October 2017 - sssd-users - Fedora mailing-lists

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

SSSD for one-way trusted AD domain
by Ondrej Valousek 15 May '18

15 May '18

Hi List, Question, we have joined machine into AD domain B. This domain has one way trust to domain A. No direct connection from domain B network to DCs in domain A is possible. Can we use SSSD to authenticate members in domain A. In windows, this works - but can't get it working in Linux via SSSD (Fedora 25, used realmd for AD join). Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

3 2

id -G user only showing primary group
by Jeff Sadowski 17 Nov '17

17 Nov '17

I'm running Fedora 26 sssd --version 1.15.3 I am authentication against an Active Directory Domain that has posix extensions enabled. All my ubuntu and centos machines are using power broker or winbind to authenticate to the domain. I want to transition away from power broker. I tried using winbind to connect fedora but I end up with issues of it not using posix extensions from my active directory. So I tried sssd out and see that users show correctly when I run the command getent passwd <username> when using winbind I had to use template for the shell and home directories which I did not like. This is not happening on my ubuntu or centos servers with the same config. There config if it helps is as follows [global] security = ads realm = MIND.UNM.EDU workgroup = MIND idmap config * : backend = tdb idmap config * : range = 2000-7999 idmap config MIND:backend = ad idmap config MIND:schema_mode = rfc2307 idmap config MIND:range = 8000-9999999 winbind nss info = rfc2307 winbind use default domain = yes # so that the users show up in getent winbind enum users = yes # so that the groups show up in getent winbind enum groups = yes restrict anonymous = 2 #added the following 2 for the Badlock updates that change the defaults #to no longer work with my domain controllers ldap server require strong auth = no client ldap sasl wrapping = plain Since that wasn't working, I uninstalled winbind and reinstalled sssd (I had removed it while testing samba since I know they can interfere.) I used realm to leave and rejoin the domain It looks like realm rewrote my smb.conf file as such [global] security = user idmap config * : backend = tdb idmap config * : range = 2000-7999 idmap config MIND:backend = ad idmap config MIND:schema_mode = rfc2307 idmap config MIND:range = 8000-9999999 winbind nss info = rfc2307 winbind use default domain = yes # so that the users show up in getent winbind enum users = yes # so that the groups show up in getent winbind enum groups = yes restrict anonymous = 2 #added the following 2 for the Badlock updates that change the defaults #to no longer work with my domain controllers ldap server require strong auth = no client ldap sasl wrapping = plain template homedir=/na/homes/%U template shell=/bin/bash My sssd.conf file looks like so [sssd] domains = mind.unm.edu config_file_version = 2 services = nss, pam [domain/mind.unm.edu] ad_domain = mind.unm.edu krb5_realm = MIND.UNM.EDU realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash #ldap_id_mapping = True ldap_id_mapping = False #use_fully_qualified_names = True use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = ad # debug = 3 I learned with ldap_id_mapping = True I was getting funny uid's and that interfered with my isilon that is using rfc2307 to our domain. And I want to login with <username> not <domain>\\<username> so i set use_fully_qualified_names = False While reading this https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html under sections: Common AD provider issues->A group my user is a member of doesn’t display in the id output In case the group is not present in the id -G output at all, there is something up with the initgroups part. This is the case but I'm not really sure where to go from here. I set debug on the domain to 3 and my /var/log/sssd/sssd_<domainname> looks as follows when I run id -G <user> in this case the user is jsadowski id -G <username> is only showing the primary group for any user I have tried. ... (Tue Oct 31 09:16:10 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:17:11 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:17:39 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:17:39 2017) [sssd[be[mind.unm.edu]]] [get_access_filter] (0x0010): Warning: LDAP access rule 'filter' is set, but no ldap_access_filter configured. All domain users will be denied access. (Tue Oct 31 09:18:16 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:21:03 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [krb5_init_kdc] (0x0010): Missing krb5_realm option! (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [dp_module_run_constructor] (0x0010): Module [krb5] constructor failed [22]: Invalid argument (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [dp_target_init] (0x0010): Unable to load module krb5 (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [main] (0x0010): Could not initialize backend [1432158209] (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [krb5_init_kdc] (0x0010): Missing krb5_realm option! (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [dp_module_run_constructor] (0x0010): Module [krb5] constructor failed [22]: Invalid argument (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [dp_target_init] (0x0010): Unable to load module krb5 (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Tue Oct 31 09:21:54 2017) [sssd[be[mind.unm.edu]]] [main] (0x0010): Could not initialize backend [1432158209] (Tue Oct 31 09:21:56 2017) [sssd[be[mind.unm.edu]]] [krb5_init_kdc] (0x0010): Missing krb5_realm option! (Tue Oct 31 09:21:56 2017) [sssd[be[mind.unm.edu]]] [dp_module_run_constructor] (0x0010): Module [krb5] constructor failed [22]: Invalid argument (Tue Oct 31 09:21:56 2017) [sssd[be[mind.unm.edu]]] [dp_target_init] (0x0010): Unable to load module krb5 (Tue Oct 31 09:21:56 2017) [sssd[be[mind.unm.edu]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Tue Oct 31 09:21:56 2017) [sssd[be[mind.unm.edu]]] [main] (0x0010): Could not initialize backend [1432158209] (Tue Oct 31 09:22:00 2017) [sssd[be[mind.unm.edu]]] [krb5_init_kdc] (0x0010): Missing krb5_realm option! (Tue Oct 31 09:22:00 2017) [sssd[be[mind.unm.edu]]] [dp_module_run_constructor] (0x0010): Module [krb5] constructor failed [22]: Invalid argument (Tue Oct 31 09:22:00 2017) [sssd[be[mind.unm.edu]]] [dp_target_init] (0x0010): Unable to load module krb5 (Tue Oct 31 09:22:00 2017) [sssd[be[mind.unm.edu]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Tue Oct 31 09:22:00 2017) [sssd[be[mind.unm.edu]]] [main] (0x0010): Could not initialize backend [1432158209] (Tue Oct 31 09:23:45 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:26:03 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children (Tue Oct 31 09:36:00 2017) [sssd[be[mind.unm.edu]]] [orderly_shutdown] (0x0010): SIGTERM: killing children ... (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [ad_sasl_log] (0x0040): SASL: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-2)[Local error] (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [1432158226]: Authentication Failed (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [be_run_online_cb] (0x0080): Going online. Running callbacks. (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [be_ptask_enable] (0x0080): Task [Subdomains Refresh]: already enabled (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [be_ptask_enable] (0x0080): Task [SUDO Smart Refresh]: already enabled (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [be_ptask_enable] (0x0080): Task [SUDO Full Refresh]: already enabled (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [be_ptask_enable] (0x0080): Task [AD machine account password renewal]: already enabled (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [resolv_gethostbyname_done] (0x0040): querying hosts database failed [5]: Input/output error (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [nsupdate_get_addrs_done] (0x0040): Could not resolve address for this machine, error [5]: Input/output error, resolver returned: [11]: Could not contact DNS servers (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [nsupdate_get_addrs_done] (0x0040): nsupdate_get_addrs_done failed: [5]: [Input/output error] (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [sdap_dyndns_dns_addrs_done] (0x0040): Could not receive list of current addresses [5]: Input/output error (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [5]: Input/output error (Tue Oct 31 10:16:44 2017) [sssd[be[mind.unm.edu]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [5]: Input/output error (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [ad_sasl_log] (0x0040): SASL: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-2)[Local error] (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)] (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [1432158226]: Authentication Failed (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sdap_ad_tokengroups_get_posix_members] (0x0080): Domain not found for SID S-1-5-32-545 (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sdap_ad_tokengroups_get_posix_members] (0x0080): Domain not found for SID S-1-5-32-544 (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sdap_ad_tokengroups_get_posix_members] (0x0080): Domain not found for SID S-1-5-32-555 (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sdap_ad_tokengroups_get_posix_members] (0x0080): Domain not found for SID S-1-5-32-551 (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sysdb_mod_group_member] (0x0080): ldb_modify failed: [No such attribute](16)[attribute 'member': no matching attribute value while deleting attribute on 'name=Administrators(a)mind.unm.edu,cn=groups,cn=mind.unm.edu,cn=sysdb'] (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sysdb_error_to_errno] (0x0020): LDB returned unexpected error: [No such attribute] (Tue Oct 31 10:16:51 2017) [sssd[be[mind.unm.edu]]] [sysdb_update_members_ex] (0x0020): Could not remove member [jsadowski(a)mind.unm.edu] from group [name=Administrators(a)mind.unm.edu,cn=groups,cn=mind.unm.edu,cn=sysdb] Skipping (Tue Oct 31 10:16:54 2017) [sssd[be[mind.unm.edu]]] [sdap_sudo_load_sudoers_done] (0x0040): Received 0 sudo rules

2 1

what are the causes of Port status of port 389 for server is 'not working'
by Jeremy Monnet 17 Nov '17

17 Nov '17

Hi, I have that error message that I do not understand, because I have 2 ubuntu servers setup the same way (but 1 ubuntu 14.04 and 1 ubuntu 16.04). Ubuntu 14 is working fine, I can authenticate and sudo just fine, Ubuntu 16 can list users and groups but I cannot authenticate nor sudo. And I see in the sssd_domain.log : (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [get_server_status] (0x1000): Status of server '<servername>' is 'name resolved' (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [get_port_status] (0x1000): Port status of port 389 for server '<servername>' is 'not working' (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [get_server_status] (0x1000): Status of server '<servername2>' is 'name resolved' (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [get_port_status] (0x1000): Port status of port 389 for server '<servername2>' is 'not working' (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD' (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5 (Fri Oct 20 16:27:29 2017) [sssd[be[domain]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) Of course, port 389 is indeed reachable, and I have joined and re-joined the domain several times, deleted the object computer in AD, checked several times that the keytab was created, and that I could kinit with it... One thing is that I join a child AD domain and tries to login with an account from the main domain, that is probably an issue, but as that work on the other Ubuntu with the same setup, I am stuck... Thanks, Jeremy

