Why SSSD Service override_homedir triggers creation of home directory with wrong permissions?
0
votes
1
answer
266
views
I have a vendor application installed in an Ubuntu Jammy server that relies on SSSD v2.6.3 configured for LDAP integration for the authentication and creation of the home directory of the user in the server.
In the sssd.conf configuration it is present:
[sssd]
config_file_version=2
reconnection_retries=3
services=nss,pam
domains=mydomain.com
[nss]
...
[pam]
...
[domain/mydomain.com]
... ldap configuration ...
override_homedir=/sfs/home/%u
When user is authenticated the home directory created has the following set of permissions:
$ ls -lhtar /sfs/home
drwxr-xr-x 3 myuser mygroup 4.0K Jan 3 19:23 myuser
Unfortunately the permissions drwxr-xr-x
give also access to others to navigate in their home directory.
At the beginning I thought this was controlled by the PAM modules, in particular, the common-session
executing the pam_mkhomedir.so
module, **however this is not the case!!!**, since commenting this module does not have any effect, and also the home directory is always completely empty, not following the home "skeleton" usually provided in the mkhomedir e.g. session required pam_mkhomedir.so skel=/etc/skel/
.
I also noticed that the permissions drwxr-xr-x
correspond to a umask 022 which is usually the default in the linux distributions, so I have modify to a 006 in /etc/login.defs
and also add the umask 006 in /etc/profile
to avoid the use of the 022 umask, however this attempt has been also in vain.
is there anyone out there that has had this issue?
How can you force the right umask when home directory creation is being triggered by the SSSD service?
Thank you so much in advance!
Asked by Alejandro Arévalo
(111 rep)
Jan 3, 2024, 08:04 PM
Last activity: Jan 8, 2024, 11:47 AM
Last activity: Jan 8, 2024, 11:47 AM