Thanks for your reply. I tried to configure it with system-config-authentication (the same as authconfig-gtk) before but that tool did not generate a useable output. I adjusted sssd.conf manually afterwards and got "getent passwd" and ssh login to work. The two pam files you mentioned are shown below. Both include pam_sss.so in the authentication stack.
Bye
Bernd
/etc/pam.d/password-auth
authÂÂÂÂÂÂÂ requiredÂÂÂÂÂ pam_env.so
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_unix.so nullok try_first_pass
authÂÂÂÂÂÂÂ requisiteÂÂÂÂ pam_succeed_if.so uid >= 500 quiet
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_sss.so use_first_pass
authÂÂÂÂÂÂÂ requiredÂÂÂÂÂ pam_deny.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so broken_shadow
accountÂÂÂÂ sufficientÂÂÂ pam_localuser.so
accountÂÂÂÂ sufficientÂÂÂ pam_succeed_if.so uid < 500 quiet
accountÂÂÂÂ [default=bad success=ok user_unknown=ignore] pam_sss.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_permit.so
passwordÂÂÂ requisiteÂÂÂÂ pam_cracklib.so try_first_pass retry=3 type=
passwordÂÂÂ sufficientÂÂÂ pam_unix.so md5 shadow nullok try_first_pass use_authtok
passwordÂÂÂ sufficientÂÂÂ pam_sss.so use_authtok
passwordÂÂÂ requiredÂÂÂÂÂ pam_deny.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_keyinit.so revoke
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_limits.so
-sessionÂÂÂÂ optionalÂÂÂÂÂ pam_systemd.so
sessionÂÂÂÂ [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_sss.so
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_unix.so nullok try_first_pass
authÂÂÂÂÂÂÂ requisiteÂÂÂÂ pam_succeed_if.so uid >= 500 quiet
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_sss.so use_first_pass
authÂÂÂÂÂÂÂ requiredÂÂÂÂÂ pam_deny.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so broken_shadow
accountÂÂÂÂ sufficientÂÂÂ pam_localuser.so
accountÂÂÂÂ sufficientÂÂÂ pam_succeed_if.so uid < 500 quiet
accountÂÂÂÂ [default=bad success=ok user_unknown=ignore] pam_sss.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_permit.so
passwordÂÂÂ requisiteÂÂÂÂ pam_cracklib.so try_first_pass retry=3 type=
passwordÂÂÂ sufficientÂÂÂ pam_unix.so md5 shadow nullok try_first_pass use_authtok
passwordÂÂÂ sufficientÂÂÂ pam_sss.so use_authtok
passwordÂÂÂ requiredÂÂÂÂÂ pam_deny.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_keyinit.so revoke
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_limits.so
-sessionÂÂÂÂ optionalÂÂÂÂÂ pam_systemd.so
sessionÂÂÂÂ [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_sss.so
cat /etc/pam.d/system-auth
authÂÂÂÂÂÂÂ requiredÂÂÂÂÂ pam_env.so
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_unix.so nullok try_first_pass
authÂÂÂÂÂÂÂ requisiteÂÂÂÂ pam_succeed_if.so uid >= 500 quiet
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_sss.so use_first_pass
authÂÂÂÂÂÂÂ requiredÂÂÂÂÂ pam_deny.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so broken_shadow
accountÂÂÂÂ sufficientÂÂÂ pam_localuser.so
accountÂÂÂÂ sufficientÂÂÂ pam_succeed_if.so uid < 500 quiet
accountÂÂÂÂ [default=bad success=ok user_unknown=ignore] pam_sss.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_permit.so
passwordÂÂÂ requisiteÂÂÂÂ pam_cracklib.so try_first_pass retry=3 type=
passwordÂÂÂ sufficientÂÂÂ pam_unix.so md5 shadow nullok try_first_pass use_authtok
passwordÂÂÂ sufficientÂÂÂ pam_sss.so use_authtok
passwordÂÂÂ requiredÂÂÂÂÂ pam_deny.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_keyinit.so revoke
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_limits.so
-sessionÂÂÂÂ optionalÂÂÂÂÂ pam_systemd.so
sessionÂÂÂÂ [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_sss.so
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_unix.so nullok try_first_pass
authÂÂÂÂÂÂÂ requisiteÂÂÂÂ pam_succeed_if.so uid >= 500 quiet
authÂÂÂÂÂÂÂ sufficientÂÂÂ pam_sss.so use_first_pass
authÂÂÂÂÂÂÂ requiredÂÂÂÂÂ pam_deny.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so broken_shadow
accountÂÂÂÂ sufficientÂÂÂ pam_localuser.so
accountÂÂÂÂ sufficientÂÂÂ pam_succeed_if.so uid < 500 quiet
accountÂÂÂÂ [default=bad success=ok user_unknown=ignore] pam_sss.so
accountÂÂÂÂ requiredÂÂÂÂÂ pam_permit.so
passwordÂÂÂ requisiteÂÂÂÂ pam_cracklib.so try_first_pass retry=3 type=
passwordÂÂÂ sufficientÂÂÂ pam_unix.so md5 shadow nullok try_first_pass use_authtok
passwordÂÂÂ sufficientÂÂÂ pam_sss.so use_authtok
passwordÂÂÂ requiredÂÂÂÂÂ pam_deny.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_keyinit.so revoke
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_limits.so
-sessionÂÂÂÂ optionalÂÂÂÂÂ pam_systemd.so
sessionÂÂÂÂ [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
sessionÂÂÂÂ requiredÂÂÂÂÂ pam_unix.so
sessionÂÂÂÂ optionalÂÂÂÂÂ pam_sss.so
-- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