2 8

AD auth with multiple domains
by Jeremy Monnet 17 Nov '17

17 Nov '17

Hi, I am trying to setup an authentication against Active Directory, with multiple domains, and I haven't been able to find the recommended way to do it (it is very possible I missed it...), so I am looking for explanation and advice. With a master domain example.com, and subdomains sub1.example.com, sub2.example.com, etc, how would you setup sssd (and the linux system) to authenticate the users from all the domains ? To give te example, my user is ad admin across all the forests ( my_user(a)example.com) and I want to authenticate on all the servers, smtp.example.com or proxy.sub1.example.com, etc. I also want on some computer to authenticate customer's account (my_customer(a)sub1.example.com) For now, I have 2 different setups : - on computers from example.com [sssd] config_file_version = 2 debug_level =0 domains = example.com services = nss, pam [domain/example.com] enumerate = true dns_discovery_domain = cy2._sites.example.com debug_level = 8 id_provider = ad access_provider = ad ldap_id_mapping = false #dyndns_update = false - on computer from sub1.example.com [sssd] config_file_version = 2 debug_level =0 domains = sub1.example.com,example.com services = nss, pam [domain/example.com] enumerate = true dns_discovery_domain = cy2._sites.example.com debug_level = 9 id_provider = ad access_provider = ad ldap_id_mapping = false [domain/sub1.example.com] enumerate = true dns_discovery_domain = cy2._sites.sub1.example.com debug_level = 7 id_provider = ad access_provider = ad ldap_id_mapping = false I join computer to example.com or to sub1.example.com: adcli join example.com -U my_user(a)EXAMPLE.COM or adcli join sub1.example.com -U my_user(a)EXAMPLE.COM as I would do with an ordinary windows workstation. And for AD, I use the posix attributes (and that may be the way...) so if a UID or GID exists in both domains, I happen to find wrong group names, etc. I hope my questions are clear enough ! :-) What am I doing wrong ? What are the recommended settings for that situation ? Thanks, Jeremy

2 2

Re: [Freeipa-interest] Announcing SSSD 1.16.0
by Jakub Hrozek 09 Nov '17

09 Nov '17

On Mon, Oct 23, 2017 at 08:46:08PM +0200, Michael Ströder wrote: > HI! > > Has anything changed with building the man pages? > > I'm asking because I now get formatting markup in the output of man (see > below). No, not that I'm aware of. You render the man pages locally, right, because the tarball only contains the XML sources? > > Ciao, Michael. > > SSSD-LDAP(5) > File Formats and Conventions > SSSD-LDAP(5) > > .SH "NAME" sssd-ldap - SSSD LDAP provider > > .SH "DESCRIPTION" > > .PP This manual page describes the configuration of LDAP domains > for sssd(8). Refer to the “FILE FORMAT” section of the sssd.conf(5) > manual page for detailed syntax information. > > .PP You can configure SSSD to use more than one LDAP domain. >

3 5

sssd with OTP does not work in all cases.
by Asif Iqbal 02 Nov '17

02 Nov '17

With pam_securid.so I can on /etc/pam.d/sshd auth sufficient pam_securid.so and at ssh login, I just put PIN at Password: prompt and then I get Enter SMS Token: prompt and I can then put the tokencode and I can ssh into the server fine. If I do the same with pam_sss.so it keeps asking for Password: and never changes the prompt to Enter SMS Token: and ssh fails badly. At this second Password: prompt I tried with just tokencode (at 18:45:34 in log below) or PIN and tokencode (at 18:47:55). Neither let me in and failed eventually. I think it is because pam_sss -> proxy -> securid -> pam_securd is failing to handle PAM conversation? Is there a way to fix that to so pam_sss to behave the right way and let authenticate in two steps with PIN and then TokenCode on next step? Also without this PAM conversation, when the PIN expires it will not let you update it. With simple pam.d/sshd and auth sufficient pam_securid.so that works very well as well. I have sssd.conf setup like this auth_server = proxy proxy_target_pam = securid And in pam.d/securid file auth sufficient pam_securid.so Here are some log http://dpaste.com/2HD27XH.txt where I tried with PIN at first Password: prompt and then TokenCode at second Password: prompt at 18:45:34 and failed to login And I tried with PIN at first Password: prompt and then PIN and TokenCode at second Password: prompt at 18:47:55 and failed to login I tried with SElinux off and on and same result If I put PIN and TokenCode at the first Password: prompt, login works fine . I did not put any log for that here. Any suggestion how to fix pam_sss for OTP? Thanks! -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 7

loss of id / i have no name!
by Thomas Beaudry 25 Oct '17

25 Oct '17

Hi, I have repeated issues with users losing their usernames (only being mapped to their uid / in the terminal it says "i have no name!@host"). It doesn't happen daily, but it is extremely frustrating because they are running scientific pipelines that take a few hours to several days to complete, and as soon as their name is lost, it fails and the pipeline has to start from scratch. My setup is as follows. Client: Ubuntu 16.04 (Note that my university has licenses for Redhat, I could upgrade to it if it will 100% fix my problem. I simply use Ubuntu since a lot of scientific packages are already tailored for it, and it saves me weeks of work). Server: Windows AD, with a Windows NFS file server. What i don't understand is that if a user is successfully able to authenticate, why isn't the account cached, and used for their entire session? How can a name be lost if it is cached. I have the following in my sssd.conf: cache_credentials = True krb5_store_password_if_offline = True I have had this issue for quite awhile, so upon a previous sssd users suggestion, i disabled reverse DNS and it seemed to make this occur less often, but as far as I can tell my DNS is setup properly. I can do a `nslookup <host>` and get the proper ip address, and vice versa. Any help would be greatly appreciated! Thomas

2 7

idmap_sss Backend for Winbind
by rdratlos＠yahoo.co.uk 25 Oct '17

25 Oct '17

Dear all, I would like to use SSSD's dmap_sss backend (1.15.3) for winbindd (Version 4.6.7) to let SSSD map UIDs/GIDs and SIDs on a file server in an samba based AD environment. I've followed the limited instructions of the man page but from the logs it seems that winbindd does directly communicate with the AD server. The major settings in smb.conf are: [global] workgroup = MYDOMAIN realm = MYDOMAIN.COM security = ads ... winbind use default domain = yes winbind nss info = rfc2307 # Default idmap config for local BUILTIN accounts and groups idmap config * : range = 10000-19999 # idmap config for MYDOMAIN idmap config MYDOMAIN:backend = sss idmap config MYDOMAIN:schema_mode = rfc2307 idmap config MYDOMAIN:range = 500-9999 What's wrong here? Could someone please provide me with a working example?

2 5

Re: [Freeipa-interest] Announcing SSSD 1.16.0
by Michael Ströder 23 Oct '17

23 Oct '17

HI! Has anything changed with building the man pages? I'm asking because I now get formatting markup in the output of man (see below). Ciao, Michael. SSSD-LDAP(5) File Formats and Conventions SSSD-LDAP(5) .SH "NAME" sssd-ldap - SSSD LDAP provider .SH "DESCRIPTION" .PP This manual page describes the configuration of LDAP domains for sssd(8). Refer to the “FILE FORMAT” section of the sssd.conf(5) manual page for detailed syntax information. .PP You can configure SSSD to use more than one LDAP domain.

1 0

Kerberos Ticket renewal within Samba AD Domain
by Michael Löffler 21 Oct '17

21 Oct '17

Dear SSSD Users, I have a question regarding the renewal of Kerberos tickets within a Samba AD. All servers and clients are running Ubuntu 16.04. We have a lot of Windows clients too; therefore we're using Samba. First of all, I'll summarize our setup: - One server acts as the Samba AD Host (and Kerberos (integrated in Samba) principal) - One server acts as a file server; all directories (the users' home directories as well) are exported via kerberized NFS - The clients mount the directories; login auth is realized using sssd (with id_provider = ad, auth_provider = ad and access_provider = ad) When a user logs in at a client, he gets a Kerberos ticket and is therefore granted access to his home directory. If he locks the screen and logs in again, the ticket is renewed. However, if the user keeps the client locked for a time greater than the ticket lifetime, the ticket expires and the user is not able to write to his home directory any more. That's a problem if the user is, for example, running a process which takes a long time (in our case mostly simulations which are usually run overnight). The same things happens if a user connects to a client via ssh. Then, the ticket is never renewed automatically. Is it somehow possible to configure that sssd renews the krb5 ticket if the user has active processes running? Regards Michael

3 6

shortnames for 2 realms in Centos6
by Hampus Lundqvist 21 Oct '17

21 Oct '17

Hello Im searching for a solution to use shortnames for users from both FreeIPA(4.5) realm and a from a Trusted AD realm, I'm using Centos6.9 which has sssd 1.13. I’m doing it for the centos7’s using domain resolution order in the IPA server. Anyone has any suggestion on how to accomplish this on centos6? BR Hampus

4 5

SSSD trusted domain in forest
by Andreas Hauffe 21 Oct '17

21 Oct '17

Hi, I try to configure a client that is member of active directory domain s2dom.d1dom.dom.example.com which is a subdomain of d1dom.dom.example.com which itself is a subdomain of dom.example.com. Now I try to to login with users from user(a)dom.example.com and user1(a)s2dom.d1dom.dom.example.com. The last one works without problems. But I'm not able to get a user(a)dom.example.com working. my sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = s2dom.d1dom.dom.example.com [nss] default_shell=/bin/bash override_homedir = /home/%u [pam] [domain/s2dom.d1dom.dom.example.com] id_provider = ad access_provider = ad ldap_schema = ad ldap_id_mapping=true ldap_idmap_range_min=1000000 ldap_idmap_range_max=2000000 ldap_idmap_range_size=1000000 use_fully_qualified_names = true Regards Andreas

