a | grep sssd |-sssd -i --logger=files | |-sssd_be --domain implicit_files --uid 0 --gid 0 --logger=files | |- sssd_be --domain example.com --uid 0 --gid 0 --logger=files | |-sssd_ifp --uid 0 --gid 0 --logger=files | |- sssd_nss --uid 0 --gid 0 --logger=files | |-sssd_pac --uid 0 --gid 0 --logger=files | |- sssd_pam --uid 0 --gid 0 --logger=files | |- sssd_ssh --uid 0 --gid 0 --logger=files | `-sssd_sudo --uid 0 --gid 0 --logger=files |-sssd_kcm --uid 0 --gid 0 --logger=files
[user@client ~]USD ping <IP_address_of_the_database_server>
[user@client ~]USD dig -t SRV _ldap._tcp.example.com @<name_server> [user@client ~]USD ping <fully_qualified_host_name_of_the_server>
[user@client ~]USD kinit -k 'host/client.example.com@EXAMPLE.COM' [user@client ~]USD ldapsearch -LLL -Y GSSAPI -h server.example.com -b "dc=example,dc=com" uid= <user_name>
[user@client ~]USD kinit -k 'CLIENTUSD@AD.EXAMPLE.COM' [user@client ~]USD ldapsearch -LLL -Y GSSAPI -h server.ad.example.com -b "dc=example,dc=com" sAMAccountname= <user_name>
[user@client ~]USD ldapsearch -xLLL -D "cn=ldap_default_bind_dn_value" -W -h ldapserver.example.com -b "dc=example,dc=com" uid= <user_name>
[user@client ~]USD kinit <user_name>
[user@client ~]USD kinit <user_name@AD.EXAMPLE.COM>
[user@client ~]USD getent passwd <user_name> [user@client ~]USD id <user_name>
[user@client ~]USD sudo sssctl user-checks -a auth -s ssh <user_name>
ls -l /var/log/sssd/ total 620 -rw-------. 1 root root 0 Mar 29 09:21 krb5_child.log -rw-------. 1 root root 14324 Mar 29 09:50 ldap_child.log -rw-------. 1 root root 212870 Mar 29 09:50 sssd_example.com.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_ifp.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_implicit_files.log -rw-------. 1 root root 0 Mar 29 09:21 sssd.log -rw-------. 1 root root 219873 Mar 29 10:03 sssd_nss.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_pac.log -rw-------. 1 root root 13105 Mar 29 09:21 sssd_pam.log -rw-------. 1 root root 9390 Mar 29 09:21 sssd_ssh.log -rw-------. 1 root root 0 Mar 29 09:21 sssd_sudo.log
[domain/example.com] debug_level = 6 id_provider = ipa [sssd] debug_level = 6 services = nss, pam, ifp, ssh, sudo domains = example.com [nss] debug_level = 6 [pam] debug_level = 6 [sudo] debug_level = 6 [ssh] debug_level = 6 [pac] debug_level = 6 [ifp] debug_level = 6
systemctl restart sssd
sssctl debug-level 6
sssctl debug-level 6
sssctl cache-expire -u idmuser
sssctl logs-remove
date; su idmuser ; date Mon Mar 29 15:33:48 EDT 2021 su: user idmuser does not exist Mon Mar 29 15:33:49 EDT 2021
sssctl debug-level 2
(Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][ name=idmuser@example.com ] (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=idmuser)(objectclass=posixAccount)(uid= )(&(uidNumber= )(!(uidNumber=0))))][cn=accounts,dc=example,dc=com]. (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sysdb_search_by_name] (0x0400): No such entry (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Mon Mar 29 15:33:48 2021) [sssd[be[example.com]]] [sysdb_search_by_name] (0x0400): No such entry (Mon Mar 29 15:33:49 2021) [sssd[be[example.com]]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request
sssctl logs-fetch sssd-logs-Mar29.tar
date; id idmuser; date Mon Mar 29 15:33:48 EDT 2021 id: 'idmuser': no such user Mon Mar 29 15:33:49 EDT 2021
[domain/example.com] ipa_server = server.example.com
systemctl restart sssd
sssctl debug-level 6
sssctl debug-level 6
sssctl cache-expire -u idmuser
sssctl cache-expire -u idmuser
sssctl logs-remove
sssctl logs-remove
date; su idmuser; date Mon Mar 29 16:20:13 EDT 2021 su: user idmuser does not exist Mon Mar 29 16:20:14 EDT 2021
sssctl debug-level 0
sssctl debug-level 0
sssctl logs-fetch sssd-logs-server-Mar29.tar
sssctl logs-fetch sssd-logs-client-Mar29.tar
date; su idmuser ; date Mon Mar 29 16:20:13 EDT 2021 su: user idmuser does not exist Mon Mar 29 16:20:14 EDT 2021
less /var/log/sssd/sssd_example.com.log
(2021-07-26 18:26:37): [be[testidm.com]] [dp_req_destructor] (0x0400): [RID#3] Number of active DP request: 0 (2021-07-26 18:26:37): [be[testidm.com]] [dp_req_reply_std] (0x1000): [RID#3] DP Request AccountDomain #3: Returning [Internal Error]: 3,1432158301,GetAccountDomain() not supported (2021-07-26 18:26:37): [be[testidm.com]] [dp_attach_req] (0x0400): [RID#4] DP Request Account #4: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-07-26 18:26:37): [be[testidm.com]] [dp_attach_req] (0x0400): [RID#4] Number of active DP request: 1
(2021-10-29 13:24:16): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#5] DP Request [Account #5]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:16): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#6] DP Request [AccountDomain #6]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:16): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#7] DP Request [Account #7]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#8] DP Request [Initgroups #8]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#9] DP Request [Account #9]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#10] DP Request [Account #10]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#11] DP Request [Account #11]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#12] DP Request [Account #12]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001]. (2021-10-29 13:24:17): [be[ad.vm]] [dp_attach_req] (0x0400): [RID#13] DP Request [Account #13]: REQ_TRACE: New request. [sssd.nss CID #1] Flags [0x0001].
sssctl analyze request list -v
sssctl analyze request show 20
sssctl analyze request --logdir=/tmp/var/log/sssd
[jsmith@host ~] USD kinit Password for jsmith@EXAMPLE.COM: