[SSSD-users] Re: sssd failing due to self-signed certificates--but that's not what openssl says

2024-02-26 Thread Gordon Messmer
On 2024-02-21 09:45, Johnnie W Adams wrote:      So I've got a very puzzling situation. Just today, when I look at sssd with systemctl status, I get this error:*Could not start TLS encryption. error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed

[SSSD-users] Re: sshkey use allows expired account user to access system

2022-06-02 Thread Gordon Messmer
On 6/2/22 13:36, Jim Kinney wrote: It seems if valid ssh keys exist, the expired account status doesn't block login with ssh keys. I believe that's because *users* don't expire.  *Passwords* do. If you aren't authenticating with passwords, then password expiration doesn't affect the

[SSSD-users]Re: Trouble-shooting sssd’s ‘Automatic Kerberos Host Keytab Renewal’ with AD back-end….

2021-08-25 Thread Gordon Messmer
On 8/25/21 8:32 AM, Spike White wrote: Because we are researching an ongoing problem reported by L1 server ops.  About 70 – 80 sssd-enabled Linux servers / month drop off the domain.  Out of our current sssd-enabled population of ~20K server, that’s not horrible.  But still it should be

[SSSD-users] Unreadable GPOs should not be logged as a critical failure

2019-12-27 Thread Gordon Messmer
We've recently started receiving a lot of complaints from users about broadcast messages of the form: Message from syslogd@hostname at Dec 4 09:08:35 ... sssd[be[domain.lan]]:Group Policy Container with DN [cn={66062A26-FA18-4C56-A7E1-B22209856319},cn=policies,cn=system,DC=domain,DC=lan] is

[SSSD-users] Re: Could not convert objectSID ... to a UNIX ID

2019-07-31 Thread Gordon Messmer
On Tuesday, July 30, 2019 22:35 PDT, Sumit Bose wrote: the version of SSSD you are using should automatically pick a new range if the RID is too large. Can you send your sssd.conf for a start to better understand your setup and see what might preventing SSSD from picking a new range? The