2 1

pam_sss force smartcard for TTY logins
by Winberg, Adam 20 Oct '17

20 Oct '17

Using pam_pkcs11 we can use the parameter 'wait_for_card' to halt the pam process until a smart card is inserted. Is there any feature like that with pam_sss? Use case is to require smart card for logins. With GDM this is configured via dconf, but with console/tty logins there is no such configuration available as I know of. So with pam_sss you can freely logon to a TTY without using smartcard. Or maybe there is a solution out there I'm missing? Regards Adam

2 3

p11_child showing certificate on smart card not valid
by Winberg, Adam 20 Oct '17

20 Oct '17

I'm trying to get smartcard auth working with sssd on RHEL 7.4. We currently use a pam_pkcs11/pam_krb5 setup and I was hoping to simplify this by using sssd instead. Unfortunately I cant get it to work, sssd does not seem to detect my smartcard certificate. Running p11_child I get the following: $ /usr/libexec/sssd/p11_child --pre -d 10 --debug-fd=2 --nssdb=/etc/pki/nssdb --pin (Thu Oct 19 10:43:19:786759 2017) [[sssd[p11_child[6320]]]] [main] (0x0400): p11_child started. (Thu Oct 19 10:43:19:786836 2017) [[sssd[p11_child[6320]]]] [main] (0x2000): Running in [pre-auth] mode. (Thu Oct 19 10:43:19:786849 2017) [[sssd[p11_child[6320]]]] [main] (0x2000): Running with effective IDs: [0][0]. (Thu Oct 19 10:43:19:786859 2017) [[sssd[p11_child[6320]]]] [main] (0x2000): Running with real IDs [0][0]. (Thu Oct 19 10:43:20:755639 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Default Module List: (Thu Oct 19 10:43:20:755722 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [NSS Internal PKCS #11 Module]. (Thu Oct 19 10:43:20:755753 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [(null)]. (Thu Oct 19 10:43:20:755780 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [p11-kit-trust]. (Thu Oct 19 10:43:20:755864 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [/usr/lib64/pkcs11/p11-kit-trust.so]. (Thu Oct 19 10:43:20:755900 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [OpenSC PKCS #11 Module]. (Thu Oct 19 10:43:20:755958 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [/usr/lib64/pkcs11/opensc-pkcs11.so]. (Thu Oct 19 10:43:20:755992 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Dead Module List: (Thu Oct 19 10:43:20:756025 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): DB Module List: (Thu Oct 19 10:43:20:756057 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [NSS Internal Module]. (Thu Oct 19 10:43:20:756085 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [(null)]. (Thu Oct 19 10:43:20:756112 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [Policy File]. (Thu Oct 19 10:43:20:756140 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [(null)]. (Thu Oct 19 10:43:20:771873 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [NSS User Private Key and Certificate Services Mozilla Foundation ] Manufacturer [Mozilla Foundation ] flags [1]. (Thu Oct 19 10:43:20:771969 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [NSS Internal Cryptographic Services Mozilla Foundation ] Manufacturer [Mozilla Foundation ] flags [1]. (Thu Oct 19 10:43:20:772007 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [/usr/share/pki/ca-trust-source PKCS#11 Kit ] Manufacturer [PKCS#11 Kit ] flags [1]. (Thu Oct 19 10:43:20:772037 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [/etc/pki/ca-trust/source PKCS#11 Kit ] Manufacturer [PKCS#11 Kit ] flags [1]. (Thu Oct 19 10:43:20:772245 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [Alcor Micro AU9540 00 00 Generic ] Manufacturer [Generic ] flags [7]. (Thu Oct 19 10:43:20:772290 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Found [identification (Instant EID IP9)] in slot [Alcor Micro AU9540 00 00][0] of module [3][/usr/lib64/pkcs11/opensc-pkcs11.so]. (Thu Oct 19 10:43:20:772320 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Token is NOT friendly. (Thu Oct 19 10:43:20:772346 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Trying to switch to friendly to read certificate. (Thu Oct 19 10:43:20:772372 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Login required. (Thu Oct 19 10:43:20:772397 2017) [[sssd[p11_child[6320]]]] [do_work] (0x0020): Login required but no pin available, continue. (Thu Oct 19 10:43:20:773994 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): found cert[identification (Instant EID IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] (Thu Oct 19 10:43:20:774071 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Filtered certificates: (Thu Oct 19 10:43:20:774167 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): found cert[identification (Instant EID IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] (Thu Oct 19 10:43:20:804677 2017) [[sssd[p11_child[6320]]]] [do_work] (0x0040): Certificate [identification (Instant EID IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] not valid [-8062], skipping. (Thu Oct 19 10:43:20:804857 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): No certificate found. What does the error code '-8062' mean? Regards, Adam

3 7

p11_child selinux woes
by Winberg, Adam 20 Oct '17

20 Oct '17

I'm running tests with using sssd for smartcard auth as an pam_pkcs11 replacement. I've gotten it to work, but am getting a _lot_ of selinux denials. It seems that p11_child inherits the sssd selinux context and therefore runs in the 'sssd_t' domain. This causes problems since p11_child seems to want access to a whole lot of stuff. Some examples: SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory fs. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /dev/hugepages. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /proc/fs/nfsd. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /boot. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /home. SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory /var/lib/nfs. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /. SELinux is preventing /usr/libexec/sssd/p11_child from execute access on the file /run/user/60483/ffiSOUzGu (deleted). SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /sys/fs/fuse/connections. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /dev. SELinux is preventing /usr/libexec/sssd/p11_child from execute access on the file /dev/shm/ffi8thWCx (deleted). SELinux is preventing /usr/libexec/sssd/p11_child from execute access on the file /run/ffi24njzA (deleted). SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /sys/kernel/config. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /sys/fs/selinux. An Sealert output: SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory .config. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that p11_child should be allowed search access on the .config directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'p11_child' --raw | audit2allow -M my-p11child # semodule -i my-p11child.pp Additional Information: Source Context system_u:system_r:sssd_t:s0 Target Context unconfined_u:object_r:config_home_t:s0 Target Objects .config [ dir ] Source p11_child Source Path /usr/libexec/sssd/p11_child Port <Unknown> Host c21226.ad.smhi.se Source RPM Packages sssd-krb5-common-1.15.2-50.el7_4.6.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.5.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name c21226.ad.smhi.se Platform Linux c21226.ad.smhi.se 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 13 10:46:25 EDT 2017 x86_64 x86_64 Alert Count 29 First Seen 2017-10-20 08:14:10 CEST Last Seen 2017-10-20 13:21:38 CEST Local ID 17d70bbe-a54d-47c3-8515-985d6646a93f Raw Audit Messages type=AVC msg=audit(1508498498.877:13286): avc: denied { search } for pid=29036 comm="krb5_child" name=".config" dev="sda2" ino=16782181 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir type=SYSCALL msg=audit(1508498498.877:13286): arch=x86_64 syscall=openat success=no exit=EACCES a0=ffffffffffffff9c a1=56536c43c350 a2=90800 a3=0 items=0 ppid=20098 pid=29036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=krb5_child exe=/usr/libexec/sssd/krb5_child subj=system_u:system_r:sssd_t:s0 key=(null) Hash: p11_child,sssd_t,config_home_t,dir,search Whats with all the acceses, is that normal? And if so, how's that suppose to work while running in the 'sssd_t' context? Regards Adam

2 2

kerberos/sssd lowercase problem
by Hampus Lundqvist 20 Oct '17

20 Oct '17

Hi Facing an issue where kinit defaults to using realm name in lowercase. Im switching to the user and execute 'kinit' the krb5kdc.log shows that it uses lowercased realm name and kinit gives an e-text error.. if I run as same user: kinit username it will add @REALM.. i did use "su" to become this user. Krb5.conf is running with defaults from ipa-client install, sssd 1.15. Any ideas? BR Hampus

2 1

sssd pam password
by Günther J. Niederwimmer 19 Oct '17

19 Oct '17

Hello, CentOS 7.4 I mean this is a old question :-(. but is it possible to have a password from sssd ? My Problem is, I installed FreeIPA and like to have a Dovecot SASL -> postfix installation? I configured Dovecot to use PAM, but with this I have no password for the postfix! What is the correct way to have a secure authentication for dovecot SASL -> postfix? Have I to do this with LDAP or is it possible with a "normal" way. Thanks for a answer, -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

2 3

sudo trying to use proxy for auth
by Asif Iqbal 18 Oct '17

18 Oct '17

I setup sssd to login with 2 factor auth and it works fine and then I am failing to sudo with ldap even though id_provider is ldap. Here is log from sssd_LDAP when running sudo -s http://dpaste.com/36PTMS0.txt Here is relevant config [domain/LDAP] chpass_provider = krb5 access_provider = ldap id_provider = ldap ... auth_provider = proxy proxy_pam_target = securid .. There is no sudo_* in here sudo -s works if I use the auth provider, which is 2FA. So it seems like sudo auth follows whatever auth_provider is set to? Can I have ssh login with proxy as auth provider and sudo login with ldap as auth provider? I know both ssh and sudo login works with ldap and krb5, but I need to have the ssh login with 2FA in my env. Thanks for your help -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

