Ttgjyuk

I'm setting up a lab, in this case we have few ubuntu 16.04 Desktop, in that I'm planning to login with kerberos user with sudo privileges. It means, whenever a new user login to this desktop with his kerberos creds, a home directory will create and he will get sudo privileges for this machine.

Env:-
16.04.4 LTS (Xenial Xerus)"
4.13.0-36-generic

In my case user=test , domain = AD.TEST.EDU hostname = test.com

Added in /etc/pam.d/common-session for enabling home directory

session optional pam_mkhomedir.so skel=/etc/skel/ umask=0077 
# end of pam-auth-update config

Regarding to enable sudo for these kerberos users, I couldn't find the info using "id" command

#id ad.test.edu\test
 id: ‘ad.test.edu\test’: no such user

But here klist shows fine. How can I add rule for these kerberos user in sudo list?

Below is the krb client configuration.

 $grep -i ad.te /etc/krb5.conf 
 kdc = ad.test.edu
 admin_server = ad.test.edu

I'm able to get the kerberos ticket without any issues

$kinit test@AD.TEST.EDU
 Password for test@AD.TEST.EDU: 

Below is the ticket details

 $klist 
 Ticket cache: FILE:/tmp/krb5cc_1000
 Default principal: test@AD.TEST.EDU

 Valid starting Expires Service principal
 03/20/2019 09:36:05 03/21/2019 02:36:05 
 krbtgt/AD.TEST.EDU@AD.TEST.EDU

Even from console, I'm able to retrieve tickets without any issues

Mar 20 10:09:58 TEST lightdm: pam_krb5(lightdm:auth): user test@AD.TEST.EDU authenticated as test@AD.TEST.EDU
Mar 20 10:09:58 TEST lightdm: gkr-pam: error looking up user information
Mar 20 10:09:58 TEST lightdm: pam_kwallet5(lightdm:auth): (null): pam_sm_authenticate
Mar 20 10:09:58 TEST lightdm: pam_kwallet5(lightdm:auth): pam_kwallet5: Couldn't get user info (passwd) info
Mar 20 10:09:58 TEST lightdm: pam_unix(lightdm:account): could not identify user (from getpwnam(test@AD.TEST.EDU))
Mar 20 10:09:58 TEST lightdm: PAM unable to dlopen(pam_kwallet.so): /lib/security/pam_kwallet.so: cannot open shared object file: No such file or directory
Mar 20 10:09:58 TEST lightdm: PAM adding faulty module: pam_kwallet.so

Here I thought, below entry causing problem, by eliminate this install this package - libpam-kwallet5 . But after that, once I login with local user, I'm unable to logout from the session, It takes 3 or 4 times try to hit the logout button. After removing this package - libpam-kwallet5 , there is no issue.

Mar 20 10:09:58 TEST lightdm: PAM unable to dlopen(pam_kwallet.so): /lib/security/pam_kwallet.so: cannot open shared object file: No such file or directory

I tried with kerberos user name syntax as "test@AD.TEST.EDU" , "test/AD.TEST.EDU" , test/AD.TEST.EDU@AD.TEST.EDU. Nothing help here.

Mar 20 10:14:35 TEST lightdm: pam_krb5(lightdm:auth): user test@AD.TEST.EDU authenticated as test@AD.TEST.EDU
Mar 20 10:14:35 TEST lightdm: gkr-pam: error looking up user information
Mar 20 10:14:35 TEST lightdm: pam_kwallet(lightdm:auth): (null): pam_sm_authenticate
Mar 20 10:14:35 TEST lightdm: pam_kwallet(lightdm:auth): pam_kwallet: Couldn't get user info (passwd) info
Mar 20 10:14:35 TEST lightdm: pam_kwallet5(lightdm:auth): (null): pam_sm_authenticate
Mar 20 10:14:35 TEST lightdm: pam_kwallet5(lightdm:auth): pam_kwallet5: Couldn't get user info (passwd) info
Mar 20 10:14:35 TEST lightdm: pam_unix(lightdm:account): could not identify user (from getpwnam(test@AD.TEST.EDU))

Here I want to acheive below three things

1) Login to Ubuntu desktop using kerberos user

2) Create home directory for login user

3) Provide sudo privileges for the login user.

Comment me some suggestions.

Thanks