sssd-users August 2018

sssd-users@lists.fedorahosted.org

22 participants
26 discussions

concerning "ldap_idmap_range_size"
by Lawrence Kearney 29 Aug '18

29 Aug '18

I have a question concerning values for the the "ldap_idmap_range_size" directive. I'm aware that v1.13.4 or better of the daemon supports multiple slices for the same domain. My question goes to earlier versions of the daemon that do not, "and" the v1.13.4 or better versions of the daemon that do. In environments that have high RID values (>750,000), what disadvantages are there to setting the value of the "ldap_idmap_range_size" directive to values above 1,000,000 to accommodate extraordinary large RID values. My common sense says the computational tax would be too high for a host to be sustainable, but I wanted to ask. So, in environments where I might want to have slice capacity > 200,000, what are the concerns, best practices, and briefly, why? Many thanks -- Lawrence Kearney

2 2

AD computer password renewal failing
by John Beranek 23 Aug '18

23 Aug '18

Hi, I was just looking in our Active Directory for computer account for CentOS 6 and 7 servers, and was surprised that the pwdLastSet value for accounts was many months in the past. So, I took a test CentOS 7 server and set the debug_level up to 7. What I found was the following (redacted internal details): (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [be_ptask_execute] (0x0400): Task [EXAMPLE machine account password renewal]: executing task, timeout 60 seconds (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [child_sig_handler] (0x1000): Waiting for child [186603]. (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [child_sig_handler] (0x0020): child [186603] failed with status [3]. (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [read_pipe_handler] (0x0400): EOF received, client finished (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [ad_machine_account_password_renewal_done] (0x1000): --- adcli output start--- * Found realm in keytab: EXAMPLE.COM * Found computer name in keytab: pal062-dev * Found service principal in keytab: cifs/srv062-dev * Found service principal in keytab: cifs/srv062-dev.EXAMPLE.COM * Using fully qualified name: srv062-dev.EXAMPLE.COM * Using domain name: EXAMPLE.COM * Calculated computer account name from fqdn: SRV062-DEV * Using domain realm: EXAMPLE.COM * Sending netlogon pings to domain controller: cldap://10.20.30.100 * Received NetLogon info from: dc03.EXAMPLE.COM * Wrote out krb5.conf snippet to /tmp/adcli-krb5-UWvCeO/krb5.d/adcli-krb5-conf-9dw0Is ! Couldn't get kerberos ticket for machine account: SRV062-DEV: Keytab contains no suitable keys for SRV062-DEV$(a)EXAMPLE.COM adcli: couldn't connect to EXAMPLE.COM domain: Couldn't get kerberos ticket for machine account: SRV062-DEV: Keytab contains no suitable keys for SRV062-DEV$(a)EXAMPLE.COM ---adcli output end--- (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [be_ptask_done] (0x0400): Task [EXAMPLE machine account password renewal]: finished successfully (Thu Aug 23 17:57:45 2018) [sssd[be[EXAMPLE]]] [be_ptask_schedule] (0x0400): Task [EXAMPLE machine account password renewal]: scheduling task 60 seconds from last execution time [1535043525] The server's keytab has: Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 23 03/15/2018 09:59:33 srv062-dev$(a)EXAMPLE.COM 23 03/15/2018 09:59:33 srv062-dev$(a)EXAMPLE.COM 23 03/15/2018 09:59:33 srv062-dev$(a)EXAMPLE.COM 23 03/15/2018 09:59:33 srv062-dev$(a)EXAMPLE.COM 23 03/15/2018 09:59:33 srv062-dev$(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev.ad.pvt(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev.ad.pvt(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev.ad.pvt(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev.ad.pvt(a)EXAMPLE.COM 23 03/15/2018 09:59:33 cifs/srv062-dev.ad.pvt(a)EXAMPLE.COM Any ideas what could be wrong? Is it potentially because the keytab has srv062-dev$ and not SRV062-DEV$ ? Cheers, John -- John Beranek To generalise is to be an idiot. http://redux.org.uk/ -- William Blake

2 4

SSSD 2.0, local auth, and sssd_krb5_localauth_plugin
by Pat Riehecky 23 Aug '18

23 Aug '18

I've been looking into using the sssd_krb5_localauth_plugin as part of a migration path off of pam_krb5. However, I noticed that local provider appears to be leaving SSSD 2.0. I've not fully gotten my head around how all the parts are inter-related, but is there a plan for what to do with this plugin's use of local IDs? Pat -- Pat Riehecky Fermi National Accelerator Laboratory www.fnal.gov www.scientificlinux.org

