2022-04-27 13:22:11 +02:00
<!DOCTYPE HTML>
< html lang = "en" class = "sidebar-visible no-js light" >
< head >
<!-- Book generated using mdBook -->
< meta charset = "UTF-8" >
< title > PAM and nsswitch - Kanidm Administration< / title >
<!-- Custom HTML head -->
< meta content = "text/html; charset=utf-8" http-equiv = "Content-Type" >
< meta name = "description" content = "" >
< meta name = "viewport" content = "width=device-width, initial-scale=1" >
< meta name = "theme-color" content = "#ffffff" / >
2022-06-05 07:20:33 +02:00
< link rel = "shortcut icon" href = "../favicon.png" >
< link rel = "stylesheet" href = "../css/variables.css" >
< link rel = "stylesheet" href = "../css/general.css" >
< link rel = "stylesheet" href = "../css/chrome.css" >
< link rel = "stylesheet" href = "../css/print.css" media = "print" >
2022-04-27 13:22:11 +02:00
<!-- Fonts -->
2022-06-05 07:20:33 +02:00
< link rel = "stylesheet" href = "../FontAwesome/css/font-awesome.css" >
< link rel = "stylesheet" href = "../fonts/fonts.css" >
2022-04-27 13:22:11 +02:00
<!-- Highlight.js Stylesheets -->
2022-06-05 07:20:33 +02:00
< link rel = "stylesheet" href = "../highlight.css" >
< link rel = "stylesheet" href = "../tomorrow-night.css" >
< link rel = "stylesheet" href = "../ayu-highlight.css" >
2022-04-27 13:22:11 +02:00
<!-- Custom theme stylesheets -->
< / head >
< body >
<!-- Provide site root to javascript -->
< script type = "text/javascript" >
2022-06-05 07:20:33 +02:00
var path_to_root = "../";
2022-04-27 13:22:11 +02:00
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "navy" : "light";
< / script >
<!-- Work around some values being stored in localStorage wrapped in quotes -->
< script type = "text/javascript" >
try {
var theme = localStorage.getItem('mdbook-theme');
var sidebar = localStorage.getItem('mdbook-sidebar');
if (theme.startsWith('"') & & theme.endsWith('"')) {
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
}
if (sidebar.startsWith('"') & & sidebar.endsWith('"')) {
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
}
} catch (e) { }
< / script >
<!-- Set the theme before any content is loaded, prevents flash -->
< script type = "text/javascript" >
var theme;
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
if (theme === null || theme === undefined) { theme = default_theme; }
var html = document.querySelector('html');
html.classList.remove('no-js')
html.classList.remove('light')
html.classList.add(theme);
html.classList.add('js');
< / script >
<!-- Hide / unhide sidebar before it is displayed -->
< script type = "text/javascript" >
var html = document.querySelector('html');
var sidebar = 'hidden';
if (document.body.clientWidth >= 1080) {
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
sidebar = sidebar || 'visible';
}
html.classList.remove('sidebar-visible');
html.classList.add("sidebar-" + sidebar);
< / script >
< nav id = "sidebar" class = "sidebar" aria-label = "Table of contents" >
< div class = "sidebar-scrollbox" >
2022-07-20 09:37:37 +02:00
< ol class = "chapter" > < li class = "chapter-item expanded " > < a href = "../intro.html" > < strong aria-hidden = "true" > 1.< / strong > Introduction to Kanidm< / a > < / li > < li class = "chapter-item expanded " > < a href = "../installing_the_server.html" > < strong aria-hidden = "true" > 2.< / strong > Installing the Server< / a > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../server_configuration.html" > < strong aria-hidden = "true" > 2.1.< / strong > Server Configuration< / a > < / li > < li class = "chapter-item expanded " > < a href = "../security_hardening.html" > < strong aria-hidden = "true" > 2.2.< / strong > Security Hardening< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < a href = "../client_tools.html" > < strong aria-hidden = "true" > 3.< / strong > Client Tools< / a > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../installing_client_tools.html" > < strong aria-hidden = "true" > 3.1.< / strong > Installing client tools< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < a href = "../accounts_and_groups.html" > < strong aria-hidden = "true" > 4.< / strong > Accounts and Groups< / a > < / li > < li class = "chapter-item expanded " > < a href = "../administrivia.html" > < strong aria-hidden = "true" > 5.