sssd-users March 2013

sssd-users@lists.fedorahosted.org

15 participants
13 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

RFC: dropping upstream support of RHEL5 starting with 1.10
by Jakub Hrozek 01 May '13

01 May '13

Hi, many new features rely on library APIs and features that are only available in recent versions of SSSD dependencies. As a result, the code often needs #ifdefs and special branches in order to at least compile or run on RHEL5. So far we've been doing nightly builds also for RHEL5 and fixing issues as we were finding them. But recently we are considering dropping support for RHEL5 -- it is causing some engineering effort and at the same time the audience is probably very limited. If you are running super-stable enterprise distribution, chances are you are not all that interested in the latest and possibly very unstable SSSD version. The proposal would be to keep building and supporting the 1.9.x branch for RHEL5 and switch to using RHEL6 as the oldest supported release starting from the 1.10 upstream version. Of course we would still accept patches from any potential contributors. Any objections against the plan?

3 5

SSSD, Linux Mint 14 and Samba 4 AD Server
by Rowland Penny 11 Apr '13

11 Apr '13

Hello, I am trying to use sssd instead of winbind against a samba 4 AD server. After looking around the internet, I have got to the point where I can get a domain users info with 'getent passwd <domainuser>' and 'id <domainuser>'. I can also create a directory and chmod it <domainuser>:users, what I cannot do is login into the computer through ssh or the login GUI on the computer. This is on Linux Mint 14 using sssd 1.9.1. Does anybody have any idea why sssd seems to work but fails in a very important way. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

5 29

sss_ssh_authorizedkeys returns "Error looking up public keys"
by Mathieu Lemoine 11 Apr '13

11 Apr '13

Hello, I have sssd 1.9.4 (from https://launchpad.net/~nicholas-hatch/+archive/auth/+packages) configured on an OpenLDAP server. getent passwd, getent group, authentication and cache is working great. My issue now lies with the SSH public key. My user has the ldapPublicKey objectClass, and the key is in the sshPublicKey attribute. sss_ssh_authorizedkeys is still returning "Error looking up public keys". An inquiry on the #sssd chan directed me to this mailing-list and more precisely to jcholast, I tried to check out the commits, but nothing seems to get out of it... If any of you had informations regarding that, it'd be greatly appreciated., Mathieu.

8 22

Re: [SSSD-users] RHEL5-builds of sssd 1.9.4
by Michael Ströder 28 Mar '13

28 Mar '13

On Thu, 28 Mar 2013 10:16:27 -0400 Stephen Gallagher <sgallagh(a)redhat.com> wrote > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Thu 28 Mar 2013 10:15:10 AM EDT, Michael Ströder wrote: > > On Thu, 28 Mar 2013 10:05:35 -0400 Stephen Gallagher > > <sgallagh(a)redhat.com> wrote > >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > >> > >> On Thu 28 Mar 2013 10:01:43 AM EDT, Michael Ströder wrote: > >>> Ok, now I'm stuck with this output of OpenLDAP lib checks when > >>> running 1.9.4's configure: > >>> > >>> checking for LDAPDerefRes... no configure: error: The OpenLDAP > >>> version found does not contain the required type LDAPDerefRes > >>> > >>> I guess this is because the OpenLDAP 2.3.43 libs that come > >>> with RHEL5 does not contain support for the experimental deref > >>> LDAP control. > >>> > >>> Since I don't need it my question is: Any chance to disable > >>> this when running configure? > >> > >> RHEL 5.6 and later have an openldap24-libs-devel package that you > >> can build against. > > > > This does not seam to be in the standard 5.6 repo. In which repo > > can I find that? > > > > Sorry, I was incorrect. It's in 5.7, not 5.6. Ok, I've grabbed openldap24-libs-devel from more recent RHEL 5.8, applying the above mentioned patch and after installing myriads of other -devel packages the build fails: libtool: link: gcc -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasing -std=gnu99 -g -O2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -o sss_ssh_authorizedkeys src/sss_client/sss_ssh_authorizedkeys-common.o src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_client.o src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_authorizedkeys.o /.libs/libsss_util.a -ltevent -ltalloc -lpopt -lldb -L/lib64 -ldbus-1 -lpcre -lini_config -lcollection -ldhash -L/usr/lib64/openldap24 -llber -lldap -ltdb -lglib-2.0 -lssl3 -lsmime3 -lnss3 -lnssutil3 -lplds4 -lplc4 -lnspr4 -lpthread -ldl /usr/bin/ld: warning: libpath_utils.so.1, needed by /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so, not found (try using -rpath or -rpath-link) /usr/bin/ld: warning: libref_array.so.1, needed by /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so, not found (try using -rpath or -rpath-link) /usr/bin/ld: warning: libbasicobjects.so.0, needed by /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so, not found (try using -rpath or -rpath-link) /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_alloc' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_replace' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_get_buf' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_reset' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_get_len' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_append' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_free' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_create' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_copy' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_add_cr' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_len' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_remove' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_getlen' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `make_normalized_absolute_path' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_destroy' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_insert' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_add_str' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_get' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `ref_array_swap' /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../lib64/libini_config.so: undefined reference to `simplebuffer_add_raw' collect2: ld returned 1 exit status make[2]: *** [sss_ssh_authorizedkeys] Error 1 make[2]: Leaving directory `/home/mstroeder/sssd-1.9.4' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/mstroeder/sssd-1.9.4' make: *** [all] Error 2 Ciao, Michael.