3 4

sudo does not work with SSSD
by Asif Iqbal 17 Oct '17

17 Oct '17

Hi All I have this is sssd.conf [sudo] debug_level = 0x3ff0 [domain/LDAP] debug_level = 0x02F0 ... sudo_provider = ldap ldap_sudo_search_base = ou=People,dc=mnet,dc=qintra,dc=com ldap_sudorule_object_class = mnetperson user can login OK with ldap, but sudo is failing I see the it is doing a ldapsearch like this in the sssd_sudo.log (Fri Oct 13 18:08:10 2017) [sssd[sudo]] [sudosrv_get_sudorules_query_cache] (0x0200): Searching sysdb with [(&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=iqbala)(sudoUser=#408462)(sudoUser=%iqbala)(sudoUser=+*)))] (Fri Oct 13 18:08:10 2017) [sssd[sudo]] [sudosrv_get_sudorules_from_cache] (0x0400): Returning 0 rules for [iqbala@LDAP] It would have worked if search were like this (&(objectClass=mnetperson)(|(sudoUser=ALL)(name=defaults)(uid=iqbala)(sudoUser=#408462)(sudoUser=%iqbala)(sudoUser=+*))) How do I change the config to search like above? Essentiall all I need is (&(objectClass=mnetperson)(uid=iqbala)) and may be I will add more attributes if I want other groups to be able to sudo. Also I do I map this to the sudo command that a user can run? Appreciate the help! -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

6 11

Does anyone use id_provider=local ?
by Jakub Hrozek 16 Oct '17

16 Oct '17

Hi, are there any SSSD users who actively use a configuration with: id_provider=local ? If so, what is your use-case? We're considering deprecating and eventually removing this provider upstream. The replacemant for id_provider=local would be id_provider=files: https://fedorahosted.org/sssd/wiki/DesignDocs/FilesProvider which is already under review and later extension of the SSSD's D-Bus interface to allow manipulating custom user attributes. My current plan for deprecating the local provider is to only build the provider and the tools around it if a configure-time flag is provided. This flag would be disabled by default. Then, if noone complains, eventually just remove the code.

3 5

SSSD reports errors with GPO formatted using SDDL
by Daniel Bryan 16 Oct '17

16 Oct '17

Hello, I noticed some of our users having linux authentication issues recently. Upon further digging it happened when a GPO was applied to the same OU these linux servers belonged to. The debug logs said there was an error due to a missing equal sign. I tracked down the policy and looked at the ini file and instantly noticed it differed from the normal format. *Many of our GPOs are in the format of:* [section] key=value *But this one was like:* saltminion",2,"D:AR(A;;CCLCSWLOCRRC;;;AU(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;LA)(A;;CCLCSWL The result was that access was denied to the user logging into the server. *Questions:* 1.) Should SSSD be able to parse GPOs using the template of Microsofts SDDL (Security Descriptor Definition Language) <https://msdn.microsoft.com/en-us/library/windows/desktop/aa379567(v=vs.85).…> ? 2.) What options are available to restore access besides removing the GPO from the OU, or setting ad_gpo_access_control to disabled or permissive? Thanks! --Dan -- *Daniel Bryan* DevOps Engineer | Stratus Solutions dbryan(a)stratussolutions.com www.stratussolutions.com

3 2

A security bug in SSSD 1.12 and later (CVE-2017-12173)
by Sumit Bose 15 Oct '17

15 Oct '17

=============== A security bug in SSSD 1.12 and later ========================= = = Subject: Unsanitized input when searching in local cache database = = CVE ID#: CVE-2017-12173 = = Summary: SSSD stores its cached data in an LDAP like local database = file using libldb. To lookup cached data LDAP search = filters like '(objectClass=user)(name=user_name)' are used. = However, in sysdb_search_user_by_upn_res(), the input is = not sanitized and allows to manipulate the search filter = for cache lookups. = = This would allow a logged in user to discover the password = hash of a different user. = = Impact: Moderate = = Affects default = configuration: When configured with tools like realmd or = ipa-client-install = = Introduced with: 1.12.0 = ============================================================================== ==== DESCRIPTION ==== SSSD stores its cached data in an LDAP like local database file using libldb. To lookup cached data LDAP search filters like '(objectClass=user)(name=user_name)' are used. However, in sysdb_search_user_by_upn_res(), the input is not sanitized and allows to manipulate the search filter for cache lookups. This would allow a logged in user to discover the password hash of a different user. While in the default configuration the sssd.conf parameter 'cache_credentials' is set to 'False' it is typically switched to 'True' by tools like realmd or ipa-client-install to support offline authentication. To remove the only password hashes from the cache 'cache_credentials' should be set to 'False' in all [domain/...] sections of sssd.conf. Additionally the already stored hashes must be remove e.g. by calling ldbedit -H /var/lib/sss/db/cache_DOMAIN-NAME.ldb for each configured domain and removing all 'cachedPassword' attributes. ==== PATCH AVAILABILITY ==== The patch is available at: https://pagure.io/SSSD/sssd/c/1f2662c8f97c9c0fa250055d4b6750abfc6d0835?bran…

3 5

Re: A security bug in SSSD 1.12 and later (CVE-2017-12173)
by Douglas Duckworth 12 Oct '17

12 Oct '17

To mitigate could one make the cache only readable by root which I thought would be the default? On Oct 11, 2017 5:43 PM, "Lachlan Musicman" <datakid(a)gmail.com> wrote: Will the COPR repos will be republished? ------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. " *Greg Bloom* @greggish https://twitter.com/greggish/ status/873177525903609857 <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_greggish_s…> On 12 October 2017 at 02:41, Sumit Bose <sbose(a)redhat.com> wrote: > =============== A security bug in SSSD 1.12 and later > ========================= > = > = Subject: Unsanitized input when searching in local cache > database > = > = CVE ID#: CVE-2017-12173 > = > = Summary: SSSD stores its cached data in an LDAP like local > database > = file using libldb. To lookup cached data LDAP search > = filters like '(objectClass=user)(name=user_name)' are > used. > = However, in sysdb_search_user_by_upn_res(), the input > is > = not sanitized and allows to manipulate the search > filter > = for cache lookups. > = > = This would allow a logged in user to discover the > password > = hash of a different user. > = > = Impact: Moderate > = > = Affects default > = configuration: When configured with tools like realmd or > = ipa-client-install > = > = Introduced with: 1.12.0 > = > ============================================================ > ================== > > ==== DESCRIPTION ==== > > SSSD stores its cached data in an LDAP like local database file using > libldb. > To lookup cached data LDAP search filters like > '(objectClass=user)(name=user_name)' are used. However, in > sysdb_search_user_by_upn_res(), the input is not sanitized and allows to > manipulate the search filter for cache lookups. > > This would allow a logged in user to discover the password hash of a > different > user. > > While in the default configuration the sssd.conf parameter > 'cache_credentials' > is set to 'False' it is typically switched to 'True' by tools like realmd > or > ipa-client-install to support offline authentication. > > To remove the only password hashes from the cache 'cache_credentials' > should be > set to 'False' in all [domain/...] sections of sssd.conf. Additionally the > already stored hashes must be remove e.g. by calling > > ldbedit -H /var/lib/sss/db/cache_DOMAIN-NAME.ldb > > for each configured domain and removing all 'cachedPassword' attributes. > > ==== PATCH AVAILABILITY ==== > > The patch is available at: > https://pagure.io/SSSD/sssd/c/1f2662c8f97c9c0fa250055d4b6750 > abfc6d0835?branch=master > <https://urldefense.proofpoint.com/v2/url?u=https-3A__pagure.io_SSSD_sssd_c_…> > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org >

2 1

HBAC rules randomly failing on ubuntu 16.04
by Orion Poplawski 11 Oct '17

11 Oct '17

I just added my first ubuntu 16.04 client to our IPA domain and am having problem with HBAC rules randomly denying access to a user that should have access. Users are in AD (ad.nwra.com) I have an external group containing the AD user linked to an IPA group used for the HBAC rule. Much of the time it will work, but sometimes not. sssd.conf: [domain/nwra.com] cache_credentials = True krb5_auth_timeout = 30 krb5_store_password_if_offline = True ipa_domain = nwra.com id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ipa_server = ipa.nwra.com, _srv_ ldap_tls_cacert = /etc/ipa/ca.crt dns_discovery_domain = nwra.com timeout = 20 debug_level = 5 [sssd] services = nss, sudo, pam, ssh, autofs domains = nwra.com default_domain_suffix = ad.nwra.com debug_level = 5 This is with 1.13.4-1ubuntu1.8 Is there any hope for this version to work? Any reliable source for an updated package? -- Orion Poplawski Technical Manager of NWRA Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

3 6

debugging sssd / autofs problem
by Thomas Beaudry 11 Oct '17

11 Oct '17

Hi, I have sssd + autofs working properly on 20+ machines. Recently, 1 of those machine has been not functioning properly (it might be linked to a power failure). Essentially, after any user logs into the machine, they get a: .bashrc: permission denied I thought that this could have been linked to a corrupt cache, so i deleted everything in my /var/lib/sss/db folder and restarted sssd. This didn't fix my problem.? Does anyone else have some suggestions as to what i can try? My logs are very large (6.5GB), so i could post them. but maybe there aren't necessary since maybe someone knows what the problem is. Thanks! Thomas

