AUTHSELECT-MIGRATIO(7)

📦
version 1.7.1 · 3 versions
, in fedora 43, fedora 44

AUTHSELECT-MIGRATIO(7) 💅

okay bestie, welcome to the authselect-migration glow-up guide ✨ this is the manual page that walks you through moving off authconfig and onto authselect, and honestly? it's giving character development. let's get into it 🫶

🌸 NAME 🌸

authselect-migration — a guide on how to migrate from authconfig to authselect. no cap, that's literally the whole job. 📋

✨ DESCRIPTION ✨

this manual page explains the main differences between authconfig — the previous tool for configuring system authentication and identity sources — and authselect, which replaces it. 💫

it also explains what actions need to be done in order to migrate from authconfig to authselect. consider this your migration roadmap, bestie. 🗺️

🔥 MAIN DIFFERENCES 🔥

Authselect takes a completely different approach to system configuration than the previous tool authconfig. like, completely completely. not a little different. completely. 💀

Authconfig tries its best to keep users's manual changes to the files it generates. it generates not only PAM configuration files and nsswitch.conf (to setup authentication modules and identity sources) but it also generates simple configuration files for several services such as LDAP and Kerberos. so it's out here doing the most, generating everything. 🎀

Authselect does no such things. it does not generate any configuration files beside PAM and nsswitch.conf, and it strictly prohibits any manual changes to generated configuration. yes, really. hands off. 🙅♀️ it provides a set of files called profiles. each profile describes how the resulting configuration should look like and it can be slightly modified by enabling or disabling certain optional features. if a need arises for a different profile than what authselect ships, the administrator has an option to create a whole new profile and use it with authselect. see authselect-profiles(5) to learn more about profiles. 👑

this may seem like a big disadvantage but the truth is the opposite. Authconfig is a very old tool and the applications providing required services have changed rapidly over the years. typically, there is no longer a need to have multiple authentication modules in PAM and nsswitch.conf, because the vast majority of use-cases is covered by SSSD. therefore there is no need to add or remove them specifically. there are also better tools to generate configuration for system daemons that can help you automate the process of joining to a remote domain such as realm. in addition, the shipped profiles give us comprehensive and deterministic system configuration that can be fully tested and is much less error prone. it is also much easier to distribute such configuration across many systems. ✨

probably the most controversial change is that authselect only ships profiles for sssd and winbind providers. those two providers cover all modern use cases from providing local users and legacy LDAP domain to complex configurations with IPA or Active Directory servers. the profiles no longer contain support for nss-pam-ldapd and users are encouraged to switch to sssd. 👀

🌈 JOINING REMOTE DOMAINS 🌈

you can use either ipa-client-install or realm to join an IPA domain and realm to join an Active Directory domain. these tools will make sure that the correct authselect profile is selected and all daemons and services are properly configured. they handle the whole vibe check for you. 🦋

💖 CONVERTING YOUR SCRIPTS 💖

if you use ipa-client-install or realm to join a domain, you can just remove any authconfig call in your scripts. clean. simple. iconic. 🎀

if this is not an option, you need to replace each authconfig call with its equivalent authselect call to select a correct profile with desired features. then you also need to write configuration file for required services. yeah, there's homework. 😭

📊 Table 1. Relation of authconfig options to authselect profiles

  • --enableldap, --enableldapauth → profile sssd
  • --enablesssd, --enablesssdauth → profile sssd
  • --enablekrb5 → profile sssd
  • --enablewinbind, --enablewinbindauth → profile winbind
  • --enablenis → profile none

📊 Table 2. Relation of authconfig options to authselect profile features

  • --enablesmartcard → feature with-smartcard
  • --enablefingerprint → feature with-fingerprint
  • --enableecryptfs → feature with-ecryptfs
  • --enablemkhomedir → feature with-mkhomedir
  • --enablefaillock → feature with-faillock
  • --enablepamaccess → feature with-pamaccess
  • --enablewinbindkrb5 → feature with-krb5
  • --enableshadow → feature none
  • --passalgo → feature none
Note 🙈 Authconfig options --enableshadow and --passalgo=sha512 were often used to make sure that passwords are stored in /etc/shadow using sha512 algorithm. the authselect profiles now use the yescrypt hashing method and it cannot be changed through an option (only by creating a custom profile). you can just omit these options. periodt. 💅

🧚 Examples.

