January 2020 - sssd-users - Fedora mailing-lists

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

ID Views for IPA ID Views for AD users inconsistent resolution
by Louis Abel 01 Aug '21

01 Aug '21

I didn't get a response in #sssd, so I figured I'll try here at the mail list. # rpm -q sssd ipa-server sssd-1.16.0-19.el7_5.5.x86_64 ipa-server-4.5.4-10.el7_5.3.x86_64 I've been scratching my head trying to resolve this particular issue. I'm having issues with AD users where when they login, they'll get the UID/GID assigned in the ID views correctly, but only some of the time. Other times, they won't get the id view assigned to them. This is all done in the default trust view. What makes this issue even more interesting is that out of my 6 domain controllers, sometimes it'll be one server out of the six that does it, sometimes it's two. But it's never the same ones, so it's difficult to track the particular issue down. What's even more interesting is this is not occurring with some users (like my own). I have yet to see it occur with my account or even the rest of my team's accounts. One of the things I tried to do is delete the ID views of the offending users and recreate them to no avail. I put SSSD into debug mode on the IPA servers and tried to get some relevant logs and such to try and figure this out. Below is my SSSD configuration, ldb info, and debug logs (removing private information where possible). I'm trying to determine if this is either a bug within SSSD or if this is a misconfiguration on my part. $ ldbsearch -H cache_ipa.example.com.ldb name=user.name(a)ad.example.com originalADuidNumber uidNumber originalADgidNumber gidNumber asq: Unable to register control with rootdse! # record 1 dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb originalADuidNumber: 55616902 originalADgidNumber: 55616902 uidNumber: 55616902 gidNumber: 55616902 $ ipa idoverrideuser-show "Default Trust View" user.name(a)ad.example.com Anchor to override: user.name(a)ad.example.com UID: 40001 GID: 40001 Home directory: /home/user.name Login shell: /bin/bash $ ldbsearch -H timestamps_ipa.example.com.ldb | less dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb objectCategory: user originalModifyTimestamp: 20180823172515.0Z entryUSN: 92632390 initgrExpireTimestamp: 1535133621 lastUpdate: 1535128235 dataExpireTimestamp: 1535133635 distinguishedName: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb ## DEBUG LOGS (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 32 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 32 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1080], connected[1], ops[(nil)], ldap[0x55f30a5d0f90] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [ipaanchoruuid=:SID:S-1-5-21-922099545-2851689246-2917073205-16902,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaAnchorUUID] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaOriginalUid] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 32 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): Found override for object with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [uidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x0080): Override attribute for [gidNumber] has more [2] than one value, using only the first. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [gidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [homeDirectory] with [/home/user.name] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [loginShell] with [/bin/bash] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a6819a0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a681a60 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a681a60 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [safe_original_attributes] (0x4000): Original object does not have [sshPublicKey] set. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a683c50 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a683d10 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a683d10 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [uidNumber] of entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d1c0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a68d280 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a68d280 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [cache, ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d330 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a688900 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a689320 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6893e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a688900 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a634920 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6349e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6893e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6349e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 0/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Fetching group S-1-5-21-922099545-2851689246-2917073205-20676 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 33 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 33 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 33 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 1/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_memberships_send] (0x0400): External group information still valid. ## /etc/sssd/sssd.conf [domain/ipa.example.com] cache_credentials = True krb5_store_password_if_offline = True # krb5_realm = IPA.EXAMPLE.COM ipa_domain = ipa.example.com ipa_hostname = entl01.ipa.example.com # Server Specific Settings ipa_server = entl01.ipa.example.com ipa_server_mode = True subdomain_homedir = %o fallback_homedir = /home/%u default_shell = /bin/bash id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, sudo, pam, ssh domains = ipa.example.com [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,activemq,informix,oracle,xdba,grid,dbadmin,weblogic,operator,postgres,devolog memcache_timeout = 600 homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp]

