Skip to main content

How to configure SSSD for LDAP authentication on CentOS

1. Install OpenLDAP Packages.

yum install openldap  openldap-clients

2. Install the sssd and sssd-client packages.

yum install sssd sssd-client

3. Modify /etc/openldap/ldap.conf to contain the proper server and search base information for the organization.

TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://ldap.sabagus.com:389
BASE dc=sabagus,dc=com

4. Modify /etc/nsswitch.conf to use sss.

passwd:     files sss
shadow:     files sss
group:      files sss

5. Configure the LDAP client by using sssd.

The sssd configuration is located at /etc/sssd/sssd.conf.
Example: (Here domain is set to sabagus.com)

[domain/sabagus.com]
autofs_provider = ldap
cache_credentials = False
ldap_search_base = dc=sabagus,dc=com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ldap.sabagus.com:389
ldap_id_use_start_tls = False
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_schema = rfc2307bis
ldap_auth_disable_tls_never_use_in_production = true
use_fully_qualified_names = True
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = sabagus.com
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75
[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
[autofs]

6.  Configure PAM to use sssd

Add "pam_sss.so" related entries into /etc/pam.d/password-auth and /etc/pam.d/system-auth.

Example of /etc/pam.d/password-auth is:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

Example of /etc/pam.d/system-auth is:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

7. Start sssd

chmod 0600 /etc/sssd/sssd.conf
/etc/init.d/sssd start

Troubleshoot issues by checking /var/log/sssd/sssd.log if needed.

8. Test by looking for one user identified in LDAP server.

# id someuser@sabagus.com
uid=10002(someuser@sabagus.com) gid=15000(somegroup@sabagus.com)

Reference:
Labels:

Comments

Post a Comment

Popular posts from this blog

Troubleshooting WAF, CDN, and Load balancer

 Troubleshooting issues involving a Web Application Firewall (WAF), Content Delivery Network (CDN), and Load Balancer (LB) can be complex. Here is a step-by-step guide, including testing methods and relevant commands to isolate problems at each level. ### Step 1: Check Basic Connectivity 1. **Ping the Website**:    ```sh    ping example.com    ``` 2. **Check DNS Resolution**:    ```sh    nslookup example.com    ``` ### Step 2: Verify Load Balancer 1. **Direct Access to Load Balancer**:    Modify `/etc/hosts` to bypass CDN and WAF, pointing directly to the load balancer’s IP.    ```sh    sudo nano /etc/hosts    ```    Add the line:    ```    LB_IP example.com    ```     2. **Test HTTP Response**:    ```sh    curl -I http://example.com    ```    Check headers and status code to verify the load bal...
Post a Comment
Read more

Soal dan pembahasan LKSN ITNSA

Berikut adalah koleksi soal-soal ITNSA dan beberapa website yang memberikan pembahasan pada event perlombaaan LKS SMK Nasional bidang lomba IT Network Systems Administration. 2014 Palembang Di tahun ini ada 1 soal packet tracer. Di website dibawah ini diberikan juga cara pembahasannya. https://agussas.wordpress.com/2015/04/02/review-soal-lks-nasional-it-network-23-packet-tracer-challenge/ Semua soal:  https://www.dropbox.com/sh/l90zyke2ib5msgv/AAA3kPOFo-zEn4wPOW4a3iMwa?dl=0 dan https://drive.google.com/file/d/18lDhtMjAnPAhkfOJ6uFHsC5j6ycg3K4I/view Pembahasan juga dalam bentuk video di youtube:  https://www.youtube.com/watch?v=8QML594nQBU 2015 Banten Pembahasan:   https://www.youtube.com/watch?v=quDbpC2xSfQ Soal:  https://drive.google.com/file/d/1B09IYfdoGENBL3txSQodpptG1zdQxBWI/view 2016 Malang Soal:   https://drive.google.com/file/d/13-2bRtb5IXO9vxAhLfhghZbDXeUzD0FI/view Pembahasan:   https://www.youtube.com/watch?v=zmUSUZguH24 20...
2 comments
Read more

Daftar juara ITNSA LKS Nasional SMK

Daftar juara ITNSA LKSN SMK *List juara 1: 2008 Jawa Tengah 2009 Banten 2010 DKI Jakarta 2011 Jawa Barat 2012 DI Yogyakarta 2013 Jawa Tengah 2014 Banten 2015 Bali 2016 Kalimantan Selatan 2017 Jawa Barat 2018 Banten 2019 Kepulauan Riau 2020 Banten 2021 Jawa Barat 2022 Banten 2023 Banten 2024 Banten 2025 Banten *Data diatas dikumpulan dari hasil browsing di google
Post a Comment
Read more