2 1

host principal generated by "net" command vs "adcli/realm"
by Ondrej Valousek 23 Aug '18

23 Aug '18

Hi list, I have noticed that there is a slight difference in host principals when joining to AD using "net" command or via "adcli/realm". All commands generates the short version (i.e. as per "hostname -s") in capital letters in AD, but in local kerberos keytab, the "net" command generates all "host/" principals lower case, but "adcli" generates then upper case - which renders kerberized access via ssh unusable in case we specify hostname without the domain suffix: # cat /etc/hostname Myshostname Question, why do you convert the short hostname to uppercase? Why is sshd so picky about lower/upper cases for the host principals in Kerberos keytab? Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

2 1

SSSD setup for authentication against AD using LDAP provider
by Andre Piwoni 22 Aug '18

22 Aug '18

There does not seem to be much documentation how to make authentication work without any extras. All I need is a simple non-anonymous bind using provided credentials without any searches. My understanding is that I don't need NSS for this only PAM with auth_provider set to ldap. However, without id_provider set in sssd.conf SSSD does not start at all. This has been reported as a bug and supposedly have been fixed before SSSD 1.16.0 version that I'm using. I have tried to set id_provider to none but I'm getting some indications in logs that id provider is needed. Is it possible to do simple non-anonymous bind without anything extra, not even chpass? Here's domain log: [sssd[be[fqdn_domainname]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=username@fqdn_domainname] [sssd[be[fqdn_domainname]]] [sss_domain_get_state] (0x1000): Domain fqdn_domainname is Active [sssd[be[fqdn_domainname]]] [dp_attach_req] (0x0400): DP Request [Initgroups #1]: New request. Flags [0x0001]. [sssd[be[fqdn_domainname]]] [dp_attach_req] (0x0400): Number of active DP request: 1 [sssd[be[fqdn_domainname]]] [sss_domain_get_state] (0x1000): fqdn_domainname is Active [sssd[be[fqdn_domainname]]] [dp_find_method] (0x0100): Target [id] is not initialized [sssd[be[fqdn_domainname]]] [_dp_req_recv] (0x0400): DP Request [Initgroups #1]: Receiving request data. [sssd[be[fqdn_domainname]]] [dp_req_reply_gen_error] (0x0080): DP Request [Initgroups #1]: Finished. Target is not supported with this configuration. [sssd[be[fqdn_domainname]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:3::fqdn_domainname:name=username@fqdn_domainname] from reply table Why initgroups would be called for authentication? Can I or should I disable it and how? Why target [id] is not initialized? I have disabled id provider (see below). Here's relevant PAM log: [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE [pam_print_data] (0x0100): domain: not set [sssd[pam]] [pam_print_data] (0x0100): user: username [sssd[pam]] [pam_print_data] (0x0100): service: pgpool [pam_print_data] (0x0100): logon name: username [pam_initgr_check_timeout] (0x4000): User [username] not found in PAM cache [cache_req_set_plugin] (0x2000): CR #1: Setting "Initgroups by name" plugin [cache_req_send] (0x0400): CR #1: New request 'Initgroups by name' [cache_req_process_input] (0x0400): CR #1: Parsing input name [username] [sss_parse_name_for_domains] (0x0200): name 'username' matched without domain, user is username [cache_req_set_name] (0x0400): CR #1: Setting name [username] [cache_req_select_domains] (0x0400): CR #1: Performing a multi-domain search [cache_req_search_domains] (0x0400): CR #1: Search will bypass the cache and check the data provider [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain fqdn_domainname type POSIX is valid [cache_req_set_domain] (0x0400): CR #1: Using domain [fqdn_domainname] [cache_req_prepare_domain_data] (0x0400): CR #1: Preparing input data for domain [fqdn_domainname] rules [cache_req_search_send] (0x0400): CR #1: Looking up username@fqdn_domainname [cache_req_search_ncache] (0x0400): CR #1: [username@fqdn_domainname] is not present in negative cache [cache_req_search_dp] (0x0400): CR #1: Looking up [fqdn_domainname] in data provider [sss_dp_issue_request] (0x0400): Issuing request for [0x55a33da304c0:3:username@fqdn_domainname@fqdn_domainname] [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [fqdn_domainname][0x3][BE_REQ_INITGROUPS][name=username@fqdn_domainname:-] [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [0x55a33da304c0:3:username@fqdn_domainname@fqdn_domainname] [sss_dp_get_reply] (0x0100): Data Provider does not support this operation. [cache_req_common_dp_recv] (0x0040): CR #1: Data Provider Error: 3, 5, Failed to get reply from Data Provider [cache_req_common_dp_recv] (0x0400): CR #1: Due to an error we will return cached data [pam_reply] (0x0200): pam_reply called with result [10]: User not known to the underlying authentication module. Why Data Provider does not support this operation? Verification that only auth provider is enabled: [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [id] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [ldap] provider for [auth] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [access] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [chpass] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [sudo] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [autofs] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [selinux] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [hostid] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [subdomains] [sssd[be[fqdn_domainname]]] [dp_load_configuration] (0x0100): Using [none] provider for [session] Andre Piwoni