2 1

sssd-krb5, krb5_ccachedir, DIR-cache-store...
by Jostein Fossheim 15 Dec '20

15 Dec '20

We are working with several kerberos-REALMS and are trying to get our clients to store their kerberos tickets in a DIRECTORY. This seems to work nicely for clients not authenticating at login, with the following configuration set in /etc/krb5.conf. ... [libdefaults] ... default_ccache_name = DIR:/tmp/krb5cc_%{uid} ... user@server:~$ klist Ticket cache: DIR::/tmp/krb5cc_888/tkt Default principal: user@REALM Valid starting Expires Service principal 09/22/19 17:35:50 09/23/19 17:35:48 krbtgt/user@REALM Each ticket is stored in a separate file. For clients using sssd for login, I want to set up the same behavior. But when I attempt to login the system creates an "/tmp/krb5cc_${UiD}" - but here the directory don't get the excutable bit set (that is the directory get 0600-permission), and the login fails. In the man-page from Debian-buster (sssd-version: 1.16.3), there are to settings that seems to regulate this behaviour : krb5_ccachedir (string) Directory to store credential caches. All the substitution sequences of krb5_ccname_template can be used here, too, except %d and %P. The directory is created as private and owned by the user, with permissions set to 0700. Default: /tmp krb5_ccname_template (string) Location of the user's credential cache. Three credential cache types are currently supported: "FILE", "DIR" and "KEYRING:persistent". The cache can be specified either as TYPE:RESIDUAL, or as an absolute path, which implies the "FILE" type. In the template, the following sequences are substituted: [...] If the template ends with 'XXXXXX' mkstemp(3) is used to create a unique filename in a safe way. When using KEYRING types, the only supported mechanism is "KEYRING:persistent:%U", which uses the Linux kernel keyring to store credentials on a per-UID basis. This is also the recommended choice, as it is the most secure and predictable method. The default value for the credential cache name is sourced from the profile stored in the system wide krb5.conf configuration file in the [libdefaults] section. The option name is default_ccache_name. See krb5.conf(5)'s PARAMETER EXPANSION paragraph for additional information on the expansion format defined by krb5.conf. NOTE: Please be aware that libkrb5 ccache expansion template from krb5.conf(5) uses different expansion sequences than SSSD. Default: (from libkrb5) ... I have tried to both set and unset, the two parameters in question like this: krb5_ccachedir = /tmp/krb5cc_%U krb5_ccname_template = DIR: %d krb5_ccname_template = DIR:%d/krb5cc_%U_XXXXXX But the configuration-options seems to be ignored, no matter what I do, and I have the same behavior: A non-executable directory is created and the user is unable to login. If I set the +x bit on the directory manually as the root-user, everything works.

4 5

sssd with samba
by Edouard Guigné 20 Nov '20

20 Nov '20

Dear sssd users, I would like to get informations about the use of sssd with samba (centos 7, samba 4.8.3). I need it because I configured a samba share, accessible with sssd. The authentication is against a windows AD. My /etc/nsswitch.cnf is configured only with sssd : /passwd: files sss// //shadow: files sss// //group: files sss/ For an other purpose, I set an sftpd access also configured with sssd against the AD. I followed some discussions on the samba user list about samba + sssd. I would like to understand if there are some issues with sssd and samba 4.8.3 on centos 7 ? Or is it with next RHEL 8 ? /The RHEL 8 documentation states this: // //// //"Red Hat only supports running Samba as a server with the winbindd // //service to provide domain users and groups to the local system. Due to // //certain limitations, such as missing Windows access control list (ACL) // //support and NT LAN Manager (NTLM) fallback, SSSD is not supported." // //// //https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/deploying_different_types_of_servers/assembly_using-samba-as-a-server_deploying-different-types-of-servers//// //// //What's confusing is that the RHEL 7 documentation says: // //// //"Prior to Red Hat Enterprise Linux 7.1, only Winbind provided this // //functionality. In Red Hat Enterprise Linux 7.1 and later, you no longer // //need to run Winbind and SSSD in parallel to access SMB shares. For // //example, accessing the Access Control Lists (ACLs) no longer requires // //Winbind on SSSD clients." // //// //and // //// //"4.2.2. Determining Whether to Use SSSD or Winbind for SMB Shares // //For most SSSD clients, using SSSD is recommended:" // //// //and most worrisome, in my use case: // //// //"In environments with direct Active Directory integration where the // //clients use SSSD for general Active Directory user mappings, using // //Winbind for the SMB ID mapping instead of SSSD can result in // //inconsistent mapping." / In my case, running samba 4.8.3 with SSSD on centos 7 do I need to : - enable and start winbind service , in conjunction to sssd ? - or only sssd is enough with samba ? - Do I have to fear issues in next release of sssd for the support of samba ? especially for acls support ?/ / A nsswitch.conf like : passwd: files sss winbind shadow: files sss winbind group: files sss winbind or passwd: files winbind sss shadow: files winbind sss group: files winbind sss Does not seem to work... I test and this is not stable. Best Regards, Edouard

