<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>> Subject: Re: [Freeipa-users] FreeIPA manual PAM setup help<br><div>> From: simo@redhat.com<br>> To: chillermillerlong@hotmail.com<br>> CC: jhrozek@redhat.com; freeipa-users@redhat.com<br>> Date: Thu, 29 Nov 2012 21:08:02 -0500<br>> <br>> On Thu, 2012-11-29 at 20:55 -0500, СÁú ³Â wrote:<br>> <br>> <br>> > And PAM is working!<br>> <br>> Excellent!<br>> <br>> > I've just finished a helper for setting up NSS and PAM for sssd. It<br>> > basically does the following:<br>> > <br>> > 1. Looks for 'passwd', 'shadow', 'group', 'services', 'netgroup', and<br>> > 'automount'<br>> > in /etc/nsswitch.conf and adds 'sss' to it.<br>> <br>> SSSD does not provide a shadow map so you shouldn't ad sss to shadow. It<br>> will do no harm though, it will just be a noop.<br><br>I see. I'll remove that part that. I just saw that Fedora's authconfig adds it<br>by default.<br><br>> <br>> > 2. Looks for pam_unix.so in every file in /etc/pam.d/, changes<br>> > 'required'<br>> > to 'sufficient', and adds an 'include' line for 'sss' right below<br>> > itq. /etc/pam.d/sss<br>> > contains the pam_sss.so lines.<br>> > <br>> > So far, I've tested sudo and su, and both are working :)<br>> > <br>> > Here's a link to the script:<br>> > https://github.com/chenxiaolong/ArchLinux-Packages/blob/master/freeipa/sss-auth-setup.py<br>> > <br>> > If someone is bored, I'd appreciate it if he/she would take a look at<br>> > it<br>> > for glaring issues.<br>> <br>> Cool stuff, I do not know Arch Linux default PAm stack configuration so<br>> I can;t tell with certainty that the replace you make is perfect, but I<br>> do not see anything stunningly bad.<br><br>Thanks for taking a look at the script!<br><br>I'm having some ssh issues now, unfortunately. Password authentication works<br>find, but GSSAPI doesn't. The client always fails "Connection closed by UNKNOWN"<br><br>Client: http://paste.kde.org/617216/<br>Server: http://paste.kde.org/617222/<br><br>Interestingly enough, the server logs nothing (with GSSAPI) unless I set it to log<br>debug messages.<br><br>Anyways, I'll have to look at this tomorrow. I'm not going to finish my homework :)<br><br>Xiao-Long Chen<br></div> </div></body>
</html>