< / strong > Administrative Tasks< / a > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../monitoring.html" > < strong aria-hidden = "true" > 5.1.< / strong > Monitoring the platform< / a > < / li > < li class = "chapter-item expanded " > < a href = "../password_quality.html" > < strong aria-hidden = "true" > 5.2.< / strong > Password Quality and Badlisting< / a > < / li > < li class = "chapter-item expanded " > < a href = "../posix_accounts.html" > < strong aria-hidden = "true" > 5.3.< / strong > POSIX Accounts and Groups< / a > < / li > < li class = "chapter-item expanded " > < a href = "../ssh_key_dist.html" > < strong aria-hidden = "true" > 5.4.< / strong > SSH Key Distribution< / a > < / li > < li class = "chapter-item expanded " > < a href = "../recycle_bin.html" > < strong aria-hidden = "true" > 5.5.< / strong > The Recycle Bin< / a > < / li > < li class = "chapter-item expanded " > < a href = "../why_tls.html" > < strong aria-hidden = "true" > 5.6.< / strong > Why TLS?< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < li class = "part-title" > For Developers< / li > < li class = "chapter-item expanded " > < a href = "../DEVELOPER_README.html" > < strong aria-hidden = "true" > 6.< / strong > Developer Guide< / a > < / li > < li class = "chapter-item expanded " > < div > < strong aria-hidden = "true" > 7.< / strong > Design Documents< / div > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../developers/designs/access_profiles_and_security.html" > < strong aria-hidden = "true" > 7.1.< / strong > Access Profiles< / a > < / li > < li class = "chapter-item expanded " > < a href = "../developers/designs/rest_interface.html" > < strong aria-hidden = "true" > 7.2.< / strong > REST Interface< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < a href = "../developers/python.html" > < strong aria-hidden = "true" > 8.< / strong > Python Module< / a > < / li > < li class = "chapter-item expanded " > < a href = "../developers/radius.html" > < strong aria-hidden = "true" > 9.< / strong > RADIUS Integration< / a > < / li > < li class = "chapter-item expanded affix " > < li class = "part-title" > Integrations< / li > < li class = "chapter-item expanded " > < a href = "../integrations/oauth2.html" > < strong aria-hidden = "true" > 10.< / strong > Oauth2< / a > < / li > < li class = "chapter-item expanded " > < a href = "../integrations/pam_and_nsswitch.html" class = "active" > < strong aria-hidden = "true" > 11.< / strong > PAM and nsswitch< / a > < / li > < li class = "chapter-item expanded " > < a href = "../integrations/radius.html" > < strong aria-hidden = "true" > 12.< / strong > RADIUS< / a > < / li > < li class = "chapter-item expanded " > < a href = "../integrations/ldap.html" > < strong aria-hidden = "true" > 13.< / strong > LDAP< / a > < / li > < li class = "chapter-item expanded affix " > < li class = "part-title" > Integration Examples< / li > < li class = "chapter-item expanded " > < a href = "../examples/k8s_ingress_example.html" > < strong aria-hidden = "true" > 14.< / strong > Kubernetes Ingress< / a > < / li > < li class = "chapter-item expanded affix " > < li class = "part-title" > Packaging< / li > < li class = "chapter-item expanded " > < a href = "../packaging.html" > < strong aria-hidden = "true" > 15.< / strong > Packaging< / a > < / li > < li class = "chapter-item expanded " > <
2022-04-27 13:22:11 +02:00
< / div >
< div id = "sidebar-resize-handle" class = "sidebar-resize-handle" > < / div >
< / nav >
< div id = "page-wrapper" class = "page-wrapper" >
< div class = "page" >
< div id = "menu-bar-hover-placeholder" > < / div >
< div id = "menu-bar" class = "menu-bar sticky bordered" >
< div class = "left-buttons" >
< button id = "sidebar-toggle" class = "icon-button" type = "button" title = "Toggle Table of Contents" aria-label = "Toggle Table of Contents" aria-controls = "sidebar" >
< i class = "fa fa-bars" > < / i >
< / button >
< button id = "theme-toggle" class = "icon-button" type = "button" title = "Change theme" aria-label = "Change theme" aria-haspopup = "true" aria-expanded = "false" aria-controls = "theme-list" >
< i class = "fa fa-paint-brush" > < / i >
< / button >