2 5

HowTo Handle an AD User rename?
by Pete Klukowski 20 Aug '18

20 Aug '18

Hello, We have SSSD running on CentOS 7.3 communicating with Active Directory (Server 2008 R2). An AD account (e.g., msmith1) that had been synch'd with the SSSD service and was working fine (both "id msmith1(a)DOMAIN.COM" and "getent passwd msmith1" succeeded) has been renamed to msmith. Now on the CentOS/SSSD server if we, as root, su - to the newly renamed msmith account we get messages such as, cannot find name for user ID 151XXXXX17 and I have no name! (see below): /usr/bin/id: cannot find name for user ID 151XXXXX17 /usr/bin/id: cannot find name for user ID 151XXXXX17 [I have no name!@server ~] Similarly, running id msmith results in: id: msmith: no such user Lastly, unlike all the other sync'd /home/userid@DOMAIN .COM directories, the owner of the /home/msmith directory on the CentOS/SSSD server shows 151XXXXX17 as the owner rather than msmith(a)DOMAIN.COM. Can anyone please provide specific steps on how to re-create a working /home/msmith(a)DOMAIN.COM on the CentOS/SSSD server? FWIW, there is nothing of value in the current directory. Thanks

2 1

Announcing SSSD 2.0
by Jakub Hrozek 14 Aug '18

14 Aug '18

SSSD 2.0 =========== The SSSD team is proud to announce the release of version 2.0 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback ———— Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- This release removes or deprecates functionality from SSSD, therefore the SSSD team decided it was time to bump the major version number. The sssd-1-16 branch will be still supported (most probably even as a LTM branch) so that users who rely on any of the removed features can either migrate or ask for the features to be readded. Except for the removed features, this release contains a reworked internal IPC and a new default storage back end for the KCM responder. Platform support removal ^^^^^^^^^^^^^^^^^^^^^^^^ * Starting with SSSD 2.0, upstream no longer supports RHEL-6 and its derivatives. Users of RHEL-6 are encouraged to stick with the sssd-1-16 branch. Removed features ^^^^^^^^^^^^^^^^ * The Python API for managing users and groups in local domains (``id_provider=local``) was removed completely. The interface had been packaged as module called ``pysss.local`` * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath was adding needless additional complexity for little performance gain and was rarely used. * The ``ldap_groups_use_matching_rule_in_chain`` and ``ldap_initgroups_use_matching_rule_in_chain`` options and the code that evaluated them was removed. Neither of these options provided a significant performance benefit and the code implementing these options was complex and rarely used. Deprecated features ^^^^^^^^^^^^^^^^^^^ * The local provider (``id_provider=local``) and the command line tools to manage users and groups in the local domains, such as ``sss_useradd`` is not built by default anymore. There is a configure-time switch ``--enable-local-domain`` you can use to re-enable the local domain support. However, upstream would like to remove the local domain completely in a future release. * The ``sssd_secrets`` responder is not packaged by default. The responder was meant to provide a REST API to access user secrets as well as a proxy to Custodia servers, but as Custodia development all but stopped and the local secrets handling so far didn't gain traction, we decided to not enable this code by default. This also means that the default SSSD configuration no longer requires libcurl and http-parser. Changed default settings ^^^^^^^^^^^^^^^^^^^^^^^^ * The ``ldap_sudo_include_regexp`` option changed its default value from ``true`` to ``false``. This means that wild cards in the ``sudoHost`` LDAP attribute are no longer supported by default. The reason we changed the default was that the wildcard was costly to evaluate on the LDAP server side and at the same time rarely used. New features ^^^^^^^^^^^^ * The KCM responder has a new back end to store credential caches in a local database. This new back end is enabled by default and actually uses the same storage as the ``sssd-secrets`` responder had used, so the switch from sssd-secrets to this new back end should be completely seamless. The ``sssd-secrets`` socket is no longer required for KCM to operate. * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option ``pam_p11_allowed_services``. Packaging Changes ----------------- * The ``sss_useradd``, ``sss_userdel``, ``sss_usermod``, ``sss_groupadd``, ``sss_groupdel``, ``sss_groupshow`` and ``sss_groupmod`` binaries and their manual pages are no longer packaged by default unless ``--enable-local-provider`` is selected. * The sssd_secrets responder is no longer packaged by default unless ``--enable-secrets-responder`` is selected. * The new internal IPC mechanism uses several private libraries that need to be packaged - ``libsss_sbus.so``, ``libsss_sbus_sync.so``, ``libsss_iface.so``, ``libsss_iface_sync.so``, ``libifp_iface.so`` and ``libifp_iface_sync.so`` * The new KCM ccache back end relies on a private library ``libsss_secrets.so`` that must be packaged in case either the KCM responder or the secrets responder are enabled. Documentation Changes --------------------- * The ``ldap_groups_use_matching_rule_in_chain`` and ``ldap_initgroups_use_matching_rule_in_chain`` options were removed. * The ``ldap_sudo_include_regexp`` option changed its default value from ``true`` to ``false``. Known issues ------------ * https://pagure.io/SSSD/sssd/issue/3807 - The sbus codegen script relies on "python" which might not be available on all distributions * There is a script that autogenerates code for the internal SSSD IPC. The script happens to call "python" which is not available on all distributions. Patching the ``sbus_generate.sh`` file to call e.g. python3 explicitly works around the issue Tickets Fixed ------------- * `3717 <https://pagure.io/SSSD/sssd/issue/3717>`_ - Don't package sssd-secrets by default * `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a new back end that would write to the secrets database directly * `3530 <https://pagure.io/SSSD/sssd/issue/3530>`_ - Remove CONFDB_DOMAIN_LEGACY_PASS * `3515 <https://pagure.io/SSSD/sssd/issue/3515>`_ - Disable host wildcards in sudoHost attribute (ldap_sudo_include_regexp=false) * `3494 <https://pagure.io/SSSD/sssd/issue/3494>`_ - Remove the special-case for RFC2307bis with zero nesting level * `3493 <https://pagure.io/SSSD/sssd/issue/3493>`_ - Remove the pysss.local interface * `3492 <https://pagure.io/SSSD/sssd/issue/3492>`_ - Remove support for ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain * `3304 <https://pagure.io/SSSD/sssd/issue/3304>`_ - Only build the local provider conditionally * `2926 <https://pagure.io/SSSD/sssd/issue/2926>`_ - Make list of local PAM services allowed for Smartcard authentication configurable Detailed Changelog ------------------ * Amit Kumar (1): * providers: disable ldap_sudo_include_regexp by default * Fabiano Fidêncio (19): * man/sss_ssh_knownhostsproxy: fix typo pubkeys -> pubkey * providers: drop ldap_{init,}groups_use_matching_rule_in_chain support * ldap: remove parallel requests from rfc2307bis * tests: adapt common_dom to files_provider * tests: adapt test_sysdb_views to files provider * tests: adapt sysdb-tests to files_provider * tests: adapt sysdb_ssh tests to files provider * tests: adapt auth-tests to files provider * tests: adapt tests_fqnames to files provider * sysdb: sanitize the dn on cleanup_dn_filter * sysdb: pass subfilter and ts_subfilter to sysdb_search_*_by_timestamp() * tests: adapt test_ldap_id_cleanup to files provider * tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_certmap * tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_domain_resolution_order_ * tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_subdomains * tests: remove LOCAL_SYSDB_FILE reference from common_dom * local: build local provider conditionally * pysss: fix typo in comment * pysss: remove pysss.local * Jakub Hrozek (55): * Updating the version to track 1.16.4 development * src/tests/python-test.py is GPLv3+ * src/tests/intg/util.py is licensed under GPLv3+ * src/tests/intg/test_ts_cache.py is licensed under GPLv3+ * src/tests/intg/test_sudo.py is licensed under GPLv3+ * src/tests/intg/test_sssctl.py is licensed under GPLv3+ * src/tests/intg/test_ssh_pubkey.py is licensed under GPLv3+ * src/tests/intg/test_session_recording.py is licensed under GPLv3+ * src/tests/intg/test_secrets.py is licensed under GPLv3+ * src/tests/intg/test_pysss_nss_idmap.py is licensed under GPLv3+ * src/tests/intg/test_pam_responder.py is licensed under GPLv3+ * src/tests/intg/test_pac_responder.py is licensed under GPLv3+ * src/tests/intg/test_netgroup.py is licensed under GPLv3+ * src/tests/intg/test_memory_cache.py is licensed under GPLv3+ * src/tests/intg/test_local_domain.py is licensed under GPLv3+ * src/tests/intg/test_ldap.py is licensed under GPLv3+ * src/tests/intg/test_kcm.py is licensed under GPLv3+ * src/tests/intg/test_infopipe.py is licensed under GPLv3+ * src/tests/intg/test_files_provider.py is licensed under GPLv3+ * src/tests/intg/test_files_ops.py is licensed under GPLv3+ * src/tests/intg/test_enumeration.py is licensed under GPLv3+ * src/tests/intg/sssd_passwd.py is licensed under GPLv3+ * src/tests/intg/sssd_nss.py is licensed under GPLv3+ * src/tests/intg/sssd_netgroup.py is licensed under GPLv3+ * src/tests/intg/sssd_ldb.py is licensed under GPLv3+ * src/tests/intg/sssd_id.py is licensed under GPLv3+ * src/tests/intg/sssd_group.py is licensed under GPLv3+ * src/tests/intg/secrets.py is licensed under GPLv3+ * src/tests/intg/ldap_local_override_test.py is licensed under GPLv3+ * src/tests/intg/ldap_ent.py is licensed under GPLv3+ * src/tests/intg/krb5utils.py is licensed under GPLv3+ * src/tests/intg/kdc.py is licensed under GPLv3+ * src/tests/intg/files_ops.py is licensed under GPLv3+ * src/tests/intg/ent_test.py is licensed under GPLv3+ * src/tests/intg/ent.py is licensed under GPLv3+ * src/tests/intg/ds_openldap.py is licensed under GPLv3+ * src/tests/intg/ds.py is licensed under GPLv3+ * src/config/setup.py.in is licensed under GPLv3+ * src/config/SSSDConfig/ipachangeconf.py is licensed under GPLv3+ * Explicitly add GPLv3+ license blob to several files * Updating the version before the 2.0 release * TESTS: the sys package was used but not imported * TESTS: Remove tests database in teardown * TESTS: Properly set argv[0] when starting the secrets responder * KCM: Move a confusing DEBUG message * KCM: Fix a typo * UTIL: Add libsss_secrets * SECRETS: Use libsss_secrets * KCM; Hide the secret URL as implementation detail instead of exposing it in the JSON-marshalling API * UTIL: libsss_secrets: Add an update function * KCM: Add a new back end that uses libsss_secrets directly * TESTS: Get rid of KCM_PEER_UID * TESTS: Add tests for the KCM libsss_secrets back end * KCM: Change the default ccache storage from the secrets responder to libsecrets * BUILD: Do not build the secrets responder by default * Lukas Slebodnik (6): * krb5_locator: Make debug function internal * krb5_locator: Simplify usage of macro PLUGIN_DEBUG * krb5_locator: Fix typo in debug message * krb5_locator: Fix formatting of the variable port * krb5_locator: Use format string checking for debug function * PAM: Allow to configure pam services for Smartcards * Pavel Březina (21): * include stdarg.h directly in debug.h * pam_add_response: fix talloc context * sss_ptr_hash: add sss_ptr_get_value to make it useful in delete callbacks * sss_ptr_list: add linked list of talloc pointers * sbus: move sbus code to standalone library * sbus: add sbus sssd error codes * sbus: add new implementation * sbus: build new sbus implementation * sbus: disable generating old api * sbus: fix indirect includes in sssd * sbus: add sss_iface library * sbus: convert monitor * sbus: convert backend * sbus: convert responders * sbus: convert proxy provider * sbus: convert infopipe * sbus: convert sssctl * sbus: remove old implementation * sbus: add new internal libraries to specfile * sbus: make tests run * tests: disable parse_inp_call_dp, parse_inp_call_attach in responder-get-domains-tests * amitkuma (1): * confdb: Remove CONFDB_DOMAIN_LEGACY_PASS

