Hi Sumit,
Your test packages and configuration changes are working very well. I
See no issues with the two machines on which the fixes were applied.
The two systems are running Scientific LInux 7.2 and Centos 7.2. I will
continue to perform more tests to see if there are any issues.
I do have another question to ask you in the meantime. The question was
asked, "How long would it take for these changes to make there way into
the current repos?" Do you think it will take few weeks, or will we
need to wait for the next point release? We are just trying to
determine how to proceed in rolling out the packages.
Thanks again,
*Michael Rainey*
On 03/24/2016 05:09 AM, Sumit Bose wrote:
On Wed, Mar 23, 2016 at 12:25:50PM -0500, Michael Rainey (Contractor) wrote:
Hi Sumit,
I've trying to download the rpm via the Koji client and have been unable to
locate package. Are there any extra steps I need to complete before I can
find the package, such as, create an account in Fedora Build System.
Performing a general search for SSSD only returns a list of packages from
Fedora Projects and nothing from the EL repo.
The link I sent is the meta link for the different supported platforms
(x86_64, pcc64 and pcc64le). If you select the link for x86_64 you
should be able to see download links for the x86_64 packages.
Nevertheless I created a new build
http://koji.fedoraproject.org/koji/taskinfo?taskID=13446490 to fix some
issue with the package version number in the previous build. The x86_64
packages can be found at
http://koji.fedoraproject.org/koji/taskinfo?taskID=13446491 . To make
the download easy you can try the following command:
curl http://koji.fedoraproject.org/koji/taskinfo?taskID=13446491 | grep -o
'"https://.*.rpm";' | xargs -n 1 curl -L -O
HTH
bye,
Sumit
Thanks,
*Michael Rainey*
NRL 7320
Computer Support Group
Building 1009, Room C156
Stennis Space Center, MS 39529
On 03/22/2016 07:25 AM, Sumit Bose wrote:
On Fri, Mar 18, 2016 at 10:53:08AM -0500, Michael Rainey (Contractor) wrote:
Hi Sumit,
It has been a week and I am following up with you on the lock screen issue.
Have you had any progress? If so, I am hoping implementing the fix will be
quick and easy.
Thank you for your patience. Please find a test build for RHEL/CentOS
7.2 at https://koji.fedoraproject.org/koji/taskinfo?taskID=13412048 .
Besides the updated version of SSSD you should replace
/etc/pam.d/smartcard-auth with
======== /etc/pam.d/smartcard-auth =========
auth required pam_env.so
auth sufficient pam_sss.so allow_missing_name
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
use_uid
session required pam_unix.so
session optional pam_sss.so
===========================================
and /etc/dconf/db/distro.d/10-authconfig
===== /etc/dconf/db/distro.d/10-authconfig =====
[org/gnome/login-screen]
enable-fingerprint-authentication=false
[org/gnome/settings-daemon/peripherals/smartcard]
removal-action='lock-screen'
===============================================
and /etc/dconf/db/distro.d/locks/10-authconfig-locks
====== /etc/dconf/db/distro.d/locks/10-authconfig-locks ===
/org/gnome/login-screen/enable-fingerprint-authentication
/org/gnome/settings-daemon/peripherals/smartcard
===========================================================
and call 'dconf update' to get the new setting loaded. Finally it might
be a good idea to restart gdm to make sure the new setting and PAM
configuration is really active although I would expect that gdm is able
to pick up the changes at run-time.
Any feedback, good or bad, is welcome.
bye,
Sumit
Thanks,
*Michael Rainey*
On 03/11/2016 02:32 AM, Sumit Bose wrote:
On Thu, Mar 10, 2016 at 01:36:15PM -0600, Michael Rainey (Contractor) wrote:
Greetings,
I have been adding systems to my new domain and utilizing the smart card
login feature. To date the smart card login feature is working very well.
However, my group has been trying to implement locking the screen when the
smart card is removed, but have not been successful at making it work. Does
anyone have any suggestions as to what it would take to enable locking the
screen when the smart card is removed.
This requires a better integration with gdm which is currently WIP
(https://fedorahosted.org/sssd/ticket/2941). If you don't mind please
ping me in about a week about this again, then I might have done some
more testing.
bye,
Sumit
Thank you in advance.
--
*Michael Rainey*
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
