-
I have pursued getting then, Novell, to rewrite that TID to be better detailed and more operationally relevant, even providing the re-write, but was not successful.
-
The SSSD AD provider is not available on SLES 11, the LDAP or LDAP/Kerberos providers are required for SSSD connectivity to AD (I have discussed this with SUSE, but the AD provider, sssd-ad package) itself isn’t provided on the SLES platform until v 12). Hence your /usr/lib64/sssd/libsss_ad.so error.
-
The standard /etc/krb5.keytab file created from a domain join operation will not be transferable between different hosts.
The SSSD LDAP/Kerberos configuration on SLES 11 can be a bit clunky to implement using YaST, so I implement it manually.
In a nutshell my procedure for SLES 11 connectivity to AD using the SSSD is:
- Configure the Linux system to use the same DNS and time source as the target AD domain.
Check that the /etc/HOSTNAME file contains the FQDN of your Linux server.
Check time synchronisation with the target domain.
Check key domain SRV records used for LDAP and Kerberos functionality.
darkvixen240:~ # host -t SRV _ldap._tcp.dvc.darkvixen.com
darkvixen240:~ # host -t SRV _kerberos._tcp.dvc.darkvixen.com
- Install the SSSD client (sssd) and sssd LDAP (sssd-ldap) and SSSD Kerberos providers (sssd-krb5) and the python-sssd-config package.
I would also install the sssd-tools package for the sssd cache management utilities.
- Manually implement and test the SLES Kerberos client (doing so in YaST will implement the pam_ldap and pam_krb5 modules which are unnecessary).
Install the Kerberos client (krb5-client) package.
Configure the /etc/krb5.conf file (The SP4 krb5.conf file has some different options, but use this SP3 example as a template).
[libdefaults]
default_realm = DVC.DARKVIXEN.COM
clockskew = 300
[realms]
DVC.DARKVIXEN.COM = {
kdc = darkvixen160win.dvc.darkvixen.com
default_domain = dvc.darkvixen.com
admin_server = darkvixen160win.dvc.darkvixen.com
}
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[domain_realm]
.dvc.darkvixen.com = DVC.DARKVIXEN.COM
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 10000
clockskew = 300
external = sshd
use_shmem = sshd
}
Attempt authentication to the target domain using a known set of credentials using the “kinit” application.
kinit -k <Some_Known_User>
- Join the system to the target domain using the YaST Windows Domain Membership module using the appropriate Windows credentials.
YaST will install any of the required Samba packages.
Using the “Expert Settings” fields select the “secrets and keytab” option in the “Kerberos Method” section to create a /etc/krb5.keytab file.
Attempt authentication to the target domain using the host principles (SPN’s in Windows parlance) in the /etc/krb5.conf file using the “kinit” application.
kinit -k <Linux_HostName$>
darkvixen240:~ # kinit -k DARKVIXEN240$
(no output indicates a successful result)
Verify the host SPN used has a valid Kerberos ticket.
darkvixen240:~ # klist
Then use “kdestroy” to clear the local Kerberos ticket cache.
darkvixen240:~ # kdestroy
- Use the pam-config utility to implement the system PAM configuration to use the SSSD.
Review the current system authentication configuration.
darkvixen240:~ # pam-config --query --unix2 (do not disable, will break local auth!)
darkvixen240:~ # pam-config --query --ldap
darkvixen240:~ # pam-config --query --krb5
darkvixen240:~ # pam-config --query --winbind
darkvixen240:~ # pam-config --query --sss
darkvixen240:~ # pam-config --query --mkhomedir
Ensure pam_ldap and pam_krb5 modules are disabled if they are enabled.
darkvixen240:~ # pam-config --delete --ldap
darkvixen240:~ # pam-config --delete --krb5
Ensure the pam_mkhomedir module is disabled if remote home directories are to be used, with the automounter as in your example.
darkvixen240:~ # pam-config --delete --mkhomedir
If the SSSD module (pam_sss) is not enabled, enable it.
darkvixen240:~ # pam-config --add --sss
- Configure the /etc/nsswitch.conf to reference the SSSD.
passwd: compat sss
group: compat sss
- Manually implement a /etc/sssd/sssd.conf than facilitates connectivity to the target AD environment using GSSAPI authentication using the rights of the joined computer object for the Linux server.
[sssd]
config_file_version = 2
services = nss,pam
domains = dvc.darkvixen.com
[nss]
reconnection_retries = 3
filter_users = root
filter_groups = root
[pam]
reconnection_retries = 3
[domain/dvc.darkvixen.com]
cache_credentials = true
enumerate = false
case_sensitive = false
This directive permits the use of the naming conventions used by the AD provider.
re_expression = (((?P[^\\]+)\\(?P.+$))|((?P[^@]+)@(?P.+$))|(^(?P[^@\\]+)$))
id_provider = ldap
auth_provider = krb5
Used to implement access control to the host
access_provider = ldap
Think of this as the /etc/krb5.conf for the SSSD
krb5_realm = DVC.DARKVIXEN.COM
krb5_server = darkvixen160win.dvc.darkvixen.com
krb5_renewable_lifetime = 1d
krb5_lifetime = 1d
krb5_validate = true
ldap_schema = ad
ldap_id_mapping = true
ldap_uri = ldap://darkvixen160win.dvc.darkvixen.com
ldap_user_search_base = dc=dvc,dc=darkvixen,dc=com
ldap_group_search_base = dc=dvc,dc=darkvixen,dc=com
ldap_force_upper_case_realm = true
ldap_disable_referrals = true
Access control by expired account and group membership
ldap_access_order = filter, expire
ldap_account_expire_policy = ad
ldap_access_filter = memberOf=cn=DARKVIXEN240_G,ou=LDAP,ou=SVS,dc=dvc,dc=darkvixen,dc=com
Secure auth for the daemon using the computer object security
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = DARKVIXEN240$@DVC.DARKVIXEN.COM
Provides debug output for troubleshooting, when enabled
debug_level = 7
Start the daemon and test.
Hoping it all helps and ping us back if you have issues, or want to then implement the automounter using the SSSD as well 
.
– lawrence