< ul id = "theme-list" class = "theme-popup" aria-label = "Themes" role = "menu" >
< li role = "none" > < button role = "menuitem" class = "theme" id = "light" > Light (default)< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "rust" > Rust< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "coal" > Coal< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "navy" > Navy< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "ayu" > Ayu< / button > < / li >
< / ul >
< button id = "search-toggle" class = "icon-button" type = "button" title = "Search. (Shortkey: s)" aria-label = "Toggle Searchbar" aria-expanded = "false" aria-keyshortcuts = "S" aria-controls = "searchbar" >
< i class = "fa fa-search" > < / i >
< / button >
< / div >
< h1 class = "menu-title" > Kanidm Administration< / h1 >
< div class = "right-buttons" >
2022-06-05 07:20:33 +02:00
< a href = "../print.html" title = "Print this book" aria-label = "Print this book" >
2022-04-27 13:22:11 +02:00
< i id = "print-button" class = "fa fa-print" > < / i >
< / a >
2022-07-05 03:51:41 +02:00
< a href = "https://github.com/kanidm/kanidm" title = "Git repository" aria-label = "Git repository" >
< i id = "git-repository-button" class = "fa fa-github" > < / i >
< / a >
< a href = "https://github.com/kanidm/kanidm/edit/master/kanidm_book/src/integrations/pam_and_nsswitch.md" title = "Suggest an edit" aria-label = "Suggest an edit" >
< i id = "git-edit-button" class = "fa fa-edit" > < / i >
< / a >
2022-04-27 13:22:11 +02:00
< / div >
< / div >
< div id = "search-wrapper" class = "hidden" >
< form id = "searchbar-outer" class = "searchbar-outer" >
< input type = "search" id = "searchbar" name = "searchbar" placeholder = "Search this book ..." aria-controls = "searchresults-outer" aria-describedby = "searchresults-header" >
< / form >
< div id = "searchresults-outer" class = "searchresults-outer hidden" >
< div id = "searchresults-header" class = "searchresults-header" > < / div >
< ul id = "searchresults" >
< / ul >
< / div >
< / div >
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
< script type = "text/javascript" >
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
});
< / script >
< div id = "content" class = "content" >
< main >
< h1 id = "pam-and-nsswitch" > < a class = "header" href = "#pam-and-nsswitch" > PAM and nsswitch< / a > < / h1 >
2022-06-02 03:20:33 +02:00
< p > < a href = "http://linux-pam.org" > PAM< / a > and < a href = "https://en.wikipedia.org/wiki/Name_Service_Switch" > nsswitch< / a >
are the core mechanisms used by Linux and BSD clients to resolve identities from an IDM service
like Kanidm into accounts that can be used on the machine for various interactive tasks.< / p >
< h2 id = "the-unix-daemon" > < a class = "header" href = "#the-unix-daemon" > The UNIX Daemon< / a > < / h2 >
< p > Kanidm provides a UNIX daemon that runs on any client that wants to use PAM and nsswitch integration.
The daemon can cache the accounts for users who have unreliable networks, or who leave
the site where Kanidm is hosted. The daemon is also able to cache missing-entry responses to reduce network
traffic and main server load.< / p >
< p > Additionally, running the daemon means that the PAM and nsswitch integration libraries can be small,
helping to reduce the attack surface of the machine. Similarly, a tasks daemon is available that can
create home directories on first login and supports several features related to aliases and links to
these home directories.< / p >
< p > We recommend you install the client daemon from your system package manager:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > # OpenSUSE
zypper in kanidm-unixd-clients
# Fedora
dnf install kanidm-unixd-clients
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > You can check the daemon is running on your Linux system with:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > systemctl status kanidm-unixd
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > You can check the privileged tasks daemon is running with:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > systemctl status kanidm-unixd-tasks
< / code > < / pre >
< blockquote >
< p > < strong > NOTE< / strong > The < code > kanidm_unixd_tasks< / code > daemon is not required for PAM and nsswitch functionality.