5 6

Disable cache consistency checks to avoid running into issue 3571.
by TomK 31 Jan '20

31 Jan '20

Is there a way to disable cache consistency checks to avoid running into this issue? https://pagure.io/SSSD/sssd/issue/3571 This is related to my ask for SSSD 1.16 for RHEL 6 I just emailed about. -- Thx, TK.

1 1

SSSD 1.16 for RHEL 6
by TomK 31 Jan '20

31 Jan '20

Hi All, Earlier I've asked if there is a 1.16.X release of SSSD for RHEL 6. I was given the link in this post. https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… I have some additional questions: 1) How much testing has this version gone through vs the official RHEL 6 / 7 releases of SSSD 1.16. Does RH perform alot more testing for SSSD or does RH perform only a few more tests before certifying an SSSD release for a RHEL release? In other words, how much testing has gone into the above version. 2) Is there a 1.16 release available specifically for RHEL 6 from additional repos? What is the repo? -- Thx, TK.

1 0

Is it possible to utilize dyndns with samba_dlz?
by Z Z 29 Jan '20

29 Jan '20

I have working Samba AD server with linux and windows members. Windows machines are fine with the dynamic DNS updates. I'd like to have that for my linux machines too. I'm already using SSSD to join them to the AD domain, so I'm wondering if it's possible to use dyndns with the samba_dlz module? Has anyone tried it yet?

1 0

Is there an RFC or detailed design document describing SSSD's ID Mapping algorithm?
by Jeff Thornsen 23 Jan '20

23 Jan '20

The reason I ask is because I use a bunch of storage appliances that offer Secure-NFS (NETAPP, EMC UNITY, etc.), but they only support NIS, IDMU, RFC2307, and RFC2307bis style Identity Mapping, all of which require manual assignment of UID/GID numbers to objects in LDAP, which is untenable for large environments. Microsoft even removed Unix Attribute editor from their LDAP GUI for the RFC2307 attributes in Windows Server 2016 to push people away from using rfc2307. I would like to be able to provide a link to an RFC or design document describing the SSSD ID Mapping algorithm so that these 3rd party vendors can incorporate an identical identity mapping algorithm into their products, so that I can use their Secure-NFS product in conjunction with sssd and have the uid and gid numbers match up with the other Linux hosts in our environment.

