sssd

MS Active Directory & Linux: Auth with sssd

I'm using AWS Directory server (MS Active Directory type) to auth into my Linux machines.

I followed this and all is working fine but I have a misconfiguration into /etc/sssd/sssd.conf.

Before add the linux machine to the MS domain I this is my sssd.conf


[sssd]
domains = example.net
config_file_version = 2
services = nss, pam

After run

example3-core-test01# realm join -U Admin example.net --verbose
.
.
.
 * Using fully qualified name: example3-core-test01.example.net
 * Using domain name: example.net
 * Using computer account name: example3-CORE-TES
 * Using domain realm: example.net
 * Using fully qualified name: example3-core-test01.example.net
 * Enrolling computer name: example3-CORE-TES
 * Found computer account for example3-CORE-TES$ at: CN=example3-CORE-TES,OU=Computers,OU=example,DC=example,DC=net
 * Deleted computer account at: CN=example3-CORE-TES,OU=Computers,OU=example,DC=example,DC=net
 * Removing entries from keytab for realm
 * /usr/sbin/sss_cache --users --groups --netgroups --services --autofs-maps
 * Removing domain configuration from sssd.conf
 * /usr/sbin/update-rc.d sssd disable
 * /usr/sbin/service sssd stop
 * Successfully unenrolled machine from realm

As you can see in output logs the hostname is truncated from example3-core-test01.example.net to example3-CORE-TES$. This happed in runtime. The machine is joined to MS Directory with the truncated name. Then, changing the name into /etc/sssd/sssd.conf have no sense.

Since I have more machines with this pattern name I have a problem.

This is the file /etc/sssd/sssd.conf after the joining.

[sssd]
domains = example.net
config_file_version = 2
services = nss, pam

[domain/example.net]
ad_domain = example.net
krb5_realm = EXAMPLE.NET
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = EXAMPLE3-CORE-TES$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad

I have two questions:

Solution

  • To avoid the truncated name we can use --computer-name

    example3-core-test01# realm join -U Admin example.net --computer-name=example3-core-test01 --verbose

    --automatic-id-mapping=no is usefull too if you are using Unix Atribbutes.