2022-06-02 03:20:33 +02:00
If disabled, your system will function as usual. It is, however, recommended due to the features
2022-04-27 13:22:11 +02:00
it provides supporting Kanidm's capabilities.< / p >
< / blockquote >
< p > Both unixd daemons use the connection configuration from /etc/kanidm/config. This is the covered in
2022-05-23 04:11:43 +02:00
< a href = "./client_tools.html#kanidm-configuration" > client_tools< / a > .< / p >
2022-06-02 03:20:33 +02:00
< p > You can also configure some unixd-specific options with the file /etc/kanidm/unixd:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > pam_allowed_login_groups = [" posix_group" ]
default_shell = " /bin/sh"
home_prefix = " /home/"
home_attr = " uuid"
home_alias = " spn"
uid_attr_map = " spn"
gid_attr_map = " spn"
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > < code > pam_allowed_login_groups< / code > defines a set of POSIX groups where membership of any of these
groups will be allowed to login via PAM. All POSIX users and groups can be resolved by nss
regardless of PAM login status. This may be a group name, spn, or uuid.< / p >
< p > < code > default_shell< / code > is the default shell for users. Defaults to < code > /bin/sh< / code > .< / p >
2022-04-27 13:22:11 +02:00
< p > < code > home_prefix< / code > is the prepended path to where home directories are stored. Must end with
a trailing < code > /< / code > . Defaults to < code > /home/< / code > .< / p >
< p > < code > home_attr< / code > is the default token attribute used for the home directory path. Valid
choices are < code > uuid< / code > , < code > name< / code > , < code > spn< / code > . Defaults to < code > uuid< / code > .< / p >
2022-06-02 03:20:33 +02:00
< p > < code > home_alias< / code > is the default token attribute used for generating symlinks
pointing to the user's
2022-04-27 13:22:11 +02:00
home directory. If set, this will become the value of the home path
to nss calls. It is recommended you choose a " human friendly" attribute here.
Valid choices are < code > none< / code > , < code > uuid< / code > , < code > name< / code > , < code > spn< / code > . Defaults to < code > spn< / code > .< / p >
< blockquote >
< p > < strong > NOTICE:< / strong >
All users in Kanidm can change their name (and their spn) at any time. If you change
< code > home_attr< / code > from < code > uuid< / code > you < em > must< / em > have a plan on how to manage these directory renames
2022-06-02 03:20:33 +02:00
in your system. We recommend that you have a stable ID (like the UUID), and symlinks
from the name to the UUID folder. Automatic support is provided for this via the unixd
2022-04-27 13:22:11 +02:00
tasks daemon, as documented here.< / p >
< / blockquote >
< p > < code > uid_attr_map< / code > chooses which attribute is used for domain local users in presentation. Defaults
to < code > spn< / code > . Users from a trust will always use spn.< / p >
< p > < code > gid_attr_map< / code > chooses which attribute is used for domain local groups in presentation. Defaults
to < code > spn< / code > . Groups from a trust will always use spn.< / p >
2022-06-02 03:20:33 +02:00
< p > You can then check the communication status of the daemon:< / p >
< pre > < code > kanidm_unixd_status
2022-04-27 13:22:11 +02:00
< / code > < / pre >
< p > If the daemon is working, you should see:< / p >
< pre > < code > [2020-02-14T05:58:37Z INFO kanidm_unixd_status] working!
< / code > < / pre >
< p > If it is not working, you will see an error message:< / p >
2022-06-02 03:20:33 +02:00
< pre > < code > [2020-02-14T05:58:10Z ERROR kanidm_unixd_status] Error ->
Os { code: 111, kind: ConnectionRefused, message: " Connection refused" }
2022-04-27 13:22:11 +02:00
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > For more information, see the
< a href = "./pam_and_nsswitch.html#troubleshooting" > Troubleshooting< / a > section.< / p >
2022-04-27 13:22:11 +02:00
< h2 id = "nsswitch" > < a class = "header" href = "#nsswitch" > nsswitch< / a > < / h2 >
< p > When the daemon is running you can add the nsswitch libraries to /etc/nsswitch.conf< / p >
< pre > < code > passwd: compat kanidm
group: compat kanidm
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > You can < a href = "./accounts_and_groups.html#creating-accounts" > create a user< / a > then
< a href = "./posix_accounts.html#enabling-posix-attributes-on-accounts" > enable POSIX feature on the user< / a > .< / p >
< p > You can then test that the POSIX extended user is able to be resolved with:< / p >
< pre > < code > getent passwd < account name>
getent passwd testunix
2022-04-27 13:22:11 +02:00
testunix:x:3524161420:3524161420:testunix:/home/testunix:/bin/sh
< / code > < / pre >
< p > You can also do the same for groups.< / p >
2022-06-02 03:20:33 +02:00
< pre > < code > getent group < group name>
getent group testgroup
2022-04-27 13:22:11 +02:00
testgroup:x:2439676479:testunix
< / code > < / pre >
< blockquote >
2022-06-02 03:20:33 +02:00
< p > < strong > HINT< / strong > Remember to also create a UNIX password with something like
2022-04-27 13:22:11 +02:00
< code > kanidm account posix set_password --name idm_admin demo_user< / code > .