5 6

Re: best way to check if a host is in a net group
by Charles Hedrick 23 Jan '20

23 Jan '20

I’d like to return to a discussion from a few months ago. I complained that I couldn’t find members of some netgroups. Here’s an example. I did “getent netgroup lcsrcf” and got no members. This is on Centos 8.1 It makes the right LDAP queries, and gets the right results. Here’s the final section of the log: Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [sdap_process_result] (0x2000): Trace: sh[0x5617e2787d10], connected[1], ops[0x5617e27f5d60], ldap[0x\ 5617e27c7da0] (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [sdap_get_generic_op_finished] (0x2000): Total count [0] (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [sdap_op_destructor] (0x2000): Operation 14 finished (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_members_process] (0x2000): Found 184 members in current search base (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracting netgroup members of netgroup 0 (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracted 1 netgroup members (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x4000): Extracting user members of netgroup 0 (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracted 0 user members (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x4000): Extracting host members of netgroup 0 (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracted 0 host members (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_save_netgroup] (0x2000): Storing netgroup studentdb (Thu Jan 23 10:14:25 2020) [sssd[be[cs.rutgers.edu]]] [ipa_save_netgroup] (0x1000): Adding original DN [ipaUniqueID=a5eacc30-c406-11e7-9045-000c29dbd083,cn\ =ng,cn=alt,dc=cs,dc=rutgers,dc=edu] to attributes of [studentdb]. Here’s what a check the works looks like: Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [sysdb_set_entry_attr] (0x0200): Entry [name=dcsilab_random,cn=Netgroups,cn=cs.rutgers.edu,cn=sysdb] \ has set [cache] attrs. (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracting netgroup members of netgroup 5 (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracted 0 netgroup members (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x4000): Extracting user members of netgroup 5 (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracted 0 user members (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x4000): Extracting host members of netgroup 5 (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Extracted 6 host members (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_netgr_process_all] (0x2000): Putting together triples of netgroup 5 (Thu Jan 23 09:58:02 2020) [sssd[be[cs.rutgers.edu]]] [ipa_save_netgroup] (0x2000): Storing netgroup dcsilab_linuxclients__3 Note that the first search was for net group lcsrcf, yer it stores the value as studentdb. Is it getting confused? studentdb is an indirect member of lcsrcf. > On Nov 4, 2019, at 11:24 AM, Charles Hedrick <hedrick(a)rutgers.edu> wrote: > > the query that generated that was > > ./test lcsrcf ilab1.cs.rutgers.edu > > We have 242 net groups in a complex multi-level setup. It’s historical, and doesn’t make a lot of sense. Lots of redundancy and dead systems. I’m attaching an LDAP dump > > <ng.out> > >> On Nov 4, 2019, at 11:18 AM, Charles Hedrick <hedrick(a)rutgers.edu> wrote: >> >> <sssd_cs.rutgers.edu.log> >> >>> On Nov 1, 2019, at 9:03 AM, Sumit Bose <sbose(a)redhat.com> wrote: >>> >>> On Thu, Oct 31, 2019 at 02:02:51PM +0000, Charles Hedrick wrote: >>>> I need to support netgroup checks in a service, written in C. I’m asking the SSSD list because we’re using SSSD, which means that net group operations are routed to the SSSD provider. >>>> >>>> I found that innetgr doesn’t work if there are nested net groups. The man page doesn’t suggest that this would happen, though various online discussions seem to suggest it. As far as I can tell, using the usual libc routines, I’d have to do a recursive enumeration of the netgroup. This seems pretty silly, since the host's memberOf attribute shows what net groups it’s a member of, whether direct or indirect. You could also enumerate using the compat tree, which lets a single LDAP query get all members of the netgroup. >>> >>> Hi, >>> >>> it would be good if you can share some logs which covered the failed >>> attempt. Iirc nested netgroups are handled by SSSD and glibc together. >>> I.e. SSSD will not resolve a nested netgroup automatically but just >>> returns the name and the glibc ask for the members of the nested group >>> if needed. >>> >>> bye, >>> Sumit >>> >>>> >>>> For the moment I’m doing LDAP operations. My application already needs to do GSSAPI-authenticated LDAP operations, so I have an LDAP connection already. A netgroup check require two queries, which could reasonably be cached. Lookup the netgroup by name to find the unique ID. Look up the host and see if the unique ID matches any memberOf attributes. >>>> >>>> But not all applications would be set up so this is easy. Is there a reasonable way to check netgroup membership using normal libc calls? >>>> >>>> >>>> _______________________________________________ >>>> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org >>>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>>> List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… >>> _______________________________________________ >>> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… >> >

1 0

restrict sudo su -
by Jannis Mann 20 Jan '20

20 Jan '20

Hi, I've implemented sssd with id, auth and access provider as ldap. So I am using a binding account and didn't joined the domain with the server. In general everything works. Only members of mentioned SG within the sssd.conf can login to the server, just as I wish to. However, as sudo user I can run something as following sudo su - UserThatIsNotAllowed So I (a sudo user) can switch to any user that is within the search base I've specified in the sssd.conf But these users are not allowed to use the server. I understand that not the user himself is logging in but I actually don't want sudo users to be able to switch to users that aren't allowed on the server. I'd like that it is only allowed to switch to users that are allowed on the server on local accounts of course. Is this a normal behaviour? Can it be changed? Thank you! Jannis

