[Samba] Linux client of the domain - SSSD : authenticating via Kerberos

[Cyril]

Le 20/12/2013 16:18, steve a écrit :
> On Fri, 2013-12-20 at 15:28 +0100, Cyril wrote:
>> Le 20/12/2013 15:05, steve a écrit :
>>> On Fri, 2013-12-20 at 14:48 +0100, Cyril wrote:
>>>>>
>>>>> I'll do some more testing. Re-try on a fresh install
>>>>> And I'll do a summary.
>>>>>
>>>>>
>>>>> Cyril
>>>>>
>>>>
>>>> I still have issue :
>>>>
>>>> When installing libpam-sss,
>>>> there's a dependency libpam-pwquality (>= 1.2.2-1)
>>>> But I can't find it in ubuntu 12.04.
>>>>
>>>> So I deactivate the ppa for ssd
>>>>
>>>> And I install an older version of libnss-sss.
>>>>
>>>> Now If I try to open a session on the workstation :
>>>>
>>>> with "NT4Domain/MyUser"
>>>> Dec 20 13:47:12 cyril-VB lightdm: pam_sss(lightdm:auth): authentication
>>>> failure; logname= uid=0 euid=0  tty=:1 ruser= rhost= user=NT4Domain/MyUser
>>>> Dec 20 13:47:12 cyril-VB lightdm: pam_sss(lightdm:auth): received for
>>>> user NT4Domain/MyUser: 10 (User not known to the underlying
>>>> authentication module)
>>>>
>>>> with "Myuser"
>>>> Dec 20 14:07:55 cyril-VB lightdm: pam_succeed_if(lightdm:auth):
>>>> requirement "user ingroup nopasswdlogin" not met by user "Myuser"
>>>> Dec 20 14:07:59 cyril-VB lightdm: pam_unix(lightdm:auth): authentication
>>>> failure; logname= uid=0 euid=0 tty=:1 ruser= rhost=  user=Myuser
>>>> Dec 20 14:07:59 cyril-VB lightdm: pam_sss(lightdm:auth): authentication
>>>> failure; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=Myuser
>>>> Dec 20 14:07:59 cyril-VB lightdm: pam_sss(lightdm:auth): received for
>>>> user Myuser: 9 (Authentication service cannot retrieve authentication info)
>>>>
>>>> "Myuser" is an existing user on the domain and It does have Unix
>>>> attribut (UID and GID)
>>>>
>>>> Is there any way to install libpam-pwquality manually or from any ppa ?
>>>> and then use the newer libnss-sss ?
>>>>
>>>>
>>>> Cyril
>>>>
>>>
>>> Yep, OK. As I predicted, pam is the next issue.
>>>
>>> It looks like you have a different /etc/pam.d/common-auth to the one you
>>> originally posted. Can you post the latest version?
>>>
>>> I'm not sure if
>>> pam-auth-update
>>> is new enough to include sssd yet, but cold you give it a go anyway?
>>> Steve
>>>
>>>
>> Here is the common-auth after a pam-auth-update
>>
>> # here are the per-package modules (the "Primary" block)
>> auth    [success=2 default=ignore]      pam_unix.so nullok_secure
>> auth    [success=1 default=ignore]      pam_sss.so use_first_pass
>> # here's the fallback if no module succeeds
>> auth    requisite                       pam_deny.so
>> # prime the stack with a positive return value if there isn't one already;
>> # this avoids us returning an error just because nothing sets a success code
>> # since the modules above will each just jump around
>> auth    required                        pam_permit.so
>> # and here are more per-package modules (the "Additional" block)
>> auth    optional                        pam_cap.so
>> # end of pam-auth-update config
>>
>> Cyril
>>
>>
>>
> Mmm. Looks complex. On an openSUSE client, we have simply:
>
> auth    required        pam_env.so
> auth    sufficient      pam_unix.so     try_first_pass
> auth    required        pam_sss.so      use_first_pass
>
> I know Ubuntu like to do it a la Debian so maybe not take too much
> notice of that, and anyway, you need a pam_sss.so which is sssd version
> friendly first. We'll also need to look at session. Meanwhile, good luck
> with the build.
> Steve
>
>
I had a try with ubuntu 13.10 to get newer version of sssd and pam ...

I have the same issue.
I can do getent passwd and see domain users, but authentication at login 
doesn't work.
I think there's still something wrong with my sssd.conf.

Here is the summary of what I done :


DC is CentOS 6.4
With SAMBA4 and a dhcp installed
DC Hostname : myserver
Realm et DNS domain name : subdomain.domain.fr
NT4 domain name : subdomain
IP : 192.168.1.7

Workstation is
Ubuntu 12.04 64Bit LTS
DHCP

I install :
sudo apt-get install sssd sssd-tools krb5-user libnss-sss libpam-sss

If ask, configure the realm in Uppercase
exemple : SUBDOMAIN.DOMAIN.FR

and check it /etc/krb5.conf

copy / create sssd.conf

Update /etc/hosts and /etc/hostname so it contain the FQDN

copy keytab from server

sudo scp root at myserver:/etc/krb5.sssd.keytab /etc/krb5.sssd.keytab

Update PAM :

sudo pam-auth-update

start sssd

Allow manuel login in LightDM
/etc/lightdm/lightdm.conf
or /etc/lightdm/lightdm.conf.d/10-ubuntu.conf
Append :
greeter-show-manual-login=true

I can see the workstation in the DNS zone
but not in the list of computer of the domain

Reboot and ..

Still not working :

lightdm: pam_sss(lightdm:auth): authentication failure; logname= uid=0 
euid=0 tty=:1 ruser= rhost=  user=Myuser
lightdm: pam_sss(lightdm:auth): received for user Myuser: 9 
(Authentication service cannot retrieve authentication info)
in the auth.log file.


Cyril