Otherwise there will be no credential for the account to authenticate. < / p >
< / blockquote >
< h2 id = "pam" > < a class = "header" href = "#pam" > PAM< / a > < / h2 >
< blockquote >
< p > < strong > WARNING:< / strong > Modifications to PAM configuration < em > may< / em > leave your system in a state
where you are unable to login or authenticate. You should always have a recovery
2022-06-02 03:20:33 +02:00
shell open while making changes (for example, root), or have access to single-user mode
2022-04-27 13:22:11 +02:00
at the machine's console.< / p >
< / blockquote >
2022-06-02 03:20:33 +02:00
< p > Pluggable Authentication Modules (PAM) is the mechanism a UNIX-like system
that authenticates users, and to control access to some resources. This is
configured through a stack of modules
that are executed in order to evaluate the request, and then each module may
request or reuse authentication token information.< / p >
< h3 id = "before-you-start" > < a class = "header" href = "#before-you-start" > Before You Start< / a > < / h3 >
< p > You < em > should< / em > backup your /etc/pam.d directory from its original state as you
< em > may< / em > change the PAM configuration in a way that will not allow you
to authenticate to your machine.< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > cp -a /etc/pam.d /root/pam.d.backup
< / code > < / pre >
< h3 id = "suse--opensuse" > < a class = "header" href = "#suse--opensuse" > SUSE / OpenSUSE< / a > < / h3 >
2022-06-02 03:20:33 +02:00
< p > To configure PAM on suse you must modify four files, which control the
various stages of authentication:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > /etc/pam.d/common-account
/etc/pam.d/common-auth
/etc/pam.d/common-password
/etc/pam.d/common-session
< / code > < / pre >
< blockquote >
< p > < strong > IMPORTANT< / strong > By default these files are symlinks to their corresponding < code > -pc< / code > file, for example
< code > common-account -> common-account-pc< / code > . If you directly edit these you are updating the inner
content of the < code > -pc< / code > file and it WILL be reset on a future upgrade. To prevent this you must
first copy the < code > -pc< / code > files. You can then edit the files safely.< / p >
< / blockquote >
< pre > < code > cp /etc/pam.d/common-account-pc /etc/pam.d/common-account
cp /etc/pam.d/common-auth-pc /etc/pam.d/common-auth
cp /etc/pam.d/common-password-pc /etc/pam.d/common-password
cp /etc/pam.d/common-session-pc /etc/pam.d/common-session
< / code > < / pre >
< p > The content should look like:< / p >
< pre > < code > # /etc/pam.d/common-auth-pc
# Controls authentication to this system (verification of credentials)
auth required pam_env.so
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid > = 1000 quiet_success
auth sufficient pam_kanidm.so ignore_unknown_user
auth required pam_deny.so
# /etc/pam.d/common-account-pc
# Controls authorisation to this system (who may login)
account [default=1 ignore=ignore success=ok] pam_localuser.so
2022-05-24 06:01:51 +02:00
account sufficient pam_unix.so
2022-04-27 13:22:11 +02:00
account [default=1 ignore=ignore success=ok] pam_succeed_if.so uid > = 1000 quiet_success quiet_fail
account sufficient pam_kanidm.so ignore_unknown_user
2022-05-24 06:01:51 +02:00
account required pam_deny.so
2022-04-27 13:22:11 +02:00
# /etc/pam.d/common-password-pc
# Controls flow of what happens when a user invokes the passwd command. Currently does NOT
# interact with kanidm.
password [default=1 ignore=ignore success=ok] pam_localuser.so
password required pam_unix.so use_authtok nullok shadow try_first_pass
password [default=1 ignore=ignore success=ok] pam_succeed_if.so uid > = 1000 quiet_success quiet_fail
