sssd pam authentication works with su, but not ssh
by rpoyner＠wisc.edu
I'm using sssd 1.11.7 in a jail on freebsd 10.2. and seeing an odd failure.
sssd is configured for nss, and pam both against an openldap server. Nss seems to work as evidenced by various getent calls.
When I ssh to the jail as an ldap user the authentication fails with return code 9:
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: default
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sshd
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: not set
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: host.edu
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 65873
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [9][default]
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [9].
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 24
(Thu Aug 25 10:55:52 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected!
When I login to the jail as an un-privleged user and su to the ldap user authentication succeeds:
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not set
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myser
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: /dev/pts/1
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: anotheruser
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 67944
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [myuser@default]
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: default
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: /dev/pts/1
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: anotheruser
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 67944
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][default]
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 24
(Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_cmd_setcred] (0x0100): entering pam_cmd_setcred
Even weirder is the fact that having once used su to authenticate the ldap user, subsequent attempts to ssh as the ldap user succeed!
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3].
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3].
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not set
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sshd
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: not set
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: host.edu
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 78882
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [myuser@default]
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data:
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: default
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sshd
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: not set
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: host.edu
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 78882
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][default]
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0].
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 24
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected!
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3].
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3].
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_cmd_setcred] (0x0100): entering pam_cmd_setcred
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser
(Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)]
Suggestions for next steps are welcome.
Thanks
7 years, 8 months
autofs question
by Thomas Beaudry
Hi Everyone,
I am trying to do the following and haven't been able to find a resource on it so I wanted to know if it's even possible.
Here is what I want to be able to do.
1. ssh to server (I have and AD credentials check working with sssd already)
2. automount a directory from a NAS on ssh login with sssd. What I would like to be able to use is an auto.master file and an auto.data file to do this and have the credentials provided via sssd. I was able to get this to work without sssd (i.e just autofs and a credential file already), But the server is going to be accessed by many users, so a credentials file isn't the way to go about it.
Thanks,
Thomas
7 years, 8 months
Feature request: Partial id_mapping
by Joakim Tjernlund
Getting to the of our AD domain migration but there is one step I haven't solved.
Our users has UID/GID in the new domain while the already present users in the new domain
does not. Assigning UID/GID to all users does not sit well with upstream IT so I am
looking at what to do with these when they visit/access our site.
What comes to mind is partial id_mapping, if a user had UID/GID in the AD use that, otherwise
do id_mapping for that user(preferably the same way samba does it since we already have a samba
based interim solution).
I haven't found a way to do that in sssd, is there?
Maybe I am just full of it and this is really a bad idea?
7 years, 8 months
DDNS update against Windows AD when switching to WiFi ?
by Joakim Tjernlund
Currently we have different IP addresses when using wired(Ethernet) and WiFi.
I would like sssd to refresh its DDNS record whenever I switch between wired and WiFi, is this possible?
So far I have only managed to refresh DDNS by restarting sssd but maybe there is a better way?
Jocke
7 years, 8 months
sssd seems seems not to respect default_realm = xxx ?
by Joakim Tjernlund
I changed the default REALM in krb5.conf but that did not have any effect on logins.
I had to change the order of domains = in sssd.conf for logins to switch over to the
new default domain. Should not sssd respect default_realm = xx in krb5.conf?
Using sssd 1.13.4
Jocke
7 years, 8 months
adcli --service-name strangeness
by Joakim Tjernlund
If I add --service-name="nfs" when joining a domain I do not get any
host/* or RestrictedKrbHost/* entries in my keytab. Is this intentional?
Jocke
7 years, 8 months
DDNS not working due to non FQDN hostname
by Joakim Tjernlund
Discovered why DDNS was not working in this ticket:
https://fedorahosted.org/sssd/ticket/2565
May I suggest that if gethostname() returns a non . name, sssd should automatically
add the configured SSSD domain name in sssd.conf ( [domain/domain.name] )
Jocke
7 years, 8 months
Announcing SSSD 1.14.1
by Jakub Hrozek
=== SSSD 1.14.1 ===
The SSSD team is proud to announce the release of version 1.14.1 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* The IPA provider now supports logins with enterprise principals (also
known as additional UPN suffixes). This functionality also enabled Active
Directory users from trusted AD domains who use an additional UPN suffix
to log in. Please note that this feature requires a recent IPA server.
