[Freeipa-users] Configuring RHEL 5 clients for automatic failover of servers

[Dmitri Pal]

On 04/09/2015 11:19 AM, Guertin, David S. wrote:
>> If that works it means that you are not using SSSD on RHEL5 clients.
>> Please check your nsswitch and pam.conf to see what modules are actually
>> used.
> Hmm. /etc/nsswitch.conf contains:
>
> --------------------------
> passwd:     files sss ldap
> shadow:     files sss ldap
> group:      files sss ldap
> --------------------------
>
> And /etc/pam.d/system-auth contains:
>
> --------------------------
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    pam_sss.so use_first_pass
> auth        sufficient    pam_ldap.so use_first_pass
> auth        required      pam_deny.so
>
> account     required      pam_unix.so broken_shadow
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
> account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
> account     required      pam_permit.so
>
> password    requisite     pam_cracklib.so try_first_pass retry=3
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
> password    sufficient    pam_sss.so use_authtok
> password    sufficient    pam_ldap.so use_authtok
> password    required      pam_deny.so
>
> session     optional      pam_keyinit.so revoke
> session     required      pam_limits.so
> session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
> session     required      pam_unix.so
> session     optional      pam_sss.so
> session     optional      pam_ldap.so
> --------------------------
>
> i.e. they both contain both sss and ldap, with sss first. The client was installed with the script generated by running "ipa-advise config-redhat-sssd-before-1-9" on the server. This script contains:
>
> # Use the authconfig to configure nsswitch.conf and the PAM stack
> authconfig --updateall --enablesssd --enablesssdauth
>
> and it also updates the /etc/sssd/sssd.conf file: So why would client not be using sssd?

This only means that pam_sss/nss_sss fails and LDAP takes over and works.
You need to look at the sssd logs to see why it fails.
It probably does not find the right servers and falls though to LDAP.

>
>> Which RHEL5 versions do you use?
>> If memory does not fail me if you have SSSD 1.5 (I think it was starting 5.8)
>> you should be able to use ipa-client-install to configure sssd and pass the list
>> of the servers in the --server option.
> Most of them are RHEL 5.11 with sssd 1.5.1. I'll try reinstalling and passing the list of servers with the --server option.
>
> David Guertin


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.