1 0

smartcard authentication directly against AD (no IPA)?
by James Ralston 14 Aug '18

14 Aug '18

Is anyone using sssd to perform smartcard authentication directly against Microsoft Active Directory, without using IPA? If so, what did you have to do in order to get it working? In our AD domain, the userPrincipalName attribute contains the address of what I assume is the CN of the smartcard that corresponds to that user. I don't see any other attributes set in AD that look like they're related to smartcard authentication (i.e., no certificates), so everything must drive from the userPrincipalName attribute. (We use a one-smartcard-per-account model, so we have no altSecurityIdentities attributes.) Our Windows guys don't know for certain, but I believe that the smartcard authentication employs PKINIT. (I don't see how else it would work, honestly.) Pretty much the only sssd configuration options I see related to smartcard authentication are pam_cert_auth and pam_cert_db_path. Is it really the case that all I have to do is set pam_cert_auth to "true" and smartcard logins will just magically work, because sssd will look at the userPrincipalName attribute in AD and just Do The Right Thing? I mean, it can't be that easy, can it? :-P Thanks in advance for any advice or tips.

3 3

Announcing SSSD 1.16.3
by Jakub Hrozek 12 Aug '18

12 Aug '18

SSSD 1.16.3 =========== The SSSD team is proud to announce the release of version 1.16.3 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback ———— Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- New Features ^^^^^^^^^^^^ * The ``kdcinfo`` files that SSSD uses to inform libkrb5 about which KDCs were discovered for a Kerberos realm used to be only generated for the joined domain, not the trusted domains. Starting with this release, the ``kdcinfo`` files are generated automatically also for trusted domains in setups that use ``id_provider=ad`` and IPA masters in a trust relationship with an AD domain. * The SSSD Kerberos locator plugin which processes the kdcinfo files and actually tells libkrb5 about the available KDCs can now process multiple address if SSSD generates more than one. At the moment, this feature is only used on IPA clients (see below). Please see the ``sssd_krb5_locator_plugin(8)`` manual page for more information about the Kerberos locator plugin. * On IPA clients, the AD DCs or the AD site which should be used to authenticate users can now be listed in a subdomain section. Please see `the feature design page <https://docs.pagure.org/SSSD.sssd/design_pages/kdcinfo_improvements.html>`_ or the section "trusted domains configuration" for more details. Notable bug fixes ^^^^^^^^^^^^^^^^^ * SECURITY: The permissions on ``/var/lib/sss/pipes/sudo`` were set so that anyone could read anyone else's sudo rules. This was considered an information leak and assigned CVE-2018-10852 (#3766) * IMPORTANT: The 1.16.2 release was storing the cached passwords without a salt prefix string. This bug was fixed in this release, but any password hashes generated by 1.16.2 are incompatible with the hashes generated by 1.16.3. The effect is that upgrade from 1.16.2 to 1.16.3 should be done when the authentication server is reachable so that the first authentication after the upgrade fix the cached password. * The ``sss_ssh`` proces leaked file descriptors when converting more than one x509 certificate to SSH public key (#3794) * SSSD, when configured with ``id_provider=ad`` was using too expensive LDAP search to find out whether the required POSIX attributes were replicated to the Global Catalog. Instead, SSSD now consults the Partial Attribute Set, which is much more effective (#3755) * The PAC responder is now able to process Domain Local in case the PAC uses SID compression. Typicaly this is the case with Windows Server 2012 and newer (#3767) * Some versions of OpenSSH (e.g. the one shipped in RHEL-7.5) would close the pipe towards ``sss_ssh_authorizedkeys`` when the matching key is found before the rest of the output is read. The ``sss_ssh_authorizedkeys`` helper was not handling this behaviour well and would exit with SIGPIPE, which also meant the public key authentication failed (#3747) * User lookups no longer fail if user's e-mail address conflicts with another user's fully qualified name (#3607) * The ``override_shell`` and ``override_homedir`` options are no longer applied to entries from the files domain. (#3758) * Several bugs related to the FleetCommander integration were fixed (#3773, #3774) * The grace logins with