1 1

RHEL5-builds of sssd 1.9.4
by Michael Ströder 28 Mar '13

28 Mar '13

HI! Are there any ready-to-use RPMs of sssd 1.9.4 for RHEL5 or CentOS5? Ciao, Michael.

3 10

SSSD-AD mkhomedir not working
by Sutton, Harry (GSSE) 27 Mar '13

27 Mar '13

Okay, on my Fedora 18 laptop, I can login to my system as an Active Directory user (sssd-ad), both via ssh from a remote system and locally through one of the console (Ctrl-Alt-F2) screens. (I haven't succeeded in getting the GDM login process to work yet.) But in both login cases, I end up in / as my current directory; the home directory does not get created. The oddjobd daemon is running, and I have an entry for pam_oddjob_mkhomedir in /etc/pam.d/system-auth, (and it shows as 'enabled' in the output of authconfig --test) but the directory isn't created on login. I apologize if this question has been asked and answered before, but I'm under some time pressure to complete a training seminar here at HP for making RHEL / AD Integration work and I don't have the time to sift through the list archives. I can provide configuration files and debug log output on request, but I've gone through most of it and haven't found an obvious cause for this problem. Any suggestions would be greatly appreciated. Regards, /Harry Sutton, HP

4 6

AuthorizedKeysCommand functionality part of upstream OpenSSH 6.2
by Jan Cholasta 27 Mar '13

27 Mar '13

Hi, this is just a heads up that the AuthorizedKeysCommand functionality, which is necessary for the user keys part of OpenSSH integration in SSSD and was previously available in OpenSSH packages only in few Linux distros (Fedora, RHEL, Madriva), is now part of upstream OpenSSH as of version 6.2 (see <http://www.openssh.com/txt/release-6.2>). Once this version is adopted by other Linux distros (and other OSes), SSSD OpenSSH integration will fully work in them as well. Honza -- Jan Cholasta

1 0

squeeze backport
by Angel Bosch 21 Mar '13

21 Mar '13

hi, Is there any sssd package greater than 1.2 for debian squeeze ? I need to mantain squeeze in some servers and I would like to install 1.8 on them. àngel --

2 2

A security bug in SSSD 1.9 (CVE-2013-0287)
by Jakub Hrozek 19 Mar '13

19 Mar '13

======================= A security bug in SSSD 1.9 =========================== = = Subject: A simple access provider flaw prevents intended ACL use = when SSSD is configured as an Active Directory client = = CVE ID#: CVE-2013-0287 = = Summary: When SSSD is configured as an Active Directory client by = using the new Active Directory provider or equivalent = configuration of the LDAP provider, the Simple Access = Provider does not handle access control correctly. = If any groups are specified with the simple_deny_groups = option, the group members are permitted access. = = Impact: medium = = Acknowledgements: The bug was found by Kaushik Banerjee of Red Hat = Quality Engineering team = = Affects default = configuration: no = = Introduced with: 1.9.0 = =============================================================== ==== DESCRIPTION ==== SSSD versions 1.9.0 and later are vulnerable to a security bug. If the SSSD is configured to use the Active Directory provider (or equivalent configuration of the LDAP provider) along with the Simple Access Provider which in turn uses the simple_deny_groups option, then even groups listed in that configuration option would be allowed access. The reason is that the AD provider obtains a list of groups the user is a member of in form of SIDs which are algorithmically transformed into GIDs during the initgroups operation. Thus, contrary to the LDAP provider, the group names might not be known during the account phase of the PAM conversation. As a result, groups listed in the simple_deny_groups option may be allowed access and groups in the simple_allow_groups may be denied access. The vulnerable LDAP provider configuration would include the "ldap_schema=ad" option, use the SID-to-ID mapping (ldap_id_mapping=True), would be connected to an Active Directory server and use the simple_deny_groups as mentioned above. The fix will be delivered as part of the upcoming 1.9.5 release. The bug is being tracked in the following Red Hat Bugzilla report: https://bugzilla.redhat.com/show_bug.cgi?id=910938 ==== PATCH AVAILABILITY ==== The patches for the master branch are available at: http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78… http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d703… http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d37… http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee… The patches for the sssd-1-9 branch are available at: http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e2… http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0… http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6… http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2013