password required pam_kanidm.so
# /etc/pam.d/common-session-pc
# Controls setup of the user session once a successful authentication and authorisation has
# occured.
session optional pam_systemd.so
session required pam_limits.so
session optional pam_unix.so try_first_pass
session optional pam_umask.so
session [default=1 ignore=ignore success=ok] pam_succeed_if.so uid > = 1000 quiet_success quiet_fail
session optional pam_kanidm.so
session optional pam_env.so
< / code > < / pre >
< blockquote >
< p > < strong > WARNING:< / strong > Ensure that < code > pam_mkhomedir< / code > or < code > pam_oddjobd< / code > are < em > not< / em > present in any stage of your
2022-06-02 03:20:33 +02:00
PAM configuration, as they interfere with the correct operation of the
Kanidm tasks daemon.< / p >
2022-04-27 13:22:11 +02:00
< / blockquote >
< h3 id = "fedora--centos" > < a class = "header" href = "#fedora--centos" > Fedora / CentOS< / a > < / h3 >
< blockquote >
< p > < strong > WARNING:< / strong > Kanidm currently has no support for SELinux policy - this may mean you need to
run the daemon with permissive mode for the unconfined_service_t daemon type. To do this run:
< code > semanage permissive -a unconfined_service_t< / code > . To undo this run < code > semanage permissive -d unconfined_service_t< / code > .< / p >
2022-06-02 03:20:33 +02:00
< p > You may also need to run < code > audit2allow< / code > for sshd and other types to be able to access the UNIX daemon sockets.< / p >
2022-04-27 13:22:11 +02:00
< / blockquote >
2022-06-02 03:20:33 +02:00
< p > These files are managed by authselect as symlinks. You can either work with
authselect, or remove the symlinks first.< / p >
2022-05-10 03:03:16 +02:00
< h4 id = "without-authselect" > < a class = "header" href = "#without-authselect" > Without authselect< / a > < / h4 >
2022-06-02 03:20:33 +02:00
< p > If you just remove the symlinks:< / p >
< p > Edit the content.< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > # /etc/pam.d/password-auth
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
2022-05-10 03:03:16 +02:00
auth sufficient pam_kanidm.so ignore_unknown_user
2022-04-27 13:22:11 +02:00
auth required pam_deny.so
account sufficient pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_usertype.so issystem
2022-05-10 03:03:16 +02:00
account sufficient pam_kanidm.so ignore_unknown_user
2022-04-27 13:22:11 +02:00
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
2022-05-10 03:03:16 +02:00
password sufficient pam_kanidm.so
2022-04-27 13:22:11 +02:00
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
2022-05-10 03:03:16 +02:00
session optional pam_kanidm.so
2022-04-27 13:22:11 +02:00
< / code > < / pre >
< ul >
< li > < / li >
< / ul >
< pre > < code > # /etc/pam.d/system-auth
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_fprintd.so
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
2022-05-10 03:03:16 +02:00
auth sufficient pam_kanidm.so ignore_unknown_user
2022-04-27 13:22:11 +02:00
auth required pam_deny.so
account sufficient pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_usertype.so issystem
2022-05-10 03:03:16 +02:00
account sufficient pam_kanidm.so ignore_unknown_user
2022-04-27 13:22:11 +02:00
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
2022-05-10 03:03:16 +02:00
password sufficient pam_kanidm.so
2022-04-27 13:22:11 +02:00
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
2022-05-10 03:03:16 +02:00
session optional pam_kanidm.so
2022-04-27 13:22:11 +02:00
< / code > < / pre >
2022-05-10 03:03:16 +02:00
< h4 id = "with-authselect" > < a class = "header" href = "#with-authselect" > With authselect< / a > < / h4 >
2022-06-02 03:20:33 +02:00
< p > To work with authselect:< / p >
< p > You will need to
< a href = "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_authentication_and_authorization_in_rhel/configuring-user-authentication-using-authselect_configuring-authentication-and-authorization-in-rhel#creating-and-deploying-your-own-authselect-profile_configuring-user-authentication-using-authselect" > create a new profile< / a > .< / p >
<!-- TODO this URL is too short -->
< p > First run the following command:< / p >
2022-05-10 03:03:16 +02:00
< pre > < code > authselect create-profile kanidm -b sssd
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > A new folder, /etc/authselect/custom/kanidm, should be created. Inside that folder, create or
overwrite the following three files: nsswitch.conf, password-auth, system-auth.