* When a user name is overriden in an IPA domain, resolving a group these
users are a member of now returns the overriden user names
* Users can be looked up by and log in with their e-mail address as an
identifier. In order to do so, an attribute that represents the user's
e-mail address is fetched by default. This attribute can by customized
by setting the ldap_user_email configuration option.
* A new ad_enabled_domains option was added. This option lets the
administrator select domains that SSSD should attempt to reach in the
AD forest SSSD is joined to. This option is useful for deployments where
not all domains are reachable on the network level, yet the administrator
needs to access some trusted domains and therefore disabling the subdomains
provider completely is not desirable.
* The sssctl tool has two new commands active-server and servers that
allow the administrator to observe the server that SSSD is bound to and
the servers that SSSD autodiscovered
* SSSD used to fail to start when an attribute name is present in both
the default SSSD attribute map and the custom ldap_user_extra_attrs map
* GPO policy procesing no longer fails if the gPCMachineExtensionNames
attribute only contains whitespaces
* Several commits fix regressions related to switching all user and group
names to fully qualified format, such as running initgroups for a user
who is only a member of a primary group
* Several patches fix regressions caused by splitting the database into
two ldb files, such as when user attributes change without increasing
the modifyTimestamp attribute value
* systemd unit files are now shipped for the sssd-secrets responder,
allowing the responder to be socket-activated. To do so, administrators
should enable the sssd-secrets.socket and sssd-secrets.service systemd
units.
* The sssd binary has a new switch --disable-netlink that lets sssd skip
messages from the kernel's netlink interface.
* A crash when entries with special characters such as '(' were requested
was fixed
* The ldap_rfc_2307_fallback_to_local_users option was broken in the
previous version. This release fixes the functionality.
== Packaging Changes ==
* The NFS ID-mapping plugin was moved to its own subpackage
== Documentation Changes ==
* A new option ad_enabled_domains was added
* A new LDAP attribute mapping for e-mail addresses called ldap_user_email
was added
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/2789
Warn if ad_server contains IP address
https://fedorahosted.org/sssd/ticket/2828
Add an option to disable checking for trusted domains in the subdomains provider
https://fedorahosted.org/sssd/ticket/2856
[RFE] Allow users to authenticate with alternative names
https://fedorahosted.org/sssd/ticket/2860
Add support for disabling netlink use
https://fedorahosted.org/sssd/ticket/2948
Handle overriden name of members in the memberUid attribute
https://fedorahosted.org/sssd/ticket/2958
Support multiple principals for IPA users
https://fedorahosted.org/sssd/ticket/2978
pid file name decalration is duplicated
https://fedorahosted.org/sssd/ticket/2987
Improve information about krb5_keytab & ldap_krb5_keytab option in sssd man pages
https://fedorahosted.org/sssd/ticket/3009
sssd fails to mark a connection as bad on searches that time out
https://fedorahosted.org/sssd/ticket/3018
Detect of IPA server can handle enterprise principals
https://fedorahosted.org/sssd/ticket/3024
sssd-common brings in nfs-utils
https://fedorahosted.org/sssd/ticket/3064
incorrect dataExpireTimestamp setting in the timestamps cache
https://fedorahosted.org/sssd/ticket/3068
fixes to the initial config schema implementation
https://fedorahosted.org/sssd/ticket/3069
The sssctl tool should provide information about active and available servers
https://fedorahosted.org/sssd/ticket/3072
task: Add a 1.14 upstream repo
https://fedorahosted.org/sssd/ticket/3077
sssd does not work under non-root user
https://fedorahosted.org/sssd/ticket/3084
DP: Don't pass empty string, but NULL to providers
https://fedorahosted.org/sssd/ticket/3086
tools: sssctl config-check and sssctl cache ignore --help
https://fedorahosted.org/sssd/ticket/3087
tools: make sssctl command names consistent
https://fedorahosted.org/sssd/ticket/3088
Review and update SSSD's wiki pages for 1.14.1 release
https://fedorahosted.org/sssd/ticket/3089
Error message "Failed to retrieve users" is sometimes misleading
https://fedorahosted.org/sssd/ticket/3090
Don't print message about trust direction on clients
https://fedorahosted.org/sssd/ticket/3091
remove DEBUG(SSSDBG_TRACE_INTERNAL, "Trace: ldap_result found nothing!\n");
https://fedorahosted.org/sssd/ticket/3093
Missing nested groups in user groups
https://fedorahosted.org/sssd/ticket/3094
SELINUX_getpeercon failed [-1][Unknown error -1].
