sssd-users August 2012

sssd-users@lists.fedorahosted.org

16 participants
14 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

[sssd[pam]] [accept_fd_handler] (0x0020): Accept failed [Too many open files]
by Sigbjorn Lie 25 Sep '12

25 Sep '12

Hi, When I arrived into the office this morning our Nagios server was displaying a lot of alarms. The "sssd_pam" process was consuming 100% CPU, and I was unable to log on to the box as anything else than root. 2310 root 20 0 219m 44m 2176 R 99.6 0.3 2883:27 sssd_pam In the var/log/sssd/sssd_pam.log file, the following error message was repeated: [sssd[pam]] [accept_fd_handler] (0x0020): Accept failed [Too many open files] This being our Nagios server the maximum amount of concurrent open files has been increased from the default 1024 to 4096 for all users. This is RHEL 6.3 with sssd-1.8.0-32. What can I do to prevent this from happening in the future? Regards, Siggi

3 4

sssd ldap bind timeout
by Olaf Gellert 04 Sep '12

04 Sep '12

Hi there, we do see some timeouts when sssd tries to bind to the LDAP server: (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [be_resolve_server_done] (4): Found address for server xxx1.domain.de: [10.11.12.13] TTL 21600 (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [fo_set_port_status] (4): Marking port 636 of server 'xxx1.domain.de' as 'working' (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [set_server_common_status] (4): Marking server 'xxx1.domain.de' as 'working' (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=abcdefg,ou=People,o=ldap,o=root (Mon Aug 27 10:35:59 2012) [sssd[be[LDAP]]] [be_run_offline_cb] (3): Going offline. Running callbacks. (Mon Aug 27 10:35:59 2012) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (1, 9, <NULL>) [Provider is Offline (Authentication service cannot retrieve authentication info)] In this case sssd seems to not ask the second ldap server? We ser the "ldap_search_timeout" option to 120 seconds (default is 6 seconds), but this does change the behaviour. We are running sssd 1.5.1 (as distributed with CentOS 5.X). Looking at all the different ldap timeout values, I guess that "ldap_network_timeout" is not the right thing (because network connect does work), could "ldap_opt_timeout" provide some solution (as I do not really understand what it does)? Cheers, Olaf -- Olaf Gellert email gellert(a)dkrz.de Deutsches Klimarechenzentrum GmbH phone +49 (0)40 460094 214 Bundesstrasse 45a fax +49 (0)40 460094 270 D-20146 Hamburg, Germany www http://www.dkrz.de Sitz der Gesellschaft: Hamburg Geschäftsführer: Prof. Dr. Thomas Ludwig Registergericht: Amtsgericht Hamburg, HRB 39784

2 3

Authentication failure
by Chris Hartman 25 Aug '12

25 Aug '12

Hi all, Arch: i386 OS: Fedora 17 Using the compiled source from the git repo, I'm having trouble getting users to authenticate via PAM with the pam_sss.so module. I can do ID lookups, enumerate user information, and "pam_test_client" returns successful for all cases, but when logging in via SSH or through the TTY, I get authentication failure. As an already-authenticated local user, su commands/password auth work. This problem persists despite pam_sss.so's order in the stack or its control. Examining the logs, I don't see any error messages from pam_sss. When installed from the repos, SSSD performs as expected. I'd like to contribute to the project but thought it'd be a good idea to get a system up and running with the unaltered source, first. Thanks. -Chris

2 2

SSSD presentation
by Ondrej Valousek 16 Aug '12

16 Aug '12

Hi all, I will be doing a short presentation in our company about IPA & sssd & Active Directory. The aim is to motivate headquarters to replace our existing commercial (Centrify) solution with SSSD. The presentation is available at: http://ulozto.cz/xWxcUab/unixad-pdf should you like to see it. Comments are welcome :-) Ondrej