an expired password when authenticating against certain newer versions of the 389DS/RHDS LDAP server did not work (#3597) * Whitespace around netgroup triple separator is now stripped * The ``sss_ssh_knownhostproxy`` utility can now print the host key without proxying the connection. * Due to an overly restrictive check, the fast in-memory cache was sometimes skipped, which caused a high load on the ``sssd_nss`` process (#3776). Packaging Changes ----------------- * The python2 bindings are not built by default on Fedora 29 or newer * The sssd-secrets responder is now packaged in the sssd-kcm subpackage and might be removed in a future release Documentation Changes --------------------- * ``sss_ssh_knownhostsproxy`` has a new option `-k/--print`. Tickets Fixed ------------- * `3796 <https://pagure.io/SSSD/sssd/issue/3796>`_ - The IPA selinux provider can return an error if SELinux is completely disabled * `3794 <https://pagure.io/SSSD/sssd/issue/3794>`_ - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key * `3791 <https://pagure.io/SSSD/sssd/issue/3791>`_ - The cached password does not store the salt prefix * `3778 <https://pagure.io/SSSD/sssd/issue/3778>`_ - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails * `3777 <https://pagure.io/SSSD/sssd/issue/3777>`_ - If access check for a privileged pipe fails, the responder loops indefinitely * `3776 <https://pagure.io/SSSD/sssd/issue/3776>`_ - Spurious check in the sssd nss memcache can cause the memory cache to be skipped * `3774 <https://pagure.io/SSSD/sssd/issue/3774>`_ - Desktop Profile: The 10th policy is producing a wrong file name * `3773 <https://pagure.io/SSSD/sssd/issue/3773>`_ - SSSD bails out saving desktop profiles in case an invalid profile is found * `3767 <https://pagure.io/SSSD/sssd/issue/3767>`_ - Groups go missing with PAC enabled in sssd * `3766 <https://pagure.io/SSSD/sssd/issue/3766>`_ - CVE-2018-10852: information leak from the sssd-sudo responder * `3758 <https://pagure.io/SSSD/sssd/issue/3758>`_ - override_homedir should not apply to the files provider * `3755 <https://pagure.io/SSSD/sssd/issue/3755>`_ - The search filter for detecting POSIX attributes in global catalog is too broad and can cause a high load on the servers * `3754 <https://pagure.io/SSSD/sssd/issue/3754>`_ - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries * `3747 <https://pagure.io/SSSD/sssd/issue/3747>`_ - sss_ssh_authorizedkeys exits abruptly if SSHD closes its end of the pipe before reading all the SSH keys * `3652 <https://pagure.io/SSSD/sssd/issue/3652>`_ - kdcinfo doesn't get populated for other domains * `3607 <https://pagure.io/SSSD/sssd/issue/3607>`_ - Handle conflicting e-mail addresses more gracefully * `3597 <https://pagure.io/SSSD/sssd/issue/3597>`_ - sssd doesn't allow user with expired password to login when PasswordgraceLimit set * `3596 <https://pagure.io/SSSD/sssd/issue/3596>`_ - A combination of the same qualified and unqualified sudoUser causes Error: 17: File exists * `3542 <https://pagure.io/SSSD/sssd/issue/3542>`_ - Get host key without proxying connection * `3475 <https://pagure.io/SSSD/sssd/issue/3475>`_ - Full information regarding priority of lookup of principal in keytab not in man page * `3291 <https://pagure.io/SSSD/sssd/issue/3291>`_ - RFE: sssd in cross realm trust configuration should be use AD KDC from a list or site defined in the config file Detailed Changelog ------------------ * Alexander Bokovoy (2): * ipa provider: always use a special keytab to talk to a trusted DC * ipa provider: expand search base to cover trusted domain objects * Alexey Sheplyakov (1): * nss: skip incomplete groups instead of bailing out * Amit Kumar (1): * Responder: simplify if-else structure in sss_dp_get_account_msg() * Fabiano Fidêncio (18): * intg: Do not hardcode nsslibdir * files: do not apply override_homedir to files provider * tests: add override_homedir tests for files provider * files: do not apply override_shell to files provider * tests: add override_shell tests for files provider * util: add is_files_provider() helper * files: make use of is_files_provider() helper * cache_req: keep the files provider as the first domain to be searched * tests: add basic tests for cache_req_domain_new_list_from_domain_resolution_order() * tests: add a test to ensure the output_fqnames is false for files provider * deskprofile: don't bail if we fail to save one profile * sdap: respect passwordGracelimit * deskprofile: fix a typo in _get_filename_path() * tests: add tests for ipa_deskprofile_get_filename_path() * util: