Working SSSD Config for RHEL 6.8/CentOS 6.8

Now I want to note that I have not tried this from a clean install. This is my notes from when I was switching over from samba/winbind which is why you'll see some mentions of having to copy paste things a second time or having to restart extra times. They may be optional.

Optional:
Leave old domain, sync time.

ntpdate -u dc01.domain.com
net ads leave domain.com -U username

Optional:
There was an issue with the previous version installed, had to remove before installing anything else.

yum remove libipa_hbac -y

Step 1: Install SSSD, Authconfig, SSSD Tools, ADCLI, and KRB5 Workstation

yum install sssd authconfig sssd-tools adcli krb5-workstation -y

Step 2: Configure KRB, Samba, and SSD ****** CASE MATTERS !!!!!!!! ******

echo y | cp /etc/krb5.conf /etc/krb5.conf.bak

echo "[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
DOMAIN.COM = {
kdc = DC01.DOMAIN.COM
admin_server = DC01.DOMAIN.COM
kdc = X.X.X.X
}

[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM" > /etc/krb5.conf
 
echo y |cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

echo "[global]
workgroup = DOMAINN
client signing = yes
#client user spnego = yes
kerberos method = secrets and keytab
log file = /var/log/samba/%m.log
password server = DC01.DOMAIN.COM
realm = DOMAIN.COM
security = ADS" > /etc/samba/smb.conf

echo y | cp /etc/sssd/sssd.conf /etc/sssd/sssd.conf.bak

echo "[sssd]
config_file_version = 2
services = nss, pam, autofs, ssh, autofs
domains = DOMAIN.COM
#default_domain_suffix = DOMAIN.COM

[nss]
filter_users = root,ldap,named

[domain/DOMAIN.COM]
id_provider = ad
ad_server = dc01.domain.com
ad_backup_server = dc02.domain.com
ad_domain = domain.com
krb5_realm = DOMAIN.COM
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
ldap_schema = ad
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
enumerate = true

[pam]
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5


[autofs]" > /etc/sssd/sssd.conf

Step 3 Restart the services:

service smb restart; service winbind restart; service sssd restart;

Step 3: Test to see if all the config files are working

kinit username

Type in password, if it comes back with no response it worked.
You can check this by typing

klist

If you get an error, something is wrong in the config or your password is wrong.

Step 4: Configure PAM Modules, Join Domain

authconfig --update --enablesssd --enablesssdauth

service smb restart; service winbind restart; service sssd restart;

adcli join domain.com -U user -v

Verify everything in the nssswitch file got updated. Should be files sss.

cat /etc/nsswitch.conf

Should look like this:

passwd:     files sss winbind
shadow:     files sss winbind
group:      files sss winbind

#hosts:     db files nisplus nis dns
hosts:      files dns

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss

netgroup:   files sss

publickey:  nisplus

automount:  files sss
aliases:    files nisplus

Step 5: Restart services, Print out AD Users, Print out AD Groups, Check ID for test User

service smb restart; service winbind restart; service sssd restart;
getent passwd

getent group

id username

Step 6: Test login

ssh username@127.0.0.1

****IF getent doesn't show anything but ID works, restart the services again, check again *****

service smb restart; service winbind restart; service sssd restart;

If you want to limit login based on groups, check out /etc/security/access.conf

echo "+ : group1 "group 2" jsmith root : ALL
- : ALL : ALL" >> /etc/security/access.conf

Sudo based on groups

echo "%admin ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers 

Joining Ubuntu to Active Directory (Windows Server 2008 R2 Domain)

**** CASE DOES MATTER IN ALL FILES AND COMMANDS ****

sudo apt-get install krb5-user winbind samba ntp ldap-utils

</etc/krb5.conf>

adm@mindtouch:~$ cat /etc/krb5.conf

 [logging]

default = FILE:/var/log/krb5.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log

[libdefaults]
        default_realm = TEST.UBUNTU.COM
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

[realms]
        TEST.UBUNTU.COM = {
                kdc = dc.test.ubuntu.com
                admin_server = dc.test.ubuntu.com
                default_domain = TEST.UBUNTU.COM
        }

[domain_realm]
        .test.ubuntu.com = TEST.UBUNTU.COM
        test.ubuntu.com = TEST.UBUNTU.COM
        .kerberos.server = TEST.UBUNTU.COM

[login]
        krb4_convert = true
        krb4_get_tickets = false

</etc/smb.conf>

Note: The workgroup is the left most part of the realm.

adm@mindtouch:~$ cat /etc/samba/smb.conf

 [global]
        log file = /var/log/samba/log.%m
        max log size = 1000
        security = ADS
        realm = TEST.UBUNTU.COM
        password server = 10.10.100.25
        workgroup = TEST
        use kerberos keytab = true
        idmap uid = 10000 - 20000
        idmap gid = 10000 - 20000
        winbind enum users = yes
        winbind enum groups = yes
        template homedir = /home/%D/%U
        template shell = /bin/bash
        client use spnego = yes
        client ntlmv2 auth = yes
        encrypt passwords = true
        winbind use default domain = yes
        restrict anonymous = 2