5 11

Secondary groups missing
by Ian Levesque 13 Aug '12

13 Aug '12

Hi, I'm having trouble getting a cluster of Fedora 16 installs (sssd-client-1.8.4-13.fc16.x86_64) to see secondary groups from my Open Directory server (rfc2307). I have a RHEL6 box (sssd-client-1.8.0-32.el6.x86_64) with an identical sssd.conf that does work. Is this a known issue or is there something wonky with my Fedora setup? [fedora]# id ldapuser uid=9000(ldapuser) gid=5079(ps) groups=5079(ps) [rhel63]# id ldapuser uid=9000(ldapuser) gid=5079(ps) groups=5079(ps),1000(cmcd),2004(sch-guest),1031(bc),1027(web) [fedora]# ldapsearch -LLL -x -b cn=groups,dc=ldap,dc=in,dc=hwlab cn=sch-guest | grep ldapuser memberUid: ldapuser my domain config in sssd.conf: [domain/default] ldap_id_use_start_tls = False cache_credentials = True ldap_search_base = dc=ldap,dc=in,dc=hwlab krb5_realm = LDAP.IN.HWLAB krb5_server = ldap.in.hwlab,quasimoto.in.hwlab id_provider = ldap auth_provider = krb5 chpass_provider = krb5 ldap_uri = ldap://ldap.in.hwlab/,ldap://quasimoto.in.hwlab/ krb5_kpasswd = ldap.in.hwlab ldap_tls_cacertdir = /etc/openldap/cacerts Thanks for any insight, Ian

3 4

A security bug in 1.9.0 beta6 (CVE-2012-3462)
by Jakub Hrozek 10 Aug '12

10 Aug '12

================= A security bug in 1.9.0 beta6 =============== = = Subject: HBAC rules ignored if SELinux processing = is enabled = = CVE ID#: CVE-2012-3462 = = Summary: A flaw in the SSSD's access-provider = logic causes the result of the HBAC = rule processing to be ignored in the = event that the access-provider is = also handling the setup of the user's = SELinux user context. = = = = Impact: moderate = = Affects default = configuration: yes (IPA provider only) = = Introduced with: 1.9.0 beta6 = =============================================================== ==== DESCRIPTION ==== The latest development release of the SSSD is vulnerable to a security bug. When the SSSD is configured as an IPA client and the access provider is also handling the evaluation of user's SELinux user context, the result of Host Based Access Control rules is ignored. We decided not to release a full release, for two reasons: * the number of users running the beta is very small. Furthermore, the beta releases are not fully tested and suitable for production anyway * the next release - 1.9.0 RC1 is coming very soon. It is tentatively scheduled for 2012-08-23 ==== WORKAROUND ==== If you don't rely on the evaluation of user's SELinux user context, you can turn off their processing by setting: selinux_provider = none in the sssd.conf config file. That would cause the correct access control code to be returned to the PAM service. ==== PATCH AVAILABILITY ==== The patch is available at: http://git.fedorahosted.org/cgit/sssd.git/commit/?id=ffcf27b0b773b580289d59…

1 0

OpenLDAP + AD with SSSD
by Pieter Baele 09 Aug '12

09 Aug '12

Hi, I can configure sssd to use ldap as an id provider, and AD (krb5) as auth provider, but I guess this poses problems for some web applications, because some of these don't know anything about krb and will look for userPassword instead? Sincerely, PieterB

2 1

ipHosts host mapping
by Pieter Baele 03 Aug '12

03 Aug '12

Just some question: Why is ipHost host mapping not supported in SSSD - and deferred, because this is strange when ipServicePort is supported? Not a 100% necessary feature for our environment, but could be useful for an IP mapping to important administration servers (monitoring, puppet)... (https://fedorahosted.org/sssd/ticket/359) Sincerely, PieterB

7 22

pam_sss - authentication token lock busy?
by Ondrej Valousek 03 Aug '12

03 Aug '12

Hi List, I have a problem with pam_sss: Aug 2 16:59:14 draco sshd[20932]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=deneb.prague.s3group.com user=ondrejv Aug 2 16:59:14 draco sshd[20932]: pam_sss(sshd:auth): received for user ondrejv: 22 (Authentication token lock busy) Note that if I replace pam_sss with pam_krb5, it works like a charm. Anyone knows what the message above means? Thanks, Ondrej

3 9

Passing the torch
by Stephen Gallagher 02 Aug '12

02 Aug '12

It is with a heavy heart that I write this email. I've spent a large part of my engineering career working on the System Security Services Daemon - longer, in fact, than I've worked on any other single project. Furthermore, I've been here since the very beginning, having written some of the first lines of code committed to the git repository. I've been heavily-involved with the project ever since, designing and implementing the SBUS interface and service monitor code, then later taking on the role of the public face of the project. I pushed for its inclusion into Fedora as the default mechanism for managing centralized user data. I drove it through several Fedora Test Days. I went to conferences and lectured on the advantages that SSSD provides. I have invested a lot of my professional life into this project, and I'd like to believe that it shows. SSSD today is a successful, growing project that is included in many popular Linux distributions including Red Hat Enterprise Linux, Fedora, Debian, Ubuntu and Gentoo. I could not have done this on my own, however. The SSSD development team is comprised of many of the finest engineers that I've ever had the privilege to work with. One such engineer is the magnificent Jakub Hrozek, who has been for the last two years SSSD's most prolific developer and my right-hand man. So, as I prepare to make my way into other places and other projects, I cannot think of anyone better to take my place as SSSD project lead than Jakub. His Herculean efforts at driving SSSD 1.9.0 into today's feature-complete state have proven to me without a doubt that he is the right person for the job. I'd like to invite our community to welcome Jakub Hrozek as the new SSSD project lead, and to help him as he finds his feet in this new responsibility. Congratulations, and good luck!