2 7

Kerberos Tickets not obtained until restart of SSSD
by Sam Weston 10 Oct '17

10 Oct '17

Hi again, The issue with password caching seems to have been solved. However with my 1.15.2 deployment still has one problem which is not present with 1.13. If you log in to a machine when it is offline, you have to reboot the machine or restart the sssd service for any Kerberos tickets to be obtained from the KDC when the machine comes back online. If I originally login when the machine is offline, I get this ticket: sweston@sflt28:~$ klist Ticket cache: FILE:/tmp/krb5cc_1117605638_HtMNOv Default principal: sweston(a)SMALLBUSINESS.LAN Valid starting Expires Service principal 01/01/70 01:00:00 01/01/70 01:00:00 krbtgt/SMALLBUSINESS.LAN(a)SMALLBUSINESS.LAN If I log out and login again with the network cable plugged in, I still only have the above ticket. The logs look like this: Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=sweston(a)smallbusiness.lan] (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): DP Request [Initgroups #329]: New request. Flags [0x0001]. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [_dp_req_recv] (0x0400): DP Request [Initgroups #329]: Receiving request data. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_reply_gen_error] (0x0080): DP Request [Initgroups #329]: Finished. Backend is currently offline. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:3::SMALLBUSINESS.LAN:name=sweston@smallbusiness.lan] from reply table (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): DP Request [Initgroups #329]: Request removed. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_pam_handler] (0x0100): Got request with the following data (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): domain: SMALLBUSINESS.LAN (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): user: sweston(a)smallbusiness.lan (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): service: sudo (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): tty: /dev/pts/0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): ruser: sweston (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): rhost: (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): authtok type: 1 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): priv: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): cli_pid: 3849 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): logon name: not set (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): DP Request [PAM Authenticate #330]: New request. Flags [0000]. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [krb5_auth_send] (0x0100): Home directory for user [sweston(a)smallbusiness.lan] not known. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [get_port_status] (0x0080): SSSD is unable to complete the full connection request, this internal status does not necessarily indicate network port issues. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_resolve_service_send] (0x0020): No available servers for service 'AD' (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_enable] (0x0080): Task [Check if online (periodic)]: already enabled (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_run_offline_cb] (0x0080): Going offline. Running callbacks. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_set_entry_attr] (0x0200): Entry [name=sweston(a)smallbusiness.lan,cn=users,cn=SMALLBUSINESS.LAN,cn=sysdb] has set [ts_cache] attrs. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_cache_auth] (0x0100): Hashes do match! (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_done] (0x0400): DP Request [PAM Authenticate #330]: Request handler finished [0]: Success (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [_dp_req_recv] (0x0400): DP Request [PAM Authenticate #330]: Receiving request data. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): DP Request [PAM Authenticate #330]: Request removed. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [3857] finished successfully. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_offline_cb] (0x0400): Back end is offline (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_disable] (0x0400): Task [Subdomains Refresh]: disabling task (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_pam_handler] (0x0100): Got request with the following data (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): domain: SMALLBUSINESS.LAN (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): user: sweston(a)smallbusiness.lan (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): service: sudo (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): tty: /dev/pts/0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): ruser: sweston (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): rhost: (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): authtok type: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): priv: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): cli_pid: 3849 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): logon name: not set (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): DP Request [PAM Account #331]: New request. Flags [0000]. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_access_send] (0x0400): Performing access check for user [sweston(a)smallbusiness.lan] (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_account_expired_ad] (0x0400): Performing AD access check for user [sweston(a)smallbusiness.lan] (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_send] (0x0400): service sudo maps to Permitted (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_done] (0x0400): GPO-based access control successful. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_done] (0x0400): DP Request [PAM Account #331]: Request handler finished [0]: Success (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [_dp_req_recv] (0x0400): DP Request [PAM Account #331]: Receiving request data. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): DP Request [PAM Account #331]: Request removed. (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_offline_cb] (0x0400): Back end is offline (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_disable] (0x0400): Task [SUDO Smart Refresh]: disabling task (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_offline_cb] (0x0400): Back end is offline (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_disable] (0x0400): Task [SUDO Full Refresh]: disabling task (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kdcinfo.SMALLBUSINESS.LAN], [2][No such file or directory] (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [remove_krb5_info_files] (0x0200): Could not remove [/var/lib/sss/pubconf/kpasswdinfo.SMALLBUSINESS.LAN], [2][No such file or directory] (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_offline_cb] (0x0400): Back end is offline (Tue Sep 12 17:17:08 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_ptask_disable] (0x0400): Task [AD machine account password renewal]: disabling task If I restart the sssd service and then lock the screen and login again everything works correctly. I get the ticket that I want: Ticket cache: FILE:/tmp/krb5cc_1117605638_HtMNOv Default principal: sweston(a)SMALLBUSINESS.LAN Valid starting Expires Service principal 12/09/17 17:21:24 13/09/17 03:21:24 krbtgt/SMALLBUSINESS.LAN(a)SMALLBUSINESS.LAN renew until 13/09/17 17:21:24 Logs: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=sweston(a)smallbusiness.lan] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): DP Request [Initgroups #1]: New request. Flags [0x0001]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD_GC' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolve_srv_send] (0x0200): The status of SRV lookup is neutral (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_srv_plugin_send] (0x0400): About to find domain controllers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_get_dc_servers_send] (0x0400): Looking up domain controllers in domain SMALLBUSINESS.LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'ldap'. Will use DNS discovery domain 'SMALLBUSINESS.LAN' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_ldap._tcp.SMALLBUSINESS.LAN' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_srv_done] (0x0400): Got answer. Processing... (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_srv_done] (0x0400): Got 2 servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_get_dc_servers_done] (0x0400): Found 2 domain controllers in domain SMALLBUSINESS.LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_srv_plugin_dcs_done] (0x0400): About to locate suitable site (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_connect_host_send] (0x0400): Resolving host sfbackup02.smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'sfbackup02.smallbusiness.lan' in files (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'sfbackup02.smallbusiness.lan' in files (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'sfbackup02.smallbusiness.lan' in DNS (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_connect_host_resolv_done] (0x0400): Connecting to ldap://sfbackup02.smallbusiness.lan:389 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_connect_host_done] (0x0400): Successful connection to ldap://sfbackup02.smallbusiness.lan:389 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(DnsDomain=SMALLBUSINESS.LAN)(NtVer=\14\00\00\00))][]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_get_client_site_done] (0x0400): Found site: Default-First-Site-Name (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_get_client_site_done] (0x0400): Found forest: SMALLBUSINESS.LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_srv_plugin_site_done] (0x0400): About to discover primary and backup servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_servers_send] (0x0400): Looking up primary servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'gc'. Will use DNS discovery domain 'Default-First-Site-Name._sites.SMALLBUSINESS.LAN' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.Default-First-Site-Name._sites.SMALLBUSINESS.LAN' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_srv_done] (0x0400): Got answer. Processing... (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_srv_done] (0x0400): Got 2 servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_servers_primary_done] (0x0400): Looking up backup servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_discover_srv_next_domain] (0x0400): SRV resolution of service 'gc'. Will use DNS discovery domain 'SMALLBUSINESS.LAN' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_getsrv_send] (0x0100): Trying to resolve SRV record of '_gc._tcp.SMALLBUSINESS.LAN' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_srv_done] (0x0400): Got answer. Processing... (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_discover_srv_done] (0x0400): Got 2 servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_srv_plugin_servers_done] (0x0400): Got 2 primary and 2 backup servers (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'sfpdc.smallbusiness.lan:3268' to service 'AD_GC' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_add_server_to_list] (0x0400): Inserted primary server 'sfbackup02.smallbusiness.lan:3268' to service 'AD_GC' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_add_server_to_list] (0x0400): Server 'sfbackup02.smallbusiness.lan:3268' for service 'AD_GC' is already present (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_add_server_to_list] (0x0400): Server 'sfpdc.smallbusiness.lan:3268' for service 'AD_GC' is already present (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [set_srv_data_status] (0x0100): Marking SRV lookup of service 'AD_GC' as 'resolved' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of 'sfpdc.smallbusiness.lan' in files (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [set_server_common_status] (0x0100): Marking server 'sfpdc.smallbusiness.lan' as 'resolving name' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of 'sfpdc.smallbusiness.lan' in files (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'sfpdc.smallbusiness.lan' in DNS (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [request_watch_destructor] (0x0400): Deleting request watch (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [set_server_common_status] (0x0100): Marking server 'sfpdc.smallbusiness.lan' as 'name resolved' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_resolve_server_process] (0x0200): Found address for server sfpdc.smallbusiness.lan: [192.168.1.7] TTL 3600 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://sfpdc.smallbusiness.lan' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://sfpdc.smallbusiness.lan:3268' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_kinit_send] (0x0400): Attempting kinit (default, SFLT28$, SMALLBUSINESS.LAN, 86400) (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_resolve_server_process] (0x0200): Found address for server sfbackup02.smallbusiness.lan: [192.168.1.3] TTL 3600 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [create_tgt_req_send_buffer] (0x0400): buffer size: 48 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for tgt child (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [4718] finished successfully. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_tgt_recv] (0x0400): Child responded: 0 [FILE:/var/lib/sss/db/ccache_SMALLBUSINESS.LAN], expired on [1505269284] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: SFLT28$ (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_cli_connect_recv] (0x0400): Connection established. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_set_port_status] (0x0100): Marking port 3268 of server 'sfpdc.smallbusiness.lan' as 'working' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [set_server_common_status] (0x0100): Marking server 'sfpdc.smallbusiness.lan' as 'working' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_set_port_status] (0x0400): Marking port 3268 of duplicate server 'sfpdc.smallbusiness.lan' as 'working' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [DC=SMALLBUSINESS,DC=LAN] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=sweston)(objectclass=user)(objectSID=*))][DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_save_user] (0x0400): Save user (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_primary_name] (0x0400): Processing object sweston (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_save_user] (0x0400): Processing user sweston(a)smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_save_user] (0x0400): Adding original memberOf attributes to [sweston(a)smallbusiness.lan] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_save_user] (0x0400): Adding user principal [sweston(a)SMALLBUSINESS.LAN] to attributes of [sweston(a)smallbusiness.lan] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_save_user] (0x0400): Storing info for user sweston(a)smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_set_entry_attr] (0x0200): Entry [name=sweston(a)smallbusiness.lan,cn=users,cn=SMALLBUSINESS.LAN,cn=sysdb] has set [ts_cache] attrs. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no filter][CN=Sam Weston,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_idmap_sid_to_unix] (0x0400): Object SID [S-1-5-32-550] is a built-in one. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_ad_save_group_membership_with_idmapping] (0x0400): Skipping built-in object. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_idmap_sid_to_unix] (0x0400): Object SID [S-1-5-32-545] is a built-in one. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_ad_save_group_membership_with_idmapping] (0x0400): Skipping built-in object. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_idmap_sid_to_unix] (0x0400): Object SID [S-1-5-32-544] is a built-in one. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_ad_save_group_membership_with_idmapping] (0x0400): Skipping built-in object. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_idmap_sid_to_unix] (0x0400): Object SID [S-1-5-32-549] is a built-in one. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_ad_save_group_membership_with_idmapping] (0x0400): Skipping built-in object. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_idmap_sid_to_unix] (0x0400): Object SID [S-1-5-32-574] is a built-in one. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_ad_save_group_membership_with_idmapping] (0x0400): Skipping built-in object. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_initgr_done] (0x0400): Primary group already cached, nothing to do. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_set_entry_attr] (0x0200): Entry [name=sweston(a)smallbusiness.lan,cn=users,cn=SMALLBUSINESS.LAN,cn=sysdb] has set [ts_cache] attrs. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_done] (0x0400): DP Request [Initgroups #1]: Request handler finished [0]: Success (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [_dp_req_recv] (0x0400): DP Request [Initgroups #1]: Receiving request data. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_initgr_pp] (0x0400): Ordering NSS responder to update memory cache (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_reply_list_success] (0x0400): DP Request [Initgroups #1]: Finished. Success. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:3::SMALLBUSINESS.LAN:name=sweston@smallbusiness.lan] from reply table (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): DP Request [Initgroups #1]: Request removed. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_pam_handler] (0x0100): Got request with the following data (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): domain: SMALLBUSINESS.LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): user: sweston(a)smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): service: gdm-password (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): tty: /dev/tty2 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): ruser: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): rhost: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): authtok type: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): priv: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): cli_pid: 4714 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): logon name: not set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): DP Request [PAM Authenticate #2]: New request. Flags [0000]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [krb5_auth_send] (0x0100): Home directory for user [sweston(a)smallbusiness.lan] not known. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [be_resolve_server_process] (0x0200): Found address for server sfbackup02.smallbusiness.lan: [192.168.1.3] TTL 3600 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'sfbackup02.smallbusiness.lan' as 'working' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [set_server_common_status] (0x0100): Marking server 'sfbackup02.smallbusiness.lan' as 'working' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'sfbackup02.smallbusiness.lan' as 'working' (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_set_entry_attr] (0x0200): Entry [name=sweston(a)smallbusiness.lan,cn=users,cn=SMALLBUSINESS.LAN,cn=sysdb] has set [ts_cache] attrs. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_set_entry_attr] (0x0200): Entry [name=sweston(a)smallbusiness.lan,cn=users,cn=SMALLBUSINESS.LAN,cn=sysdb] has set [cache, ts_cache] attrs. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_done] (0x0400): DP Request [PAM Authenticate #2]: Request handler finished [0]: Success (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [_dp_req_recv] (0x0400): DP Request [PAM Authenticate #2]: Receiving request data. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): DP Request [PAM Authenticate #2]: Request removed. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [4719] finished successfully. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_pam_handler] (0x0100): Got request with the following data (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): domain: SMALLBUSINESS.LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): user: sweston(a)smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): service: gdm-password (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): tty: /dev/tty2 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): ruser: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): rhost: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): authtok type: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): priv: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): cli_pid: 4714 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): logon name: not set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): DP Request [PAM Account #3]: New request. Flags [0000]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_access_send] (0x0400): Performing access check for user [sweston(a)smallbusiness.lan] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_account_expired_ad] (0x0400): Performing AD access check for user [sweston(a)smallbusiness.lan] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_send] (0x0400): service gdm-password maps to Interactive (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_connect_done] (0x0400): sam_account_name is SFLT28$ (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectclass=user)(sAMAccountName=SFLT28$))][dc=smallbusiness,dc=lan]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [objectclass=domain][DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_master_domain_next_done] (0x0400): Found SID [S-1-5-21-3845744863-2409227386-3211111987]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(DnsDomain=SMALLBUSINESS.LAN)(NtVer=\14\00\00\00))][]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_master_domain_netlogon_done] (0x0400): Found flat name [SMALLBUSINESS]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_master_domain_netlogon_done] (0x0400): Found site [Default-First-Site-Name]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_master_domain_netlogon_done] (0x0400): Found forest [SMALLBUSINESS.LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[0]->som_dn is OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[1]->som_dn is OU=Computers,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[2]->som_dn is OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[3]->som_dn is DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_site_dn_retrieval_done] (0x0400): som_list[4]->som_dn is cn=Default-First-Site-Name,cn=Sites,CN=Configuration,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][OU=Computers,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: OU=Computers,OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: OU=MyBusiness,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_gplink_list] (0x0400): som_dn: DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn=Default-First-Site-Name,cn=Sites,CN=Configuration,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_get_som_attrs_done] (0x0040): no attrs found for SOM; try next SOM (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[0]->gpo_dn: CN={7D28B004-B249-49B0-A8CE-BA2A0B9F56EA},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[1]->gpo_dn: CN={7F8D8A41-8831-4EF1-990F-3AECF333E735},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[2]->gpo_dn: CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[3]->gpo_dn: cn={BA4389F2-AD33-4678-BF30-44D81E900008},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[4]->gpo_dn: cn={5F743845-71B6-4CDF-965F-20360E51C01A},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[5]->gpo_dn: cn={8FC54817-BD35-4D6F-AB72-E799C66667E8},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[6]->gpo_dn: cn={CED4E066-9ADF-47A5-8F92-BBDDB522A034},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[7]->gpo_dn: cn={6ECD6877-791E-4F38-9945-EFAF733C3475},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[8]->gpo_dn: cn={CE7CA45B-21CC-4C6C-A9F6-DCED4A0D7C93},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[9]->gpo_dn: cn={57EF63D0-BF6F-4079-BD9B-9D896BB9A495},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[10]->gpo_dn: cn={29274130-3B70-4A97-AB38-25EA9D8D0F67},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[11]->gpo_dn: cn={D6B5C6DF-114E-49FC-976E-5B8893FA1E27},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[12]->gpo_dn: cn={3452D745-B138-4799-A555-1EBFB3654704},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[13]->gpo_dn: cn={B42D8E08-C289-436C-8E31-BD3DD2A415DC},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_populate_candidate_gpos] (0x0400): candidate_gpos[14]->gpo_dn: cn={355444B3-99ED-4D77-B9EC-BAF3EAA17AA7},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [CN={7D28B004-B249-49B0-A8CE-BA2A0B9F56EA},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][CN={7D28B004-B249-49B0-A8CE-BA2A0B9F56EA},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [CN={7F8D8A41-8831-4EF1-990F-3AECF333E735},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][CN={7F8D8A41-8831-4EF1-990F-3AECF333E735},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={BA4389F2-AD33-4678-BF30-44D81E900008},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={BA4389F2-AD33-4678-BF30-44D81E900008},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={5F743845-71B6-4CDF-965F-20360E51C01A},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={5F743845-71B6-4CDF-965F-20360E51C01A},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={8FC54817-BD35-4D6F-AB72-E799C66667E8},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={8FC54817-BD35-4D6F-AB72-E799C66667E8},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={CED4E066-9ADF-47A5-8F92-BBDDB522A034},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={CED4E066-9ADF-47A5-8F92-BBDDB522A034},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={6ECD6877-791E-4F38-9945-EFAF733C3475},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={6ECD6877-791E-4F38-9945-EFAF733C3475},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={CE7CA45B-21CC-4C6C-A9F6-DCED4A0D7C93},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={CE7CA45B-21CC-4C6C-A9F6-DCED4A0D7C93},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={57EF63D0-BF6F-4079-BD9B-9D896BB9A495},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={57EF63D0-BF6F-4079-BD9B-9D896BB9A495},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={29274130-3B70-4A97-AB38-25EA9D8D0F67},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={29274130-3B70-4A97-AB38-25EA9D8D0F67},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={D6B5C6DF-114E-49FC-976E-5B8893FA1E27},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={D6B5C6DF-114E-49FC-976E-5B8893FA1E27},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={3452D745-B138-4799-A555-1EBFB3654704},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={3452D745-B138-4799-A555-1EBFB3654704},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={B42D8E08-C289-436C-8E31-BD3DD2A415DC},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={B42D8E08-C289-436C-8E31-BD3DD2A415DC},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={355444B3-99ED-4D77-B9EC-BAF3EAA17AA7},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN] using SD (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_send] (0x0400): WARNING: Disabling paging because scope is set to base. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={355444B3-99ED-4D77-B9EC-BAF3EAA17AA7},cn=policies,cn=system,DC=SMALLBUSINESS,DC=LAN]. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[0]->gpo_guid is {7D28B004-B249-49B0-A8CE-BA2A0B9F56EA} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[1]->gpo_guid is {7F8D8A41-8831-4EF1-990F-3AECF333E735} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[2]->gpo_guid is {BA4389F2-AD33-4678-BF30-44D81E900008} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[3]->gpo_guid is {5F743845-71B6-4CDF-965F-20360E51C01A} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[4]->gpo_guid is {8FC54817-BD35-4D6F-AB72-E799C66667E8} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[5]->gpo_guid is {CED4E066-9ADF-47A5-8F92-BBDDB522A034} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[6]->gpo_guid is {6ECD6877-791E-4F38-9945-EFAF733C3475} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[7]->gpo_guid is {CE7CA45B-21CC-4C6C-A9F6-DCED4A0D7C93} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[8]->gpo_guid is {57EF63D0-BF6F-4079-BD9B-9D896BB9A495} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[9]->gpo_guid is {29274130-3B70-4A97-AB38-25EA9D8D0F67} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[10]->gpo_guid is {D6B5C6DF-114E-49FC-976E-5B8893FA1E27} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[11]->gpo_guid is {3452D745-B138-4799-A555-1EBFB3654704} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[12]->gpo_guid is {B42D8E08-C289-436C-8E31-BD3DD2A415DC} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): dacl_filtered_gpos[13]->gpo_guid is {355444B3-99ED-4D77-B9EC-BAF3EAA17AA7} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): cse_filtered_gpos[0]->gpo_guid is {7D28B004-B249-49B0-A8CE-BA2A0B9F56EA} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): cse_filtered_gpos[1]->gpo_guid is {BA4389F2-AD33-4678-BF30-44D81E900008} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): cse_filtered_gpos[2]->gpo_guid is {57EF63D0-BF6F-4079-BD9B-9D896BB9A495} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): cse_filtered_gpos[3]->gpo_guid is {D6B5C6DF-114E-49FC-976E-5B8893FA1E27} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_process_gpo_done] (0x0400): num_cse_filtered_gpos: 4 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_gpo_delete_gpo_result_object] (0x0400): Deleting GPO Result object (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cse filtered_gpos[0]->gpo_guid is {7D28B004-B249-49B0-A8CE-BA2A0B9F56EA} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_server: smb://sfpdc.smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_share: /SysVol (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_path: /SMALLBUSINESS.LAN/Policies/{7D28B004-B249-49B0-A8CE-BA2A0B9F56EA} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): gpo_guid: {7D28B004-B249-49B0-A8CE-BA2A0B9F56EA} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): retrieving GPO from cache [{7D28B004-B249-49B0-A8CE-BA2A0B9F56EA}] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): send_to_child: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cached_gpt_version: 655593 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [gpo_cse_done] (0x0400): sysvol_gpt_version: 655593 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_done] (0x0400): gpo_guid: {7D28B004-B249-49B0-A8CE-BA2A0B9F56EA} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cse filtered_gpos[1]->gpo_guid is {BA4389F2-AD33-4678-BF30-44D81E900008} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_server: smb://sfpdc.smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_share: /SysVol (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_path: /SMALLBUSINESS.LAN/Policies/{BA4389F2-AD33-4678-BF30-44D81E900008} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): gpo_guid: {BA4389F2-AD33-4678-BF30-44D81E900008} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): retrieving GPO from cache [{BA4389F2-AD33-4678-BF30-44D81E900008}] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): send_to_child: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cached_gpt_version: 10 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0020): waitpid did not found a child with changed status. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [4722] finished successfully. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [gpo_cse_done] (0x0400): sysvol_gpt_version: 10 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_done] (0x0400): gpo_guid: {BA4389F2-AD33-4678-BF30-44D81E900008} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_store_policy_settings] (0x0020): [/var/lib/sss/gpo_cache/SMALLBUSINESS.LAN/Policies/{BA4389F2-AD33-4678-BF30-44D81E900008}/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf]: ini_config_parse failed [5][Input/output error] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_store_policy_settings] (0x0020): Error (5) on line 7: Equal sign is missing. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_store_policy_settings] (0x0020): Error (5) on line 8: Equal sign is missing. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cse filtered_gpos[2]->gpo_guid is {57EF63D0-BF6F-4079-BD9B-9D896BB9A495} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_server: smb://sfpdc.smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_share: /SysVol (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_path: /SMALLBUSINESS.LAN/Policies/{57EF63D0-BF6F-4079-BD9B-9D896BB9A495} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): gpo_guid: {57EF63D0-BF6F-4079-BD9B-9D896BB9A495} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): retrieving GPO from cache [{57EF63D0-BF6F-4079-BD9B-9D896BB9A495}] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): send_to_child: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cached_gpt_version: 8 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0020): waitpid did not found a child with changed status. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [4724] finished successfully. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [gpo_cse_done] (0x0400): sysvol_gpt_version: 8 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_done] (0x0400): gpo_guid: {57EF63D0-BF6F-4079-BD9B-9D896BB9A495} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_gpo_store_gpo_result_setting] (0x0400): Storing setting: key [SeDenyInteractiveLogonRight] value [*S-1-5-21-3845744863-2409227386-3211111987-3806] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_gpo_store_gpo_result_setting] (0x0400): Updating setting: key [SeDenyRemoteInteractiveLogonRight] value [*S-1-5-21-3845744863-2409227386-3211111987-3806] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cse filtered_gpos[3]->gpo_guid is {D6B5C6DF-114E-49FC-976E-5B8893FA1E27} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_server: smb://sfpdc.smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_share: /SysVol (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): smb_path: /SMALLBUSINESS.LAN/Policies/{D6B5C6DF-114E-49FC-976E-5B8893FA1E27} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): gpo_guid: {D6B5C6DF-114E-49FC-976E-5B8893FA1E27} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): retrieving GPO from cache [{D6B5C6DF-114E-49FC-976E-5B8893FA1E27}] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): send_to_child: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_step] (0x0400): cached_gpt_version: 262220 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0020): waitpid did not found a child with changed status. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [4726] finished successfully. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [write_pipe_handler] (0x0400): All data has been sent! (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [read_pipe_handler] (0x0400): EOF received, client finished (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [gpo_cse_done] (0x0400): sysvol_gpt_version: 262220 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_cse_done] (0x0400): gpo_guid: {D6B5C6DF-114E-49FC-976E-5B8893FA1E27} (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_gpo_get_gpo_result_setting] (0x0400): key [SeInteractiveLogonRight] value [(null)] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [parse_policy_setting_value] (0x0400): No value for key [SeInteractiveLogonRight] found in gpo result (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [sysdb_gpo_get_gpo_result_setting] (0x0400): key [SeDenyInteractiveLogonRight] value [*S-1-5-21-3845744863-2409227386-3211111987-3806] (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): RESULTANT POLICY: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): gpo_map_type: Interactive (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): allowed_size = 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): denied_size = 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): denied_sids[0] = S-1-5-21-3845744863-2409227386-3211111987-3806 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): CURRENT USER: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): user_sid = S-1-5-21-3845744863-2409227386-3211111987-5638 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[0] = S-1-5-21-3845744863-2409227386-3211111987-5652 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[1] = S-1-5-21-3845744863-2409227386-3211111987-5656 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[2] = S-1-5-21-3845744863-2409227386-3211111987-3798 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[3] = S-1-5-21-3845744863-2409227386-3211111987-5655 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[4] = S-1-5-21-3845744863-2409227386-3211111987-5659 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[5] = S-1-5-21-3845744863-2409227386-3211111987-5653 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[6] = S-1-5-21-3845744863-2409227386-3211111987-5660 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[7] = S-1-5-21-3845744863-2409227386-3211111987-5663 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[8] = S-1-5-21-3845744863-2409227386-3211111987-5732 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[9] = S-1-5-21-3845744863-2409227386-3211111987-3722 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[10] = S-1-5-21-3845744863-2409227386-3211111987-5709 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[11] = S-1-5-21-3845744863-2409227386-3211111987-512 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[12] = S-1-5-21-3845744863-2409227386-3211111987-3823 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[13] = S-1-5-21-3845744863-2409227386-3211111987-5654 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[14] = S-1-5-21-3845744863-2409227386-3211111987-513 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[15] = S-1-5-21-3845744863-2409227386-3211111987-3665 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[16] = S-1-5-21-3845744863-2409227386-3211111987-3737 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[17] = S-1-5-21-3845744863-2409227386-3211111987-3754 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[18] = S-1-5-21-3845744863-2409227386-3211111987-5665 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[19] = S-1-5-21-3845744863-2409227386-3211111987-3715 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[20] = S-1-5-21-3845744863-2409227386-3211111987-5661 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[21] = S-1-5-21-3845744863-2409227386-3211111987-3812 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[22] = S-1-5-21-3845744863-2409227386-3211111987-572 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[23] = S-1-5-21-3845744863-2409227386-3211111987-3610 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[24] = S-1-5-21-3845744863-2409227386-3211111987-1182 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[25] = S-1-5-21-3845744863-2409227386-3211111987-1627 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[26] = S-1-5-21-3845744863-2409227386-3211111987-1630 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[27] = S-1-5-21-3845744863-2409227386-3211111987-1767 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[28] = S-1-5-21-3845744863-2409227386-3211111987-1628 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[29] = S-1-5-21-3845744863-2409227386-3211111987-2354 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[30] = S-1-5-21-3845744863-2409227386-3211111987-1625 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[31] = S-1-5-21-3845744863-2409227386-3211111987-1766 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[32] = S-1-5-21-3845744863-2409227386-3211111987-1768 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[33] = S-1-5-21-3845744863-2409227386-3211111987-3667 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[34] = S-1-5-21-3845744863-2409227386-3211111987-3759 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): group_sids[35] = S-1-5-11 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): POLICY DECISION: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): access_granted = 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_check] (0x0400): access_denied = 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [ad_gpo_access_done] (0x0400): GPO-based access control successful. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_done] (0x0400): DP Request [PAM Account #3]: Request handler finished [0]: Success (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [_dp_req_recv] (0x0400): DP Request [PAM Account #3]: Receiving request data. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): DP Request [PAM Account #3]: Request removed. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_method_enabled] (0x0400): Target selinux is not configured (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [child_sig_handler] (0x0100): child [4728] finished successfully. (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [dp_pam_handler] (0x0100): Got request with the following data (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): command: SSS_PAM_SETCRED (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): domain: SMALLBUSINESS.LAN (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): user: sweston(a)smallbusiness.lan (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): service: gdm-password (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): tty: /dev/tty2 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): ruser: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): rhost: (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): authtok type: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): newauthtok type: 0 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): priv: 1 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): cli_pid: 4714 (Tue Sep 12 17:21:24 2017) [sssd[be[SMALLBUSINESS.LAN]]] [pam_print_data] (0x0100): logon name: not set My config: [sssd] config_file_version = 2 reconnection_retries = 3 services = nss,pam domains = SMALLBUSINESS.LAN offline_timeout = 10 debug_level = 6 [nss] debug_level = 6 [pam] debug_level = 6 [domain/SMALLBUSINESS.LAN] debug_level = 6 access_provider = ad ad_domain = SMALLBUSINESS.LAN ad_gpo_access_control = permissive cache_credentials = True default_shell = /bin/bash fallback_homedir = /home/%u id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True realmd_tags = manages-system joined-with-samba The offline_timeout line is a recent addition which doesn't seem to have helped. I guess my question is why I have to restart SSSD for it "realise" that it's back online. Ideally I would like it to get a kerberos ticket as soon as it comes online which I guess it should do with the krb5_store_password_if_offline option set? Thanks for all your help Sam