password-auth and system-auth should be the same as above. nsswitch should be
modified for your use case. A working example looks like this:< / p >
2022-05-10 03:03:16 +02:00
< pre > < code > passwd: compat kanidm sss files systemd
group: compat kanidm sss files systemd
shadow: files
hosts: files dns myhostname
services: sss files
netgroup: sss files
automount: sss files
aliases: files
ethers: files
gshadow: files
networks: files dns
protocols: files
publickey: files
rpc: files
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > Then run:< / p >
2022-05-10 03:03:16 +02:00
< pre > < code > authselect select custom/kanidm
< / code > < / pre >
< p > to update your profile.< / p >
2022-04-27 13:22:11 +02:00
< h2 id = "troubleshooting" > < a class = "header" href = "#troubleshooting" > Troubleshooting< / a > < / h2 >
2022-06-02 03:20:33 +02:00
< h3 id = "check-posix-status-of-group-and-configuration" > < a class = "header" href = "#check-posix-status-of-group-and-configuration" > Check POSIX-status of Group and Configuration< / a > < / h3 >
2022-04-27 13:22:11 +02:00
< p > If authentication is failing via PAM, make sure that a list of groups is configured in < code > /etc/kanidm/unixd< / code > :< / p >
< pre > < code > pam_allowed_login_groups = [" example_group" ]
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > Check the status of the group with < code > kanidm group posix show example_group< / code > .
If you get something similar to the following example:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code class = "language-shell" > > kanidm group posix show example_group
Using cached token for name idm_admin
2022-06-02 03:20:33 +02:00
Error -> Http(500, Some(InvalidAccountState(" Missing class: account & & posixaccount OR group & & posixgroup" )),
" b71f137e-39f3-4368-9e58-21d26671ae24" )
2022-04-27 13:22:11 +02:00
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > POSIX-enable the group with < code > kanidm group posix set example_group< / code > . You should get a result similar
to this when you search for your group name:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code class = "language-shell" > > kanidm group posix show example_group
[ spn: example_group@kanidm.example.com, gidnumber: 3443347205 name: example_group, uuid: b71f137e-39f3-4368-9e58-21d26671ae24 ]
< / code > < / pre >
< p > Also, ensure the target user is in the group by running:< / p >
< pre > < code > > kanidm group list_members example_group
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< h3 id = "increase-logging" > < a class = "header" href = "#increase-logging" > Increase Logging< / a > < / h3 >
2022-04-27 13:22:11 +02:00
< p > For the unixd daemon, you can increase the logging with:< / p >
< pre > < code > systemctl edit kanidm-unixd.service
< / code > < / pre >
< p > And add the lines:< / p >
< pre > < code > [Service]
Environment=" RUST_LOG=kanidm=debug"
< / code > < / pre >
< p > Then restart the kanidm-unixd.service.< / p >
< p > The same pattern is true for the kanidm-unixd-tasks.service daemon.< / p >
< p > To debug the pam module interactions add < code > debug< / code > to the module arguments such as:< / p >
< pre > < code > auth sufficient pam_kanidm.so debug
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< h3 id = "check-the-socket-permissions" > < a class = "header" href = "#check-the-socket-permissions" > Check the Socket Permissions< / a > < / h3 >
< p > Check that the < code > /var/run/kanidm-unixd/sock< / code > has permissions mode 777, and that non-root readers can see it with
2022-04-27 13:22:11 +02:00
ls or other tools.< / p >
2022-06-02 03:20:33 +02:00
< p > Ensure that < code > /var/run/kanidm-unixd/task_sock< / code > has permissions mode 700, and
that it is owned by the kanidm unixd process user.< / p >
< h3 id = "verify-that-you-can-access-the-kanidm-server" > < a class = "header" href = "#verify-that-you-can-access-the-kanidm-server" > Verify that You Can Access the Kanidm Server< / a > < / h3 >
2022-04-27 13:22:11 +02:00
< p > You can check this with the client tools:< / p >
< pre > < code > kanidm self whoami --name anonymous
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< h3 id = "ensure-the-libraries-are-correct" > < a class = "header" href = "#ensure-the-libraries-are-correct" > Ensure the Libraries are Correct< / a > < / h3 >
2022-04-27 13:22:11 +02:00
< p > You should have:< / p >
< pre > < code > /usr/lib64/libnss_kanidm.so.2
/usr/lib64/security/pam_kanidm.so
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > The exact path < em > may< / em > change depending on your distribution, < code > pam_unixd.so< / code > should be co-located
with pam_kanidm.so. Look for it with the find command:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > find /usr/ -name 'pam_unix.so'
< / code > < / pre >
< p > For example, on a Debian machine, it's located in < code > /usr/lib/x86_64-linux-gnu/security/< / code > .< / p >
2022-06-02 03:20:33 +02:00
< h3 id = "increase-connection-timeout" > < a class = "header" href = "#increase-connection-timeout" > Increase Connection Timeout< / a > < / h3 >
< p > In some high-latency environments, you may need to increase the connection timeout. We set
2022-04-27 13:22:11 +02:00
this low to improve response on LANs, but over the internet this may need to be increased.