https://fedorahosted.org/sssd/ticket/3096
sssctl: Time stamps without time zone information
https://fedorahosted.org/sssd/ticket/3101
sssd does not start if sub-domain user is used with simple access provider
https://fedorahosted.org/sssd/ticket/3109
Wrong pam error code returned for password change in offline mode
https://fedorahosted.org/sssd/ticket/3110
Access denied after activating user in 389ds
https://fedorahosted.org/sssd/ticket/3111
sssd doesn't start on IPA client if IPA server VM is paused
https://fedorahosted.org/sssd/ticket/3120
SSSD fails to start when ldap_user_extra_attrs contains mail
https://fedorahosted.org/sssd/ticket/3121
[abrt] [faf] sssd: unknown function(): /usr/libexec/sssd/sssd_nss killed by 11
https://fedorahosted.org/sssd/ticket/3122
Do not check local users with disabled local_negative_timeout
https://fedorahosted.org/sssd/ticket/3130
Better error message if sssctl is ran w/o activating the IFP responder
https://fedorahosted.org/sssd/ticket/3132
check return value of sysdb_search_user_by_upn()
== Detailed Changelog ==
Dan Lavu (1):
* MAN: Update description of sssctl
Fabiano Fidêncio (5):
* sssctl: Use localtime for time stamps
* RESPONDERS: Decrease debug level for failures in SELINUX_getpeercon()
* RESPONDERS: Show a bit more info in case of SELINUX_getpeercon() failure
* RESPONDERS: Pass errno to strerror() when SELINUX_getpeercon() fails
* SDAP: Don't log an op failure when no users are found
Jakub Hrozek (18):
* Updating the version for the 1.14.1 release
* FO: Set port to NOT_WORKING when trying a next server
* LDAP: Fix storing initgroups for users with no supplementary groups
* LDAP: Use FQDN when linking parent LDAP groups
* SYSDB: Fix setting dataExpireTimestamp if sysdb is supposed to set the current time
* PAM: Do not act on ldb_message in case of a failure
* IPA: Check the return value of sss_parse_internal_fqname
* SIMPLE: Do not parse names on startup
* SIMPLE: Fail on any error parsing the access control list
* SIMPLE: Make the DP handlers testable
* TESTS: Use the DP handlers in simple provider tests, add more tests
* CONFIG: full_name_format is an allowed option for all domains
* CONFIG: re_expression is an allowed option for all domains
* SPEC: Own the secrets DB path
* UTIL: Use sss_atomic_read_s in generate_csprng_buffer
* SECRETS: Use sss_atomic_read/write for better readability
* BUILD: Ship systemd service file for sssd-secrets
* Updating the translations for the 1.14.1 release
Justin Stephenson (4):
* Make resolv_is_address() function public and create some basic tests
* Warn if IP address is used as option for ipa_server/ad_server
* Monitor: Add support for disabling netlink
* SSSCTL: More helpful error message when InfoPipe? is disabled
Lukas Slebodnik (37):
* sssctl: Fix error handling after memory allocation failure
* sssctl: Fix format string for size_t
* doxygen: Fix path to header file ipa_hbac.h
* ipa_hbac: Fix documentation for hbac_enable_debug
* sssctl: Fix warning maybe-uninitialized
* nss-srv-tests: Fix prototype of wrapped ncache functions
* TOOLS: Prevent dereference of null pointer
* sysdb-tests: Fix cast from pointer to integer
* SPEC: Move nfsidmap plugin to separate package
* test_utils: Clean files after sss_write_krb5_conf_snippet
* CI: Use /bin/sh as a CONFIG SHELL
* SECRETS: Log message for failures with removing file
* Amend debug messages after failure of unlink
* SYSDB: Do not try to modify ts cache for unsupported DNs
* SDAP: sanitize member name before using in filter
* SDAP: sysdb_search_users does not set users_count for failures
* SYSDB: Sanitize dn in sysdb_get_user_members_recursively
* LDAP: Fix Dereference after NULL check
* NSS: Do not check local users with disabled local_negative_timeout
* config_schema: Add ldap_user_email to schema
* intg: Make location of sssd nss module configurable
* intg: Allow to test netgroups