lowkey the most useful part, ngl. look how much cleaner the authselect side is:

authconfig --enableldap --enableldapauth --enablefaillock --updateall
authselect select sssd with-faillock
authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --updateall
authselect select sssd with-smartcard
authconfig --enableecryptfs --enablepamaccess --updateall
authselect select sssd with-ecryptfs with-pamaccess
authconfig --enablewinbind --enablewinbindauth --winbindjoin=Administrator --updateall
realm join -U Administrator --client-software=winbind WINBINDDOMAIN

see? one line. no notes. 🔥

bestie this is only part 1 — there's more coming, so don't go anywhere 💜

🛠️ CONFIGURATION FILES 🛠️

okay bestie, this part is literally just snippets. tiny minimal configs for the various services so you're not out here guessing. copy, paste, tune, slay. 💅

🐘 LDAP

so even if you're not using LDAP directly through pam_ldap and nss_ldap, it's still highkey worth configuring ldap.conf, because that's what configures openldap-libs and, indirectly, stuff like LDAP tools — hi, ldapsearch 👋.

the file is /etc/openldap/ldap.conf.

# Set the default base dn
BASE   dc=example,dc=com

# Set the default LDAP server
URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

🎫 KERBEROS

if you're a Kerberos girlie, you gotta set the default Kerberos realm so that krb5-libs — and therefore tools like kinit — work out of the box. no extra steps, no drama. ✨

the file is /etc/krb5.conf.

[libdefaults]
 default_realm = MYREALM

[realms]
 MYREALM = {
  kdc = kdc.myrealm.org
 }

[domain_realm]
 myrealm.org = MYREALM
 .myrealm.org = MYREALM

🌸 SSSD

Authselect encourages you to use SSSD wherever possible — it's the moment, fr fr. there are so many configuration options, like genuinely, go read sssd.conf(5). but here's a minimal config that creates one LDAP domain called default. the LDAP server is auto-discovered through DNS lookups, which is iconic behavior honestly.

/etc/sssd/sssd.conf.

[sssd]
config_file_version = 2
domains = default

[domain/default]
id_provider = ldap
ldap_uri = _srv_
dns_discovery_domain = myrealm

and here's a snippet for the same domain, except now the authentication is done over Kerberos. the KDC server is also auto-discovered through DNS lookups. 🦋

/etc/sssd/sssd.conf.

[sssd]
config_file_version = 2
domains = default

[domain/default]
id_provider = ldap
auth_provider = krb5
ldap_uri = _srv_
krb5_server = _srv_
krb5_realm = MYREALM
dns_discovery_domain = myrealm

now, if you wanna configure SSSD for an IPA or Active Directory domain? use the realm tool. 👑 it does an initial setup which involves creating a Kerberos keytab and generating basic SSSD configuration. then you can tune it up by modifying /etc/sssd/sssd.conf.

🪟 WINBIND

wanna configure the machine to use Winbind? use realm. that's it, that's the tweet. it performs an initial setup which involves creating a Kerberos keytab and running adcli to join the domain. it also makes changes to smb.conf. after that you can tune it up by modifying /etc/samba/smb.conf. 🎀

🔐 PASSWORD QUALITY

Authselect enables the pam_pwquality module to enforce password quality restrictions. important detail though: this module is only enabled for local users. remote users should use the password policy that's enforced by the respective remote server — that's not your machine's business, periodt.

the pam_pwquality module can be configured in /etc/security/pwquality.conf. go see pam_pwquality(8) for its configuration options and defaults. 📖

🚀 STARTING SERVICES 🚀

depending on your configuration, you need to start the required services manually with systemd. no, they don't just appear. you gotta do the work bestie. 😭

  • SSSD
systemctl enable sssd.service ; systemctl start sssd.service
  • Winbind
systemctl enable winbind.service ; systemctl start winbind.service
  • NIS
systemctl enable rpcbind.service ; systemctl start rpcbind.service
systemctl enable ypbind.service ; systemctl start ypbind.service
  • If mkhomedir feature is enabled
systemctl enable oddjobd.service ; systemctl start oddjobd.service

🧹 AUTHCONFIG TOOLS 🧹

okay so, authconfig shipped a tool called cacertdir_rehash. if you depend on this tool, please switch to the native openssl command: openssl rehash <directory> — it serves the exact same purpose. out with the old, in with the native. 🧚

👀 SEE ALSO 👀

authselect(8), authselect-profiles(5), realm(8), ipa-client-install(1), sssd.conf(5), smb.conf(5), ldap.conf(5), krb5.conf(5)

and that's a wrap on AUTHSELECT-MIGRATIO(7), bestie!! 🫶 this one was dated 2021-06-05, and yeah, the page itself is literally called AUTHSELECT-MIGRATIO(7) in the footer — so when you cite it, that's the name to use. go forth and migrate, you absolute icon. 💖🌈⭐

📦 where this page comes from