Proxmox and sssd pam auth

[geos_one]

Is there a way to authenticate with the pam sssd module ?
in the auth log i can find the pam auth with success but i am unabel to login via webinterface (user in in gui created with admin permissions)

{"EventReceivedTime":"2016-08-01 12:50:11","SourceModuleName":"unix_in","SourceModuleType":"im_uds","SyslogFacilityValue":1,"SyslogFacility":"USER","SyslogSeverityValue":5,"SyslogSeverity":"NOTICE","SeverityValue":2,"Severity":"INFO","Hostname":"pro-pve01-p","EventTime":"2016-08-01 12:50:11","SourceName":"IPCC.xs","ProcessID":"17095","Message":"{\"EventReceivedTime\":\"2016-08-01 12:50:11\",\"SourceModuleName\":\"unix_in\",\"SourceModuleType\":\"im_uds\",\"SyslogFacilityValue\":10,\"SyslogFacility\":\"AUTHPRIV\",\"SyslogSeverityValue\":6,\"SyslogSeverity\":\"INFO\",\"SeverityValue\":2,\"Severity\":\"INFO\",\"Hostname\":\"pro-pve01-p\",\"EventTime\":\"2016-08-01 12:50:11\",\"SourceName\":\"IPCC.xs\",\"ProcessID\":\"17095\",\"Message\":\"pam_sss(common-auth:auth): authentication success; logname= uid=0 euid=0 tty= ruser= rhost= user=xxxx.yyyy\"}"}

 

[linkstat]

Is incorrect. I think that if you want sssd, maybe is because you are thinking in get auth from your AD LDAP. But, you don't need sssd on your node to authenticate against AD in the web based console. For that purpose, you can configure auth against AD from the web interface.

Go to Datacenter -> Authentication
Click on "Add" button.
complete the fields on the box.

When you complete that, you have an additional authentication method. Now, you need add users for that auth method have added. For that, go to Users tab and then clic in 'Add' button. In the window box, select the REALM that you added. The username must previously exist in your AD.

Now. You must logout. The next time, when login, select the adecuate REALM when put your username & password.


Greetings!

 

[geos_one]

the problem is that we use an IPA server that requres an non anonymous bind.

 

[linkstat]

But, you already tried the PVE way?

Alternatively, you have LDAP auth method.
And one more: you can create users in the system as in this post.

Greetings!

 

[geos_one]

yes i know
we dont want to have local users
the ldfap bind has the problem that it dont support non anonymous bind.
and always adding a patch to a file will make it hard to update the system.

 

[ffrank]

Is there a way to authenticate with the pam sssd module ?
(...):\"2016-08-01 12:50:11\",\"SourceName\":\"IPCC.xs\",\"ProcessID\":\"17095\",\"Message\":\"pam_sss(common-auth:auth): authentication success; logname= uid=0 euid=0 tty= ruser= rhost= user=xxxx.yyyy\"}"}

Did you solve this? I have now the same problem and am wondering why that's happening.

 

[geos_one]

no not working at the moment
i got distracted by other problem.
but it still needs to be solved

 

[warlock]

no not working at the moment
i got distracted by other problem.
but it still needs to be solved

Hey

All you need to do is to add the user separately in the UI. Then it starts working.

If you are using HBAC rules you have to add a HBAC service called common-auth. Then later on add the host to use the service and user.

This should do the job.