* NSS: Use correct name for invalidating memory cache
* SYSDB: Avoid optimisation with modifyTimestamp for users
* dyndns-tests: Fix false positive failures
* LDAP: Log autofs rfc2307 config changes only with enabled responder
* DP: Add log message for get account info
* ds.py: Do not call teardown in destructor
* test_local_domain: Restore correct env variable
* intg: rename test with enumeration
* test_enumeration: Remove test without enumeration
* intg: create ldap test without enumeration
* sssd_id.py: Primary group should be returned for initgroups
* intg: Fix pep8 warnings
* test_ldap: test nested membership with rfc2307bis
* test_ldap: test resolving of names with special characters
* intg: Test extra attributes duplicate
Michal Židek (13):
* sssctl: config-check access check report
* config: override_space is monitor's option
* config: Fix user_attributes
* config: Allow timeout for all sevices
* config: Add config_file_version to schema
* dyndns: Add checks for NULL
* sdap: Fix ldap_rfc_2307_fallback_to_local_users
* sss_ini: Change debug level of config error msgs
* sssctl: Consistent commands naming
* tools: Add missing gettext macro
* sssctl: Generic help for cache-upgrade and config-check
* gpo: gPCMachineExtensionNames with just whitespaces
* sdap: Skip exact duplicates when extending maps
Pavel Březina (17):
* sssctl: move filter creation to separate function
* sssctl: improve readability of a condition
* DP: rename be_acct_req to dp_id_data
* DP: Initialize D-Bus as soon as possible
* utils: add remove_subtree
* sssctl: use internal API to remove files
* rdp: add ability to forward reply to the client request
* sbus: add sbus_request_reply_error()
* sbus: add utility function to simplify message and reply handling
* sssctl: use talloc with sifp
* failover: mark subdomain service with sd_ prefix
* sssctl: print active server and server list
* sifp: fix coverity warning
* sbus: allow freeing msg through dbus api when using talloc
* PROXY: Do not abuse data provider interface
* DP: Remove old data provider interface
* NSS: Remove unused functions
Petr Cech (18):
* SYSDB: Fixing DB update
* PROVIDERS: Setting right {u,g}id if unprivileged
* SYSDB: Removing of duplication of sysdb_ts_cache_attrs
* test_utils: Fixing assignment discards 'const' qualifier
* LDAP: Changing of confusing debug message
* IPA: Changing of confusing debug message
* Revert "LDAP: Lookup services by all protocols unless a protocol is specified"
* PROVIDER: Conversion empty string from D-Bus to NULL
* LDAP: Fixing wrong pam error code for passwd
* UTILS: Fixing duplication of pid file declaration
* AD_PROVIDER: Add ad_enabled_domains option
* AD_PROVIDER: Initializing of ad_enabled_domains
* AD_PROVIDER: ad_enabled_domains - only master
* AD_PROVIDER: ad_enabled_domains - other then master
* TESTS: Adding tests for ad_enabled_domains option
* LDAP: Adding support for SIGTERM signal
* LDAP: Adding SIGTERM signal before SIGKILL
* LDAP: Adding SIGCHLD callback
Sumit Bose (33):
* views: allow override added for non-default views at runtime
* IPA: read ipaNTAdditionalSuffixes for master and trusted domains
* sysdb: add UPN suffix support for the master domain
* sysdb: make subdomain calls aware of upn_suffixes
* DP: add dp_get_module_data()
* IPA: add ipa_init_get_krb5_auth_ctx()
* IPA: enable enterprise principals if server supports them
* IPA: fix [capaths] output
* UTIL: make domain mapping content testable
* tests: add tests for sss_get_domain_mappings_content()
* AD: avoid memory leak in netlogon_get_domain_info() and make it public
* AD: netlogon_get_domain_info() allow missing arguments and empty results
* tests: add tests for netlogon_get_domain_info
* AD: replace ad_get_client_site_parse_ndr() with netlogon_get_domain_info()
* sysdb_master_domain_add_info: properly set do_update
* IPA: make ipa_resolve_user_list_{send|recv} public and allow AD users