;Communal Files
[files]
        comment = Shared Files
        path = /Storage/
        writeable = yes

;Individual Files - sym link /home/%D to /Storage/

mkdir /Storage

chmod a+rwx /Storage

</etc/nsswitch.conf>

adm@mindtouch:~$ cat /etc/nsswitch.conf

# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat winbind
group:          compat winbind
shadow:         compat

hosts:          files mdns4_minimal dns mdns4 wins [NOTFOUND=return]
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

</etc/ntp.conf>

adm@mindtouch:~$ cat /etc/ntp.conf

server dc.test.ubuntu.com

</etc/pam.d/common-account>
adm@mindtouch:~$ cat /etc/pam.d/common-account

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#


account sufficient      pam_winbind.so
account required        pam_unix.so

</etc/pam.d/common-auth>
adm@mindtouch:~$ cat /etc/pam.d/common-auth

#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "nullok" option allows users to change an empty password, else
# empty passwords are treated as locked accounts.
#
# The "md5" option enables MD5 passwords.  Without this option, the
# default is Unix crypt.
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# You can also use the "min" option to enforce the length of the new
# password.
#
# See the pam_unix manpage for other options.

password required pam_unix.so nullok obscure min=4 max=50 md5
password optional pam_smbpass.so nullok use_authtok use_first_pass missingok

# Alternate strength checking for password. Note that this
# requires the libpam-cracklib package to be installed.
# You will need to comment out the password line above and
# uncomment the next two in order to use this.
# (Replaces the `OBSCURE_CHECKS_ENAB', `CRACKLIB_DICTPATH')
#
# password required       pam_cracklib.so retry=3 minlen=6 difok=3
# password required       pam_unix.so use_authtok nullok md5

</etc/pam.d/common-password>
adm@mindtouch:~$ cat /etc/pam.d/common-password

#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "nullok" option allows users to change an empty password, else
# empty passwords are treated as locked accounts.
#
# The "md5" option enables MD5 passwords.  Without this option, the
# default is Unix crypt.
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# You can also use the "min" option to enforce the length of the new
# password.
#
# See the pam_unix manpage for other options.

password required pam_unix.so nullok obscure min=4 max=50 md5
password optional pam_smbpass.so nullok use_authtok use_first_pass missingok

# Alternate strength checking for password. Note that this
# requires the libpam-cracklib package to be installed.
# You will need to comment out the password line above and
# uncomment the next two in order to use this.
# (Replaces the `OBSCURE_CHECKS_ENAB', `CRACKLIB_DICTPATH')
#
# password required       pam_cracklib.so retry=3 minlen=6 difok=3
# password required       pam_unix.so use_authtok nullok md5

</etc/pam.d/common-session>
adm@mindtouch:~$ cat /etc/pam.d/common-session

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).  The default is pam_unix.
#
session required        pam_mkhomedir.so umask=0022 skel=/etc/skel

</etc/pam.d/sshd>
adm@mindtouch:~$ cat /etc/pam.d/sshd

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required     pam_env.so envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional     pam_motd.so # [1]

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Set up SELinux capabilities (need modified pam)
# session  required     pam_selinux.so multiple

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

# Standard Un*x password updating.
@include common-password

Restart the following services:
/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start

kinit adm@TEST.UBUNTU.COM (THE DOMAIN HAS TO BE ALL CAPS!)

Confirm the ticket was obtained: Type: 'klist'

Sync the type with the server: 'net time'

Join the box to the domain:  'net ads join -U adm'

**If it doesn't work, try  'net ads join -U adm@TEST.UBUNTU.COM'.  A lot of the pages I used to trouble shoot errors are posted as links at the bottom of the page.**

Restart the following services again:
/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start
/etc/init.d/ssh restart

ssh adm@mindtouch

To add Admins to the sudoers file:

</etc/sudoers>
mindtouch:/# cat /etc/sudoers

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults        env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL
www-data ALL=(root) NOPASSWD: /etc/init.d/dekiwiki

# Uncomment to allow members of group sudo to not need a password
# (Note that later entries override this, so you might need to move
# it further down)
# %sudo ALL=NOPASSWD: ALL
%BUILTIN\administrators ALL=(ALL) ALL
%"domain admins" ALL=(ALL) ALL

**This was a preinstalled box that was running the Mindtouch Core Wiki.  To set a static IP and to get the internet to work, I had to add a manual default route by typing 'ip route add default via 10.10.100.1'  This needed to run everytime I rebooted the box.  If I find a way to have it stick, I'll update this.  If you know of a way please post in the comments and I'll update the post. **

Sources:  Link Link Link Link Link Link Link Link Link Link