4 5

Re: How to do cross-subdomain user authentication by short name (among trusted AD subdomains) since sssd-ad 1.15.3?
by allindiajobs AIJ 17 Jan '20

17 Jan '20

Hey Spike White, Are you able to resolve this issue? I am facing exactly similar issue. Please let me know if you have a solution.

1 0

sssd-ldap, ppolicy, ldap_account_expire_policy with SSHD
by Chris Paul 16 Jan '20

16 Jan '20

Is it possible to use sssd-ldap (1.16.4-21, CentOS 7.7) with FreeIPA server (4.6.5-11, CentOS 7.7) and have password policy (ldap_access_order=ppolicy) and also account expiration (ldap_account_expire_policy = ipa)? It’s implied that IPA works as why else would “ipa” be an option to ldap_account_expire_policy? I’m trying this in my lab; can’t get it to work. Also not perfectly clear from the manual is how to use pwd_expire_policy_reject, pwd_expire_policy_warn, pwd_expire_policy_renew. In the manual, it is written: "Also 'ldap_pwd_policy' must be set to an appropriate password policy.” What should ldap_pwd_policy be set to for an IPA server? The docs also say, “for ldap_account_expire_policy=rhds, ipa, 389ds: use the value of ldap_ns_account_lock to check if access is allowed or not.” On my FreeIPA server, I don’t see the ldap_ns_account_lock attribute set for expired accounts. Either my reading is deficient or the documentation is. I’d be happy to contribute if I understood. Does anyone have any tips? thanks, Chris Paul

3 2

No group information displaying and slow persformance while implementing sssd ldap authentication
by capricorn cap 15 Jan '20

15 Jan '20

Hi! I am trying to authentticate my ubuntu users via Active directory and also autofs mounting. May be I am doing something wrong or missing some key attributes but I checked it from last couple of days and decided to write. I have configured my sssd.conf and using ldaps for communication. After troubleshooting my issue now I am able to get the result for my output like getent passwd AD-username and id AD-username I am logged on to ubuntu machine with local account and running id AD-Username and getent passwd AD-username and it takes ages to get reply back. uid=1348(AD-username) gid=100(users) groups=100(users) when I trun getend group groupname then nothing happens. I have attached my sssd.conf file. I am using Ubuntu 18.04 Version: 1.16.1-1ubuntu1.4 Version: 1.16.1-1ubuntu1.4 [sssd] config_file_version = 2 services = nss, pam, sudo, autofs domains = mycompany.local default_domain_suffix = mycompany.local [nss] debug_level = 9 filter_groups = root filter_users = root reconnection_retries = 3 #If want override the shell for all users uncomment follow line #override_shell = /bin/bash [pam] debug_level = 9 [sudo] debug_level = 3 [autofs] [domain/mycompany.local] debug_level = 9 enumerate = false case_sensitive = false cache_credentials = true min_id = 100 #ldap_id_mapping = True #ldap_user_primary_group = primaryGroupID case_sensitive = false ### --- Providers --- ### id_provider = ldap auth_provider = ldap access_provider = simple chpass_provider = ldap ### --- LDAP GENERAL --- ### ldap_id_use_start_tls = false ldap_schema = rfc2307 ldap_tls_cacertdir = /etc/ldap/cacerts #ldap_tls_cacert = /etc/ssl/dc01.cer ### LDAP user search settings ### ldap_user_search_base = DC=mycompany,DC=local # LDAP group search settings ldap_group_search_base = DC=mycompany,DC=local # LDAP Class settings ### --- LDAP Class settings --- #### ldap_user_object_class = user ldap_user_name = sAMAccountName ldap_user_gecos = displayName #ldap_user_principal = userPrincipalName ldap_user_home_directory = unixHomeDirectory ldap_user_member_of = memberOf ldap_group_object_class = group ldap_group_name = sAMAccountName ldap_group_member = memberUid ldap_network_timeout = 3 #ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount)) ad_server = dc01.mycompany.local ### --- LDAP connection settings --- ### ldap_uri = ldaps://dc01.mycompany.local:636 ldap_default_bind_dn = CN=serviceaccount,OU=ServiceAccounts,DC=mycompany,DC=local ldap_default_authtok_type = password ldap_default_authtok = mypassword # Access settings via simple # simple_allow_groups = lusers simple_allow_groups = Users ## Temp TEst ldap_opt_timeout = 20 dns_resolver_timeout = 10 ### AutoFS autofs_provider = ldap ldap_autofs_entry_key = cn ldap_autofs_entry_object_class = nisObject ldap_autofs_entry_value = nisMapEntry ldap_autofs_map_name = nisMapName ldap_autofs_map_object_class = nisMap ldap_autofs_search_base = ou=automount,DC=mycompany,dc=local Thanks