introduce sss_ssh_print_pubkey() * ssh: make use of sss_ssh_print_pubkey() * sss_ssh_knownhostsproxy: add option to only print the pubkey * nss: remove unused label * Jakub Hrozek (38): * Bumping the version to track the 1.16.3 development * TESTS: Extend the schema with sshPublicKey attribute * TESTS: Allow adding sshPublicKey for users * TESTS: Add a basic SSH responder test * SSH: Do not exit abruptly if SSHD closes its end of the pipe before reading all the SSH keys * TESTS: Add a helper binary that can trigger the SIGPIPE to authorizedkeys * TESTS: Add a regression test for SIGHUP handling in sss_ssh_authorizedkeys * Revert "LDAP/IPA: add local email address to aliases" * util: Remove the unused function is_email_from_domain * TESTS: Allow storing e-mail address for users * TESTS: Add regression test for looking up users with conflicting e-mail addresses * AD/LDAP: Do not misuse the ignore_mark_offline to check if a connection needs to be checked for POSIX attribute presence * MAN: Remove outdated notes from the re_expression description * MAN: Document the re_expression needed to suport @-signs in the groupnames * SUDO: Create the socket with stricter permissions * AD: expose the helper function to format the site DNS query * RESOLV: Add a resolv_hostport_list request * KRB5/IPA/AD: Add a utility function to create a krb5_service instance * KRB5: Allow writing multiple addresses to the kdcinfo plugin * IPA: Add the options that the IPA subdomains code will read for trusted domains on the client * IPA: Populate kdcinfo files on trust clients with configured AD servers * MAN: Document the options available for AD trusted domains * SDAP: Detect schemaNamingContext from the rootDSE * AD: Add Global Catalog usability check in subdomain code by looking at the schema * AD: Remove the legacy check from ad_get_account_domain_posix_check request * LDAP/AD: Remove the legacy POSIX check from user, group and enumeration searches * LDAP: Remove the legacy POSIX check itself * sudo testcli: Use hand-crafted JSON for output so that the test CLI is usable in tests * TESTS: Load the sudo schema in the default OpenLDAP test instance and create ou=sudoers * TESTS: Add API to add sudo rules in tests * TESTS: Add a simple sudo LDAP test * SUDO: Don't save duplicates when saving qualified names * crypto: Silence a Coverity warning in OpenSSL version of sss_hmac_sha1() * crypto: Make one condition more defensive in NSS version of sss_hmac_sha1() * SDAP: Improve a confusing DEBUG message when initgroups search matches multiple entries * RESP: Terminate client connection if the permissions check on the priv pipe fails * SELINUX: Also call is_selinux_enabled as a check for selinux child * P11: Don't return int failure from a bool function * Josef Cejka (1): * Strip whitespaces in netgroup triple. * Lukas Slebodnik (15): * sss_seed: Remove unused parameter from seed_domain_user_info * SUDO: Fix running in unprivileged responder * SUDO: Root should be able to read/write sssd-sudo socket * SPEC: Drop unnecessary check for minor version of el7 * test_ssh_client: Do not ignore failure from read * SPEC: Move openssl deps away from unit tests deps * PYTHON: Avoid warnings with python3.7 * SPEC: Move secrets responder to the package sssd-kcm * SPEC: Do not build python2 bindings on latest distros * BUILD: Replace also runstatedir in templates * SYSTEMD: Allow to use "/run" in ListenStream * Revert "Revert "CRYPTO: Suppress warning Wstringop-truncation"" * CRYPTO: Save prefix in s3crypt_sha512 * crypto-tests: Add unit test for s3crypt_sha512 * SSS_CERT: Close file descriptors after executing p11_child * Michal Židek (1): * Revert "CRYPTO: Suppress warning Wstringop-truncation" * Stanislav Levin (1): * Fix "test-find-uid" and "find_uid-tests" tests * Sumit Bose (14): * krb5 locator: add support for multiple addresses * krb5 locator: fix IPv6 support * krb5 locator: make plugin more robust * krb5 locator: add unit tests * AD/IPA: Create kdcinfo file for sub-domains * krb5: refactor removal of krb5info files * krb5_common: add callback only once * data provider: run offline callbacks only once * utils: add libsss_child dependency to libsss_cert * AD: consider resource_groups in PAC as well * utils: make create_ipa_preauth_indicator() public as create_preauth_indicator() * PAM: create pre-auth indicator file * MC: Remove check if record is in the mapped address space * tests: fix sss_nss_idmap-tests * amitkumar50 (1): * MAN: Give information regarding priority of ldap lookup