3 2

Re: Does sssd-1.5.1-71.el5 Support Autofs
by Douglas Duckworth 07 Oct '17

07 Oct '17

Thanks! I was able to get it working with ldap! Best Doug On Oct 7, 2017 5:37 AM, "Lukas Slebodnik" <lslebodn(a)redhat.com> wrote: > On (06/10/17 13:37), Douglas Duckworth wrote: > > >Hi > > > > > >I have an old server that I need to retire. > > > > > >Until then can you tell me if this old version supports autofs? > > > > > >[root@node002 ~]# tail -n 100 /var/log/sssd/sssd.log > > >(Fri Oct 6 13:35:01 2017) [sssd] [get_monitor_config] (0): Invalid > service > > >autofs > > > > > autofs support was implemented in 1.8.x > > https://urldefense.proofpoint.com/v2/url?u=https-3A__docs. > pagure.org_SSSD.sssd_design-5Fpages_index.html-23implemented-2Din-2D1-2D8- > 2Dx&d=DwIGaQ&c=lb62iw4YL4RFalcE2hQUQealT9-RXrryqt9KZX2qu2s&r=2Fzhh_ > 78OGspKQpl_e-CbhH6xUjnRkaqPFUS2wTJ2cw&m=izJtCOzMQghf4bY5878r7fv1HhLjlN > wn9EQXoigsyZU&s=njYqiwTUvprEl2T9F49GB_0aczTVBif8RpQOVkAkGcE&e= > > > > So with older version you need to use ldap instead of sss. > > > > LS > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org >

1 0

Does sssd-1.5.1-71.el5 Support Autofs
by Douglas Duckworth 07 Oct '17

07 Oct '17

Hi I have an old server that I need to retire. Until then can you tell me if this old version supports autofs? [root@node002 ~]# tail -n 100 /var/log/sssd/sssd.log (Fri Oct 6 13:35:01 2017) [sssd] [get_monitor_config] (0): Invalid service autofs Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

2 1

Fw: sssd email login performance
by Galen Johnson 05 Oct '17

05 Oct '17

Adding the list since Sumit appears to be busy. The info is anonymized so it should be ok. Hopefully, the gz file makes it through. =G=? ________________________________ From: Galen Johnson Sent: Thursday, September 21, 2017 5:36 PM To: Sumit Bose Cc: Philip Holman Subject: sssd email login performance Hi Sumit, I'm finally getting a chance to follow up on the email thread (of the same title) from the sssd list. We've seen some delays (multi-second) for auth requests when users use their email address versus their id. I've attached a tar file with several log files. Phil may need to explain the summary file if you have any questions about it. We are running Centos 7.4 now but I'm fairly certain that it's the same binaries as RHEL 7.4. These logs were taken while on 7.3. I noticed that sssd bumped to 1.15 with 7.4. Some outstanding questions we have are: 1. The cache appears to not be used for the email attribute. Why is this not used? 2. We're also curious why the ldap requests add 2 seconds when performing the same query from the command-line returns almost immediately. 3. Is it possible to have SSSD ignore the domain and just immediately look up the address? We see "is_email_from_domain" in the domain log (reflected in the nss log). We checked the man pages and nothing really jumped out as a config option. It should be noted that we also moved the sssd db cache to tmpfs (per a blog from Jakub). ? Thanks for any insight =G=? Phil's analysis follows: To wrap up, I took one more look at one of the very slow email logins to pull out a trace of what it was doing. The attached files are the log snippets with line breaks marking off the incoming requests to make it more clear what each module was servicing when. The summary.txt shows the summarized entry for the connection and also gives an abridged combined view of the logs marking where the 7 seconds appear to have gone. So this seemed enough info to share if we have the opportunity for a consult with someone. The short version is that 1 second roughly went to the bind that tests the user, but the other 6 appear to have likely been the result of interacting with local caches rather than the DCs. So that makes the cache files and related configuration look suspicious. It also makes more sense that our earlier checks (against logs or live tests) of the Exnet interactions have failed to show any latency issues on those step. Possibly the fiddling we've already done with the cache files and cache config resolved this, but it is probably still worth passing this along to someone knowledgeable who might be able to explain what about the setup likely made everything go sideways. Otherwise, we might be facing some kind of build-up pattern where it will always look rosy after a restart and gradually degrade over time as state builds up. It might also be a good idea to bounce and clear out sssd/pam state on the weekly restarts just to protect against any possible build-up (unless we want to intentionally avoid that for now to see if it does degrade over time).

3 13

how to call SSS_NSS_GETIDBYSID from other programs?
by James Ralston 04 Oct '17

04 Oct '17

I have a storage appliance that needs local passwd/group files loaded onto it, which need to match the entries we get by using sssd's ldap_id_mapping feature. So I need some way to enumerate or synthesize passwd/group entries, for every user/group object in our domain, using LDIF dumps from AD that includes all users/groups, along with their respective objectSid attributes. We know (from experience, and from discussion on this list) that enabling enumeration in sssd is problematic, so that's out. I could just issue individual getpwnam()/getgrnam() calls for every user/group object, and let sssd synthesize the entries. But this would require careful tuning of sssd's cache configuration options to avoid significant delays, and even then, this would pound our AD domain controllers with thousands and thousands of lookup requests every time we regenerate the synthesized passwd/group files (which will probably be hourly). From digging around in the sssd source code, I see that sssd has a SSS_NSS_GETIDBYSID API call that looks to be exactly what I need. But it's not clear to me whether that's a public or private API, and additionally, it looks like I'd be limited to C for my implementation, as I see no other language bindings for those functions. Has anyone already rolled (Python, Ruby, Perl, et. al.) bindings for sssd's API calls, specifically the ID-SID mapping calls? One potential option would be to just re-implement sssd's id mapping code in Python. I could "cheat" in our implementation, because I know that the only options that vary across our domains are (ldap_idmap_range_max, ldap_idmap_range_min, ldap_idmap_range_size). But re-implementation opens the door for a subtle error that would cause my mapping code to return different results from sssd in some corner cases, which I definitely don't want. So leveraging sssd's SSS_NSS_GETIDBYSID API call would be best… if that's possible. Another option would be to bypass the API and talk directly to the NSS responder via its listening socket, which is easy enough to do in other languages. But this would require me to speak the protocol exactly the way sssd expects, and any API changes would break my code. Thoughts? Suggestions?

3 6

Unable to get ldap_tls_reqcert to work
by Jeff White 03 Oct '17

03 Oct '17

I'm attempting to enable LDAP server TLS certificate validation with "ldap_tls_reqcert = demand". However, when I set that value to anything other than "never", sssd does not work. By that I mean sssd will start as normal but no ID lookups are successful and I see "Input/output error" in the log. This occurs regardless of what CA certificate chain I give it (via ldap_tls_cacert). I have even tried using a known working chain that I use to access yum repos which uses TLS certificates from the same CA as our Active Directory. Any ideas? libsss_sudo-1.14.0-43.el7_3.11.x86_64 libsss_autofs-1.14.0-43.el7_3.11.x86_64 sssd-proxy-1.14.0-43.el7_3.11.x86_64 sssd-ad-1.14.0-43.el7_3.11.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 libsss_nss_idmap-1.14.0-43.el7_3.11.x86_64 sssd-krb5-common-1.14.0-43.el7_3.11.x86_64 sssd-ldap-1.14.0-43.el7_3.11.x86_64 libsss_idmap-1.14.0-43.el7_3.11.x86_64 python-sssdconfig-1.14.0-43.el7_3.11.noarch sssd-client-1.14.0-43.el7_3.11.x86_64 sssd-common-pac-1.14.0-43.el7_3.11.x86_64 sssd-krb5-1.14.0-43.el7_3.11.x86_64 sssd-ipa-1.14.0-43.el7_3.11.x86_64 sssd-common-1.14.0-43.el7_3.11.x86_64 -- Jeff White HPC Systems Engineer Information Technology Services - WSU

5 9

list archives?
by Galen Johnson 02 Oct '17

02 Oct '17

Hey, Where are the list archives? I went to lists.fedorahosted.org but I ended up on 2 different sites that wanted me to sign-up/login and neither worked. thanks =G=

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2017