Authentication against Kerberos and authorization against an LDAP directory is working for me. Now I'm looking for the client setup on Debian Buster using sssd.
I started with LDAP authentication with nss-pam-ldapd using SASL Proxy Authorization on an OpenLDAP server and Caching OpenLDAP credentials with ccreds. But because I consistent use systemd and its environment, that traditional setup does not fit very well to it and I run into some problems with systemd-resolved together with nsswitch and/or pam as shown in section "Some more details" about NSS query against OpenLDAP server.
Because of this I had a look at sssd and saw that it can do it all in one and that it is based on systemd and also uses dbus interprocess communication. So I decided to use it instead. But on Debian the recommended package sssd installs all possible services, e.g. for active directory and other things I do not need. I want to have my clients as lean as possible without unused software, so my question is:
What Debian packages only I have to install to get a single sign on using sssd against OpenLDAP server with Kerberos SASL/GSSAPI and how to configure it?
Best Answer
Abstract
After some tries and error I found that I need one package for gssapi and four packages for sssd. I want to have general configuration centralized so I use a local private dns server for name-, servername- and servicename-resolution. So first I check this on the client. If you don't have it on a DNS server you can define it all local on every client. I have commented it. To avoid installation of unneeded additional packages I always use option `--no-install-recommends` for Debian **apt**.Prepare Kerberos client
First ensure that you have a valid `/etc/krb5.keytab` with `sudo klist -ke`. If not available then create one:After installing a Graphical User Interface like GNOME, or Xfce, I run into problems with name resolution. sssd wasn't able to resolve the DNS domain
example.com
with my extended DNS name resolution, so it does not find the Kerberos- and LDAP-server and login fails with error messageAuthentication failure
. This may work sometimes because of cached login data but with invalid kerberos ticket data1970-01-01
shown withklist
. According to Debian hostname resolution you should have an entry in/etc/hosts
like this:If you have the nscd cache running for name service then deinstall it. We must not use it because sssd will do the same.
Install SASL/GSSAPI modules and helpers we need for authentication against Kerberos and tests:
Install sssd
We need just four packages to provide all needed services for ldap, krb5, name service and pam:
The only what's left over is to configure
/etc/sssd/sssd.conf
. I use this one:Don't forget to protect sssd.conf, otherwise sssd will not start:
Check if the operating system gets the account information from the ldap directory. Be sure the queried user account is only in the ldap directory, not in local files. The source of the query is indicated by the character behind the user id.
Be sure you get
:*:
.Set pam authentication for login:
and check login with a new user:
For testing settings in sssd.conf you have to know that sssd is caching many data so changes will not immediately have an effect. This is very confusing. So I deleted the files in
/var/lib/sss/db/
with the cached information after a modification of sssd.conf. I used this one-liner as root: