[Bug 1962611] New: sssd-kcm crashes, disabling password authentication
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1962611
Bug ID: 1962611
Summary: sssd-kcm crashes, disabling password authentication
Product: Fedora
Version: 33
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: boroske(a)ida.ing.tu-bs.de
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
luk.claes(a)gmail.com, mzidek(a)redhat.com,
pbrezina(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Hello,
we are running an application server on fedora 33.
We use FreeIPA for authentication, which builds on kerberos.
After the update to sssd packages this morning (20. May 2021) login or su using
password authentication no longer works.
I tracked down the problem to a crash in sssd-kcm I think:
A simple "klist" as a logged in user (using pubkey auth) gets you this:
[thomasb@localhost ~]$ klist
klist: Internal credentials cache error while resolving ccache
In the logs:
[root@localhost log]# tail -f sssd/sssd_kcm.log
...
(2021-05-20 12:26:27): [kcm] [local_decrypt] (0x0040): sss_decrypt failed [14]:
Bad address
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
* (2021-05-20 12:23:55): [kcm] [kcm_failbuf_construct] (0x1000): Sent reply
with error -1765328188
* (2021-05-20 12:23:55): [kcm] [queue_removal_cb] (0x0200): Removed queue
for 1449
* (2021-05-20 12:23:55): [kcm] [kcm_send] (0x2000): All data sent!
* (2021-05-20 12:23:55): [kcm] [kcm_recv] (0x4000): Client closed
connection.
* (2021-05-20 12:23:55): [kcm] [client_close_fn] (0x2000): Terminated
client [0x55cd82ddcd90][14]
* (2021-05-20 12:26:09): [kcm] [responder_idle_handler] (0x2000):
Re-scheduling the idle timeout [responder_idle_timeout] for the responder
[0x55cd819c8ae0]
* (2021-05-20 12:26:09): [kcm] [schedule_responder_idle_timer] (0x2000):
Re-scheduling the idle timeout [responder_idle_timeout] for the responder
[0x55cd819c8ae0]
* (2021-05-20 12:26:27): [kcm] [get_client_cred] (0x4000): Client
[0x55cd82dd3040][14] creds: euid[1449] egid[100] pid[29259] cmd_line['klist'].
* (2021-05-20 12:26:27): [kcm] [setup_client_idle_timer] (0x4000): Idle
timer re-set for client [0x55cd82dd3040][14]
* (2021-05-20 12:26:27): [kcm] [accept_fd_handler] (0x0400): Client
[0x55cd82dd3040][14] connected!
* (2021-05-20 12:26:27): [kcm] [kcm_input_parse] (0x1000): Received message
with length 4
* (2021-05-20 12:26:27): [kcm] [kcm_get_opt] (0x2000): The client requested
operation 20
* (2021-05-20 12:26:27): [kcm] [kcm_cmd_send] (0x0400): KCM operation
GET_DEFAULT_CACHE
* (2021-05-20 12:26:27): [kcm] [kcm_cmd_send] (0x1000): 0 bytes on KCM
input
* (2021-05-20 12:26:27): [kcm] [kcm_op_queue_send] (0x0200): Adding request
by 1449 to the wait queue
* (2021-05-20 12:26:27): [kcm] [kcm_op_queue_get] (0x1000): No existing
queue for this ID
* (2021-05-20 12:26:27): [kcm] [kcm_op_queue_send] (0x1000): Queue was
empty, running the request immediately
* (2021-05-20 12:26:27): [kcm] [kcm_op_get_default_ccache_send] (0x1000):
Getting client's default ccache
* (2021-05-20 12:26:27): [kcm] [ccdb_secdb_get_default_send] (0x2000):
Getting the default ccache
* (2021-05-20 12:26:27): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix
/kcm/
* (2021-05-20 12:26:27): [kcm] [kcm_map_url_to_path] (0x1000):
User-specific KCM path is [/kcm/persistent/1449/default]
* (2021-05-20 12:26:27): [kcm] [local_db_dn] (0x2000): Local path for
[persistent/1449/default] is [cn=default,cn=1449,cn=persistent,cn=kcm]
* (2021-05-20 12:26:27): [kcm] [sss_sec_new_req] (0x1000): Local DB path is
persistent/1449/default
* (2021-05-20 12:26:27): [kcm] [secdb_dfl_url_req] (0x2000): Created
request for URL /kcm/persistent/1449/default
* (2021-05-20 12:26:27): [kcm] [sss_sec_get] (0x0400): Retrieving a secret
from [persistent/1449/default]
* (2021-05-20 12:26:27): [kcm] [sss_sec_get] (0x2000): Searching for
[(|(type=simple)(type=binary))] at [cn=default,cn=1449,cn=persistent,cn=kcm]
with scope=base
* (2021-05-20 12:26:27): [kcm] [local_decrypt] (0x2000): Decrypting with
masterkey
* (2021-05-20 12:26:27): [kcm] [local_decrypt] (0x0040): sss_decrypt failed
[14]: Bad address
********************** BACKTRACE DUMP ENDS HERE
*********************************
(2021-05-20 12:26:27): [kcm] [sec_get] (0x0040): Cannot retrieve the secret
[14]: Bad address
(2021-05-20 12:26:27): [kcm] [kcm_ccdb_get_default_done] (0x0040): Failed to
get the default ccache [14]: Bad address
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
* (2021-05-20 12:26:27): [kcm] [sec_get] (0x0040): Cannot retrieve the
secret [14]: Bad address
* (2021-05-20 12:26:27): [kcm] [kcm_ccdb_get_default_done] (0x0040): Failed
to get the default ccache [14]: Bad address
********************** BACKTRACE DUMP ENDS HERE
*********************************
(2021-05-20 12:26:27): [kcm] [kcm_op_get_get_default_done] (0x0040): Cannot get
default ccache [14]: Bad address
(2021-05-20 12:26:27): [kcm] [kcm_cmd_done] (0x0040): op receive function
failed [14]: Bad address
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
* (2021-05-20 12:26:27): [kcm] [kcm_op_get_get_default_done] (0x0040):
Cannot get default ccache [14]: Bad address
* (2021-05-20 12:26:27): [kcm] [kcm_cmd_done] (0x0040): op receive function
failed [14]: Bad address
********************** BACKTRACE DUMP ENDS HERE
*********************************
(2021-05-20 12:26:27): [kcm] [kcm_cmd_request_done] (0x0040): KCM operation
failed [14]: Bad address
(2021-05-20 12:26:27): [kcm] [kcm_reply_error] (0x0040): KCM operation returns
failure [14]: Bad address
********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING
BACKTRACE:
* (2021-05-20 12:26:27): [kcm] [kcm_cmd_request_done] (0x0040): KCM
operation failed [14]: Bad address
* (2021-05-20 12:26:27): [kcm] [kcm_reply_error] (0x0040): KCM operation
returns failure [14]: Bad address
********************** BACKTRACE DUMP ENDS HERE
*********************************
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
2 years, 11 months
[Bug 1962126] New: Can't login in sssd 2.5.0. krb5_child[2309]: Internal credentials cache error
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1962126
Bug ID: 1962126
Summary: Can't login in sssd 2.5.0. krb5_child[2309]: Internal
credentials cache error
Product: Fedora
Version: 33
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Severity: urgent
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: dexter(a)beetjevreemd.nl
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
luk.claes(a)gmail.com, mzidek(a)redhat.com,
pbrezina(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
Just did yum upgrade, sssd was updated to 2.5.0, after a reboot I was unable to
login. Only thing logged was:
krb5_child[2309]: Internal credentials cache error
I un-enrolled and then re-enrolled to the IPA server, to no avail.
I downgraded to 2.3.1, reboot and worked again.
I indied use kerberos/ldap to login to a freeipa server
Version-Release number of selected component (if applicable):
sssd 2.5.0-1
How reproducible:
All one of one tries.
Steps to Reproduce:
1. enroll in an IPA environment
2. upgrade sssd from 2.4.2 to 2.5.0
3. reboot
4. can't login.
Actual results:
Expected results:
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
2 years, 11 months