Default SSSD template for ccache file is /tmp/krb5cc_%U_XXXXXX, where
XXXXXX is a suffix that will be interpreted by mkstemp(3) to create a
unique file name, while the standard configuration of the libkrb5
library is `/tmp/krb5cc_%U`.
To guarantee compatibility with the existing system, we force the use
of the standard model in SSSD.
Mark PAM profiles krb5, sss and yourdev as "seen" in /var/lib/pam so
next execution of command /usr/sbin/pam-auth-update in interactive
mode will ignore the values of 'Default' properties.
This avoids the automatic selection of the sss profile, which conflicts
with the yourdev profile.
Rationale: when configured with /etc/krb5.conf, SSSD ignores the values
of dns_lookup_kdc and dns_lookp_realm properties, ignores the static kdc
servers declared in the [realms] section, and always try to find the
Kerberos TGT servers using DNS _srv_ discovery, based on the realm name
as search domain (which is not optimal in the Orange network).
It's easier to define how to get the list of Kerberos servers from the
SSSD configuration, because then you can either give a static list of
servers or use DNS discovery by specifying the right search domain.
If krb5_use_kdcinfo property value is true (the default), then the
Kerberos servers are taken from sssd.conf, otherwise if the value is
false then the servers are taken from krb5.conf
Presence of comments in pam-configs/ file cause several warnings when
invoking command `pam-auth-updates` (use of uninitialized value), and
then later the PAM configuration is broken:
- SSH login fails immediately (connection closed)
- opening a session with `sudo su -` is impossible (authorisation refused)
- and maybe more...
Without comments in /usr/share/pam-configs/yourdev, everything works as
expected, no warnings in `pam-auth-updates`, no authentication problems.
Using the "change password" feature of pam_sss modules always lead to a
bad situation where AD password and Gassi password are not synchronyzed
anymore. To avoid this, we disable the feature in SSSD configuration.
The network password can still be changed using the command `kpasswd`
provided by package `krb5-user`.
Properties 'Password:' and 'Password-Initial:' are intentionally removed
from /usr/share/pam-configs/yourdev because changing a remote password
from the host using standard commands does not work in the Orange
environment : it changes the password in the Active Directory backend,
but not in the Gassi backend (they are not synchronized), and you end
up with two active passwords: the new one for kinit, IMAP, SMTP, SMB,
etc. and the old one for all websites from MonSI ...
With this configuration, you must use first the 'mot de passe attitude'
website to change your AD/Gassi password, and then the command `passwd`
to synchronize your local password.
I would have preferred something shorter like "trespassers will be shot",
but it seems that it is better to quote an article of the criminal code.
Note: the text of the banner is automatically wrapped by GDM, the use
of line breaks is not required.
With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.
According to pam-auth-update(8), it is an error to use option --force
in postinst script:
This option must not be used by package maintainer scripts;
it is intended for use by administrators only.