3 2

SSSD - too many communication failures, giving up
by Ondrej Valousek 02 Aug '12

02 Aug '12

Hi, I have just tried to use a configuration I am currently using in Prague (small site, one AD DC) in Dublin as well (large site, many DCs). I am using DNS SRV lookups for everything (service auto discovery), but in Dublin it is failing for some reason, giving the error below: (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'dcduba.dublin.ad.s3group.com' as 'working' (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [set_server_common_status] (0x0100): Marking server 'dcduba.dublin.ad.s3group.com' as 'working' (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_id_op_connect_done] (0x2000): Old USN: 76274476, New USN: 31508106 (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_id_op_connect_done] (0x4000): notify connected to op #1 (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_users_next_base] (0x0400): Searching for users with base [dc=dublin,dc=ad,dc=s3group,dc=com] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=ondrjev)(objectclass=user))][dc=dublin,dc=ad,dc=s3group,dc=com]. (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsUniqueId] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 5 (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_id_op_connect_done] (0x4000): caching successful connection after 1 notifies (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x1e9eca0], connected[1], ops[0x1ea0df0], ldap[0x1eadc50] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://DomainDnsZones.dublin.ad.s3group.com/DC=DomainDnsZones,DC=dublin,DC=…] with fd [35]. (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_rebind_proc] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_rebind_proc] (0x1000): Failed to bind to [ldap://DomainDnsZones.dublin.ad.s3group.com/DC=DomainDnsZones,DC=dublin,DC=…] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_ldap_connect_callback_del] (0x4000): Closing LDAP connection with fd [35]. (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x1e9eca0], connected[1], ops[0x1ea0df0], ldap[0x1eadc50] (Thu Aug 2 14:19:35 2012) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [110]: Connection timed out (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [sdap_id_op_done] (0x4000): too many communication failures, giving up... (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [sdap_id_op_done] (0x4000): releasing operation connection (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [sdap_id_release_conn_data] (0x4000): releasing unused connection (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [sdap_handle_release] (0x2000): Trace: sh[0x1e9eca0], connected[1], ops[(nil)], ldap[0x1eadc50], destructor_lock[0], release_memory[0] (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. (Thu Aug 2 14:19:42 2012) [sssd[be[default]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,110,User lookup failed Does anyone know what could be wrong? I have a faint feeling Jakub managed to resolve this one it the past for me, but I can not find the mail, any longer. Note that DomainDnsZones.dublin.ad.s3group.com returns many servers, some of them might be no longer accessible, but there is certainly at least one of them which is working fine. Many thanks. Ondrej

4 6

Caches and timeouts
by Pieter Baele 02 Aug '12

02 Aug '12

Hi, How can I set the refresh interval for netgroup membership in sssd? I've tried using entry_cache_netgroup_timeout entry_cache_timeout and ldap_enumeration_refresh_timeout ? enum_cache_timeout ? For now, I deleted the caches... Sincerely, PieterB

3 2

sssd_sudo - no such file or directory
by Pieter Baele 01 Aug '12

01 Aug '12

Hi, With sssd 1.8.0 32.el6, sudo with sssd is failing Isn't this supported from 1.8 onwards? (Tue Jul 31 15:54:51 2012) [sssd] [service_startup_handler] (0x0010): Could not exec /usr/libexec/sssd/sssd_sudo --debug-to-files, reason: No such file or directory (Tue Jul 31 15:54:51 2012) [sssd] [service_startup_handler] (0x0010): Could not exec /usr/libexec/sssd/sssd_sudo --debug-to-files, reason: No such file or directory (Tue Jul 31 15:54:51 2012) [sssd] [service_startup_handler] (0x0010): Could not exec /usr/libexec/sssd/sssd_sudo --debug-to-files, reason: No such file or directory (Tue Jul 31 15:54:51 2012) [sssd] [mt_svc_exit_handler] (0x0010): Process [sudo], definitely stopped! Sincerely, PieterB

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2012