Sssd

SSSD kujutab endast deemonite kogumiku, mis aitavad majandada autentimist erinevate mehanismide vastu nagu näiteks LDAP, Kerberos, FreeIPA, AD jne.

Ldap serverilt kasutajate autentimiseks kiire ja lihtne konfiguratsioon oleks /etc/sssd/sssd.conf

[sssd]
    services = nss, pam
    config_file_version = 2
    domains = LDAP
    debug_level = 3

domain/LDAP]
    cache_credentials = true
    enumerate = true
    id_provider = ldap
    auth_provider = ldap

    ldap_uri = ldap://ldap.mydomain.org
    ldap_search_base = dc=mydomain,dc=org
    ldap_tls_reqcert = demand
    cache_credentials = true
    enumerate = true

    fallback_homedir = /home/%u
    default_shell = /bin/bash

Seadistame kust kasutajaid otsitakse failist /etc/nsswitch.conf

passwd: files sss
group: files sss
shadow: files

publickey: files

hosts: files dns myhostname
networks: files

protocols: files
services: files
ethers: files
rpc: files

netgroup: nis sss
sudoers: files sss

SSHga logimise jaoks tuleks täiendada ka pami /etc/pam.d/system-auth faili järgnevalt

#%PAM-1.0
auth sufficient pam_sss.so forward_pass
auth required pam_unix.so try_first_pass nullok
auth optional pam_permit.so
auth required pam_env.so

account [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore] pam_sss.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so

password sufficient pam_sss.so use_authtok
password required pam_unix.so try_first_pass nullok sha512 shadow
password optional pam_permit.so

session required pam_mkhomedir.so skel=/etc/skel umask=0022
session required pam_limits.so
session required pam_unix.so
session optional pam_sss.so
session optional pam_permit.so

Kui vaja ldapi serveri vastu autentida tuleks sssd.conf faili veel lisada

   ldap_default_bind_dn = cn=kasutaja,cn=Users,dc=tartu,dc=zoo,dc=ee
   ldap_default_authtok_type = password
   ldap_default_authtok = mingisalajanejada

Kui aga tahtmine tls krüpteering maha keerata siis aitab

   ldap_tls_reqcert = never