2022-06-02 03:20:33 +02:00
By increasing the conn_timeout, you will be able to operate on higher latency
links, but some operations may take longer to complete causing a degree of
latency. < / p >
< p > By increasing the cache_timeout, you will need to refresh less often, but it may result in an
account lockout or group change until cache_timeout takes effect. Note that this has security
implications:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > # /etc/kanidm/unixd
# Seconds
conn_timeout = 8
# Cache timeout
cache_timeout = 60
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< h3 id = "invalidate-or-clear-the-cache" > < a class = "header" href = "#invalidate-or-clear-the-cache" > Invalidate or Clear the Cache< / a > < / h3 >
2022-04-27 13:22:11 +02:00
< p > You can invalidate the kanidm_unixd cache with:< / p >
2022-06-02 03:20:33 +02:00
< pre > < code > kanidm_cache_invalidate
2022-04-27 13:22:11 +02:00
< / code > < / pre >
< p > You can clear (wipe) the cache with:< / p >
2022-06-02 03:20:33 +02:00
< pre > < code > kanidm_cache_clear
2022-04-27 13:22:11 +02:00
< / code > < / pre >
< p > There is an important distinction between these two - invalidated cache items may still
be yielded to a client request if the communication to the main Kanidm server is not
possible. For example, you may have your laptop in a park without wifi.< / p >
< p > Clearing the cache, however, completely wipes all local data about all accounts and groups.
2022-06-02 03:20:33 +02:00
If you are relying on this cached (but invalid) data, you may lose access to your accounts until
2022-04-27 13:22:11 +02:00
other communication issues have been resolved.< / p >
< / main >
< nav class = "nav-wrapper" aria-label = "Page navigation" >
<!-- Mobile navigation buttons -->
2022-06-05 07:20:33 +02:00
< a rel = "prev" href = "../integrations/oauth2.html" class = "mobile-nav-chapters previous" title = "Previous chapter" aria-label = "Previous chapter" aria-keyshortcuts = "Left" >
2022-04-27 13:22:11 +02:00
< i class = "fa fa-angle-left" > < / i >
< / a >
2022-06-05 07:20:33 +02:00
< a rel = "next" href = "../integrations/radius.html" class = "mobile-nav-chapters next" title = "Next chapter" aria-label = "Next chapter" aria-keyshortcuts = "Right" >
2022-04-27 13:22:11 +02:00
< i class = "fa fa-angle-right" > < / i >
< / a >
< div style = "clear: both" > < / div >
< / nav >
< / div >
< / div >
< nav class = "nav-wide-wrapper" aria-label = "Page navigation" >
2022-06-05 07:20:33 +02:00
< a rel = "prev" href = "../integrations/oauth2.html" class = "nav-chapters previous" title = "Previous chapter" aria-label = "Previous chapter" aria-keyshortcuts = "Left" >
2022-04-27 13:22:11 +02:00
< i class = "fa fa-angle-left" > < / i >
< / a >
2022-06-05 07:20:33 +02:00
< a rel = "next" href = "../integrations/radius.html" class = "nav-chapters next" title = "Next chapter" aria-label = "Next chapter" aria-keyshortcuts = "Right" >
2022-04-27 13:22:11 +02:00
< i class = "fa fa-angle-right" > < / i >
< / a >
< / nav >
< / div >
< script type = "text/javascript" >
window.playground_copyable = true;
< / script >
2022-06-05 07:20:33 +02:00
< script src = "../elasticlunr.min.js" type = "text/javascript" charset = "utf-8" > < / script >
< script src = "../mark.min.js" type = "text/javascript" charset = "utf-8" > < / script >
< script src = "../searcher.js" type = "text/javascript" charset = "utf-8" > < / script >
< script src = "../clipboard.min.js" type = "text/javascript" charset = "utf-8" > < / script >
< script src = "../highlight.js" type = "text/javascript" charset = "utf-8" > < / script >
< script src = "../book.js" type = "text/javascript" charset = "utf-8" > < / script >
2022-04-27 13:22:11 +02:00
<!-- Custom JS scripts -->
< / body >
< / html >
