Skip to main content

How to configure SSSD for LDAP authentication on CentOS

1. Install OpenLDAP Packages.

yum install openldap  openldap-clients

2. Install the sssd and sssd-client packages.

yum install sssd sssd-client

3. Modify /etc/openldap/ldap.conf to contain the proper server and search base information for the organization.

TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://ldap.sabagus.com:389
BASE dc=sabagus,dc=com

4. Modify /etc/nsswitch.conf to use sss.

passwd:     files sss
shadow:     files sss
group:      files sss

5. Configure the LDAP client by using sssd.

The sssd configuration is located at /etc/sssd/sssd.conf.
Example: (Here domain is set to sabagus.com)

[domain/sabagus.com]
autofs_provider = ldap
cache_credentials = False
ldap_search_base = dc=sabagus,dc=com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ldap.sabagus.com:389
ldap_id_use_start_tls = False
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_schema = rfc2307bis
ldap_auth_disable_tls_never_use_in_production = true
use_fully_qualified_names = True
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = sabagus.com
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
[autofs]

6.  Configure PAM to use sssd

Add "pam_sss.so" related entries into /etc/pam.d/password-auth and /etc/pam.d/system-auth.

Example of /etc/pam.d/password-auth is:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

Example of /etc/pam.d/system-auth is:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

7. Start sssd

chmod 0600 /etc/sssd/sssd.conf
/etc/init.d/sssd start

Troubleshoot issues by checking /var/log/sssd/sssd.log if needed.

8. Test by looking for one user identified in LDAP server.

# id someuser@sabagus.com
uid=10002(someuser@sabagus.com) gid=15000(somegroup@sabagus.com)

Reference:
Labels:

Comments

Post a Comment

Popular posts from this blog

Troubleshooting WAF, CDN, and Load balancer

 Troubleshooting issues involving a Web Application Firewall (WAF), Content Delivery Network (CDN), and Load Balancer (LB) can be complex. Here is a step-by-step guide, including testing methods and relevant commands to isolate problems at each level. ### Step 1: Check Basic Connectivity 1. **Ping the Website**:    ```sh    ping example.com    ``` 2. **Check DNS Resolution**:    ```sh    nslookup example.com    ``` ### Step 2: Verify Load Balancer 1. **Direct Access to Load Balancer**:    Modify `/etc/hosts` to bypass CDN and WAF, pointing directly to the load balancer’s IP.    ```sh    sudo nano /etc/hosts    ```    Add the line:    ```    LB_IP example.com    ```     2. **Test HTTP Response**:    ```sh    curl -I http://example.com    ```    Check headers and status code to verify the load bal...
Post a Comment
Read more

Soal dan pembahasan LKSN ITNSA

Berikut adalah koleksi soal-soal ITNSA dan beberapa website yang memberikan pembahasan pada event perlombaaan LKS SMK Nasional bidang lomba IT Network Systems Administration. 2014 Palembang Di tahun ini ada 1 soal packet tracer. Di website dibawah ini diberikan juga cara pembahasannya. https://agussas.wordpress.com/2015/04/02/review-soal-lks-nasional-it-network-23-packet-tracer-challenge/ Semua soal:  https://www.dropbox.com/sh/l90zyke2ib5msgv/AAA3kPOFo-zEn4wPOW4a3iMwa?dl=0 dan https://drive.google.com/file/d/18lDhtMjAnPAhkfOJ6uFHsC5j6ycg3K4I/view Pembahasan juga dalam bentuk video di youtube:  https://www.youtube.com/watch?v=8QML594nQBU 2015 Banten Pembahasan:   https://www.youtube.com/watch?v=quDbpC2xSfQ Soal:  https://drive.google.com/file/d/1B09IYfdoGENBL3txSQodpptG1zdQxBWI/view 2016 Malang Soal:   https://drive.google.com/file/d/13-2bRtb5IXO9vxAhLfhghZbDXeUzD0FI/view Pembahasan:   https://www.youtube.com/watch?v=zmUSUZguH24 20...
2 comments
Read more

LKS SMK Cloud Computing

 Lomba Kompetensi Siswa SMK merupakan salah satu kegiatan rutin yang dilakukan tiap tahun, mulai dari tingkat kota/kabupaten sampai Internasional (Asean, WorldSkills Competiton). Untuk kali ini akan membahas salah satu bidang yang belum terlalu lama yaitu cloud computing, tentu dunia cloud computing sudah lama beredar, dan AWS salah satu leadernya, untuk kegiatan kompetisi lomba cloud computing ini mulai dirintis sejak 2017 di worldskills abu dhabi, saat itu masih dalam proses demo, hingga pada tahun 2019 menjadi salah satu bidang resmi di worlskills kazan. AWS sendiri sebetulnya punya kegiatan kompetisi sendiri juga seperti Hackathon dan AWS Gaming Day. Pada blogpost ini akan berusaha mencari informasi tentang cloud computing kompetisi khususnya LKS SMK seperti kisi-kisi. Berikut adalah kurasi link-link yang bermanfaat untuk belajar,  terima kasih juga pada penulis di website-website berikut:  Kisi-kisi LKS di salah satu Provinsi https://github.com/stmj-dev/Soal-Dan-Kisi...
Post a Comment
Read more