* IPA: expand ghost members of AD groups in server-mode
* sysdb: add sysdb_get_user_members_recursively()
* views: properly override group member names
* IPA: fix lookup by UPN for subdomains
* LDAP: allow multiple user principals
* LDAP: new attribute option ldap_user_email
* sysdb: include email in UPN searches
* LDAP: include email in UPN searches
* NSS: add user email to fill_orig()
* utils: add is_email_from_domain()
* LDAP/IPA: add local email address to aliases
* NSS: continue with UPN/email search if name was not found
* PAM: continue with UPN/email search if name was not found
* NSS: use different neg cache name for UPN searches
* PAM: Fix domain for UPN based lookups
* SDAP: add special handling for IPA Kerberos enterprise principal strings
* SDAP: add enterprise principal strings for user searches
Thorsten Scherf (1):
* Fixed some typos in man pages
7 years, 8 months
netlink messages on Infiniband causing sssd to exit
by Ryan Novosielski
Over time, I’ve been having seemingly random sssd quits that I’ve not been able to figure out. Today, I finally traced it to fluctuations on my Infiniband fabric:
sssd.log
(Tue Nov 3 13:17:59 2015) [sssd] [message_type] (0x0200): netlink Message type: 16
(Tue Nov 3 13:17:59 2015) [sssd] [link_msg_handler] (0x1000): netlink link message: iface idx 4 (ib0) flags 0x1003 (broadcast,multicast,up)
(Tue Nov 3 13:17:59 2015) [sssd] [message_type] (0x0200): netlink Message type: 16
(Tue Nov 3 13:17:59 2015) [sssd] [link_msg_handler] (0x1000): netlink link message: iface idx 4 (ib0) flags 0x11043 (broadcast,multicast,up,running,lower)
This exactly corresponds to the time in /var/log/messages for the unexplained shutdown:
2015-11-03T13:17:59-05:00 node75 sssd[pam]: Shutting down
2015-11-03T13:17:59-05:00 node75 sssd[be[default]]: Shutting down
2015-11-03T13:17:59-05:00 node75 sssd[nss]: Shutting down
Here is sssd_default.log for good measure:
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1414770/0x14133d0
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1414770/0x13fef90
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_ptask_destructor] (0x0400): Terminating periodic task [Cleanup of default]
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sdap_handle_release] (0x2000): Trace: sh[0x14bd850], connected[1], ops[(nil)], ldap[0x1424260], destructor_lock[0], release_memory[0]
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_connection_callback] (0x4000): Successfully removed connection callback.
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1415970/0x1416430
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): The symlink points to [/var/lib/sss/pipes/private/sbus-dp_default.18702]
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): The path including our pid is [/var/lib/sss/pipes/private/sbus-dp_default.18702]
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): Removed the symlink
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_client_destructor] (0x0400): Removed PAM client
(Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_client_destructor] (0x0400): Removed NSS client
I can duplicate this by manually taking down the Infiniband link:
[root@node24 ~]# service sssd status
sssd (pid 9132) is running...
[root@node24 ~]# ifdown ib0
[root@node24 ~]# service sssd status
sssd dead but pid file exists
I have also noticed that sssd will not start on boot. As I know that Infiniband tends to flutter a little bit before the link comes up, I’m thinking this is probably the same cause.
Can anyone explain this behavior and tell me what I might do to prevent it?
--
____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences*
|| \\UTGERS |---------------------*O*---------------------
||_// Biomedical | Ryan Novosielski - Senior Technologist
|| \\ and Health | novosirj(a)rutgers.edu - 973/972.0922 (2x0922)
|| \\ Sciences | OIRT/High Perf & Res Comp - MSB C630, Newark
`'
7 years, 8 months
