Eu tenho um erro quando uso o passwd na sessão do usuário ldap.
Eu recebo:
passwd: Authentication token manipulation error
Eu verifico este link mas isso não aconteceu Socorro.
No meu cn=config/olcDatabase={1}mbd.ldif tenho regras:
olcAccess: {0}to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn=rootdn,ou=private,ou=tl" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=rootdn,ou=private,ou=tl" write by * read
O getent passwd <ldap user> funciona.
Aqui meus arquivos de configuração.
arquivo sssd.conf:
[sssd]
debug_level = 0xFFF0
config_file_version = 2
services = nss,pam
domains = STAGENFS.FR
[nss]
debug_level = 0xFFF0
filter_users = root
filter_groups = root
[pam]
debug_level = 0xFFF0
offline_credentials_expiration = 1
[domain/STAGENFS.FR]
debug_level = 0xFFF0
ldap_schema = rfc2307
ldap_search_base = ou=tl
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_access_order = filter
ldap_access_filter = &(objectClass=posixAccount) (uidNumber=*)
ldap_uri = ldaps://ldap02.stagenfs.fr
ldap_referrals = False
ldap_id_use_start_tls = False
cache_credentials = True
account_cache_expiration = 1
enumerate = True
ldap_default_bind_dn = cn=proxyuser,ou=private,ou=tl
ldap_default_authtok_type = password
ldap_default_authtok = ProxyUser123#
ldap_tls_cacert = /etc/ssl/certs/cacert.pem
krb5_realm = STAGENFS.FR
krb5_canonicalize = False
krb5_server = kdc.stagenfs.fr
krb5_kpasswd = kdc.stagenfs.fr
krb5_ccachedir = /home/%u
arquivo nsswitch:
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the 'glibc-doc-reference' and 'info' packages installed, try:
# 'info libc "Name Service Switch"' for information about this file.
passwd: compat systemd sss
group: compat systemd sss
shadow: compat sss
gshadow: files
hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
Eu tenho pam_sss.so em arquivos pam.d:
# /etc/pam.d/common-account
account [default=bad success=ok user_unknown=ignore] pam_sss.so
# /etc/pam.d/common-auth
auth [success=1 default=ignore] pam_sss.so use_first_pass
# /etc/pam.d/common-password
password sufficient pam_sss.so use_authtok
# /etc/pam.d/common-session
session required pam_mkhomedir.so skel=/etc/skel/
session optional pam_sss.so
Você sabe se eu preciso de configuração sasl para isso?
Se você tem alguma idéia, ou se precisar de mais informações, não hesite! Obrigado.