root@Computer253var/log/sssd# cat /etc/krb5.conf
 
[libdefaults]
udp_preference_limit = 0
default_realm = intra.domain.fr
dns_lookup_realm = true
dns_lookup_kdc = true
root@Computer253var/log/sssd# cat /etc/sssd.conf
cat: /etc/sssd.conf: Aucun fichier ou dossier de ce type
root@Computer253var/log/sssd# systemctl status sssd
● sssd.service - System Security Services Daemon
     Loaded: loaded (/lib/systemd/system/sssd.service; enabled; preset: enabled)
     Active: active (running) since Wed 2024-07-03 17:03:26 CEST; 7min ago
   Main PID: 18260 (sssd)
      Tasks: 2 (limit: 37992)
     Memory: 19.5M
        CPU: 3min 32.115s
     CGroup: /system.slice/sssd.service
             ├─18260 /usr/sbin/sssd -i --logger=files
             └─18715 /usr/libexec/sssd/sssd_be --domain intra.domain.fr --uid 0 --gid 0 --logger=files
 
juil. 03 17:09:12 Computer253 sssd_be[18610]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied
juil. 03 17:09:12 Computer253 sssd_be[18610]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb
juil. 03 17:09:43 Computer253 sssd[18260]: Child [18610] ('intra.domain.fr':'%BE_intra.domain.fr') was terminated by own WATCHDOG. Consult corresponding logs to figure out the reason.
juil. 03 17:09:43 Computer253 sssd_be[18652]: Starting up
juil. 03 17:09:43 Computer253 sssd_be[18652]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied
juil. 03 17:09:43 Computer253 sssd_be[18652]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb
juil. 03 17:10:34 Computer253 sssd[18260]: Child [18652] ('intra.domain.fr':'%BE_intra.domain.fr') was terminated by own WATCHDOG. Consult corresponding logs to figure out the reason.
juil. 03 17:10:34 Computer253 sssd_be[18715]: Starting up
juil. 03 17:10:34 Computer253 sssd_be[18715]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied
juil. 03 17:10:34 Computer253 sssd_be[18715]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb
 
root@Computer253var/log/sssd# cat /etc/krb5.conf
 
[libdefaults]
udp_preference_limit = 0
default_realm = intra.domain.fr
dns_lookup_realm = true
dns_lookup_kdc = true
root@Computer253var/log/sssd# cat /etc/sssd/sssd.conf  
 
[sssd]
domains = intra.domain.fr
default_domain_suffix = intra.domain.fr
config_file_version = 2
# services = nss, pam
implicit_pac_responder = False
 
[domain/intra.domain.fr]
access_provider =ad
ad_domain = intra.domain.fr
# ad_server = server1, server2, server3
# auth_provider = ad
cache_credentials = True
default_shell = /bin/bash
debug_level = 3
enumerate = True
fallback_homedir = /home/%u@%d
override_homedir = /home/%u@%d
id_provider = ad
ldap_id_mapping = True
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
krb5_store_password_if_offline = True
krb5_realm = intra.domain.fr
realmd_tags = manages-system joined-with-adcli  
use_fully_qualified_names = True
dyndns_update = False
 
root@Computer253var/log/sssd# cat /etc/pam.conf  
# ---------------------------------------------------------------------------#
# /etc/pam.conf             #
# ---------------------------------------------------------------------------#
#
# NOTE
# ----
#
# NOTE: Most program use a file under the /etc/pam.d/ directory to setup their
# PAM service modules. This file is used only if that directory does not exist.
# ---------------------------------------------------------------------------#
 
# Format:
# serv. module    ctrl       module [path] ...[args..]       #
# name type    flag            #
                     
root@Computer253var/log/sssd# cat /etc/pam.d/common-auth  
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
 
# here are the per-package modules (the "Primary" block)
auth [success=2 default=ignore] pam_unix.so nullok
auth [success=1 default=ignore] pam_sss.so use_first_pass
# here's the fallback if no module succeeds
auth requisite   pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required   pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
root@Computer253var/log/sssd# cat /etc/pam.d/common-
common-account                 common-auth                    common-password                common-session                 common-session-noninteractive  
 
root@Computer253var/log/sssd# cat /etc/pam.d/common-account  
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#
 
# here are the per-package modules (the "Primary" block)
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so  
# here's the fallback if no module succeeds
account requisite   pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required   pam_permit.so
# and here are more per-package modules (the "Additional" block)
account sufficient   pam_localuser.so  
account [default=bad success=ok user_unknown=ignore] pam_sss.so  
# end of pam-auth-update config
 
root@Computer253var/log/sssd# cat /etc/pam.d/common-session
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of interactive sessions.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
 
# here are the per-package modules (the "Primary" block)
session [default=1]   pam_permit.so
# here's the fallback if no module succeeds
session requisite   pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required   pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required pam_unix.so  
session optional pam_sss.so  
session optional pam_systemd.so
session optional pam_mkhomedir.so skel=/etc/skel umask=077
session optional pam_mount.so  
# end of pam-auth-update config