1 0

1.16.2 test failure: sss_nss_idmap-tests
by Andreas Hasenack 09 Aug '18

09 Aug '18

Hi, I'm building 1.16.2 with just https://pagure.io/SSSD/sssd/c/a2cc554f438c220b3cc73eb93879dd87795a86cd?bran… applied (without it, it doesn't build in Ubuntu currently) and I'm seeing this test failure: [==========] Running 2 test(s). [ RUN ] test_getsidbyname [ ERROR ] --- 0x2 != 0 [ LINE ] --- ../src/tests/cmocka/sss_nss_idmap-tests.c:121: error: Failure! [ FAILED ] test_getsidbyname [ RUN ] test_getorigbyname [ ERROR ] --- 0x2 != 0 [ LINE ] --- ../src/tests/cmocka/sss_nss_idmap-tests.c:140: error: Failure! [ FAILED ] test_getorigbyname [==========] 2 test(s) run. [ PASSED ] 0 test(s). [ FAILED ] 2 test(s), listed below: [ FAILED ] test_getsidbyname [ FAILED ] test_getorigbyname 2 FAILED TEST(S) FAIL sss_nss_idmap-tests (exit status: 2) I tried with samba 4.7.6 and 4.8.2 installed, and also with --with-smb-idmap-interface-version 5 and 6, same result. Debian is at 1.16.2 and the tests pass there just fine, so I think I'm looking at some dependency problem. ldb is 1.3.1 tdb is 1.3.15 Any pointers? Maybe a way to run just that test, so I can add debugging statements? Thanks!

4 9

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2018