Hi, I'm trying to configure a FreeBSD 10.2 file server to allow Active Directory user login with SSSD, but I'm encountering some problems. I've got it working on my CentOS 7 and RHEL 7 servers, and I've tried to make the setup on the FreeBSD box as similar as possible in the hope of avoiding issues.
First of all, here's what's working:
As for what doesn't work:
I know it's actually validating the password with the AD server, as using an incorrect password results in the message "[sssd[krb5_child[850]]]: Preauthentication failed" being printed to the console, so it's getting as far as checking the password successfully.
I must have something misconfigured but I don't know what. I'd very much appreciate any help/suggestions.
I've included what I think are the relevant config files. As I mentioned before, the SSSD and Samba configuration are taken from a working setup on CentOS/RHEL 7 servers. Sorry if I'm including irrelevant things.
This is my /etc/pam.d/sshd:
This is my /etc/pam.d/system:
This is my /usr/local/etc/sssd/sssd/conf:
This is my /etc/krb5.conf:
This is my /usr/local/etc/smb4.conf:
First of all, here's what's working:
- sssd 1.11.7 installed with SMB support and running
- samba41 4.1.22 installed with ACL_SUPPORT, ADS, DNSUPDATE, LDAP and QUOTAS on
- cyrus-sasl-gssapi 2.1.26 installed
- krb5 1.14 installed
- Joined machine to domain using Samba
net ads join
net ads infooutput looks good- Creating Kerberos tickets works (e.g.
kinit Administrator) getent passwdandgetent groupwork for AD users/groups
As for what doesn't work:
- When any local user logs on with SSH, a message is printed to the console: sshd[8899]: in openpan_check_error_code(): pam_sm_open_session(): unexpected return value 13
- When any local user logs off from and SSH session, a message is printed to the console: sshd[8899]: in openpan_check_error_code(): pam_sm_close_session(): unexpected return value 13
- Authenticating as an AD user (e.g. via SSH or
su) fails and prints a message to the console: [sssd[krb5_child[15238]]]: Unknown credential cache type
I know it's actually validating the password with the AD server, as using an incorrect password results in the message "[sssd[krb5_child[850]]]: Preauthentication failed" being printed to the console, so it's getting as far as checking the password successfully.
I must have something misconfigured but I don't know what. I'd very much appreciate any help/suggestions.
I've included what I think are the relevant config files. As I mentioned before, the SSSD and Samba configuration are taken from a working setup on CentOS/RHEL 7 servers. Sorry if I'm including irrelevant things.
This is my /etc/pam.d/sshd:
Code:
#
# $FreeBSD: releng/10.2/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $
#
# PAM configuration for the "sshd" service
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient /usr/local/lib/pam_sss.so
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth required pam_unix.so no_warn try_first_pass
# account
account required /usr/local/lib/pam_sss.so ignore_unknown_user
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
# session
session optional /usr/local/lib/pam_sss.so
#session optional pam_ssh.so want_agent
session required pam_permit.so
# password
password sufficient /usr/local/lib/pam_sss.so use_authtok
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_passThis is my /etc/pam.d/system:
Code:
#
# $FreeBSD: releng/10.2/etc/pam.d/system 197769 2009-10-05 09:28:54Z des $
#
# System-wide defaults
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient /usr/local/lib/pam_sss.so
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth required pam_unix.so no_warn try_first_pass nullok
# account
account required /usr/local/lib/pam_sss.so ignore_unknown_user
#account required pam_krb5.so
account required pam_login_access.so
account required pam_unix.so
# session
#session required /usr/local/lib/pam_mkhomedir.so mode=0700
session optional /usr/local/lib/pam_sss.so
#session optional pam_ssh.so want_agent
session required pam_lastlog.so no_fail
# password
password sufficient /usr/local/lib/pam_sss.so use_authtok
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_passThis is my /usr/local/etc/sssd/sssd/conf:
Code:
[sssd]
config_file_version = 2
services = nss, pam
domains = au.anteline.com
[nss]
[pam]
[domain/au.anteline.com]
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
cache_credentials = true
ldap_schema = ad
ldap_id_mapping = false
default_shell = /usr/local/bin/bash
override_homedir = /pool/nethome/%d/%uThis is my /etc/krb5.conf:
Code:
[libdefaults]
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = true
default_realm = AU.ANTELINE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
AU.ANTELINE.COM = {
kdc = alebwdsrv01.au.anteline.com
admin_server = alebwdsrv01.au.anteline.com
}
[domain_realm]
.au.anteline.com = AU.ANTELINE.COMThis is my /usr/local/etc/smb4.conf:
Code:
[global]
log file = /var/log/samba/log.%m
max log size = 50
workgroup = ANTELINEAU
security = ads
passdb backend = tdbsam
realm = AU.ANTELINE.COM
kerberos method = secrets and keytab
load printers = yes
cups options = raw