1 0

Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied
by Michael Barkdoll 14 Jan '20

14 Jan '20

Hi, my sssd is service is crashing on CentOS 8 it looks like something is changing the file permissions on /var/lib/sss/db/config.ldb $ systemctl status sssd.service ● sssd.service - System Security Services Daemon Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Mon 2020-01-13 16:30:16 CST; 15h ago Process: 874 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=1/FAILURE) Main PID: 874 (code=exited, status=1/FAILURE) Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876393 2020) [sssd[nss]] [ldb] (0x0020): Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876628 2020) [sssd[nss]] [ldb] (0x0020): Failed to connect to '/var/lib/sss/db/config.ldb' with backend 'tdb': Unable to > Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876641 2020) [sssd[nss]] [confdb_init] (0x0010): Unable to open config database [/var/lib/sss/db/config.ldb] Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876654 2020) [sssd[nss]] [server_setup] (0x0010): The confdb initialization failed Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: Exiting the SSSD. Could not restart critical service [nss]. Jan 13 16:30:16 sp20client.ad.siu.edu sssd[be[ad.siu.edu]][943]: Shutting down Jan 13 16:30:16 sp20client.ad.siu.edu sssd[be[implicit_files]][942]: Shutting down Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: sssd.service: Main process exited, code=exited, status=1/FAILURE Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: Failed to start System Security Services Daemon. something is changing the file permissions of file /var/lib/sss/db/config.ldb to: $ ls -la /var/lib/sss/db/config.ldb -rw-------. 1 1767801122 1767800513 1286144 Jan 13 16:30 /var/lib/sss/db/config.ldb $ $ id 1767801122 id: ‘1767801122’: no such user $ getent passwd 1767801122 $ echo $? 2 $ $ systemctl restart sssd $ ls -lan /var/lib/sss/db/config.ldb -rw-------. 1 0 0 1286144 Jan 14 08:00 /var/lib/sss/db/config.ldb $ ls -la /var/lib/sss/db/config.ldb -rw-------. 1 root root 1286144 Jan 14 08:00 /var/lib/sss/db/config.ldb $ I've joined this machine to an Active Directory Domain using packages: realmd_prereq_packages: - realmd - sssd - adcli - oddjob - oddjob-mkhomedir - samba-common - samba-common-tools - krb5-workstation realm join -vvvv --computer-ou="ou=Computers,dc=sample,dc=college,dc=edu" --user-principal=nfs/sp20client.sample.college.edu(a)AD.SIU.EDU --os-name=CentOS --user=account SAMPLE.COLLEGE.EDU Things have been odd with the sssd authentication in other ways as well. One time when I tried to su root it wasn't working until I rebooted CentOS 8. Here is my sssd.conf: [sssd] domains = sample.college.edu config_file_version = 2 services = nss, pam #default_domain_suffix = SAMPLE.COLLEGE.EDU [domain/sample.college.edu] ad_domain = sample.college.edu krb5_realm = SAMPLE.COLLEGE.EDU realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True # The following pulls ldap uid,gid from AD #ldap_id_mapping = False # The following uses xxxxxxx(a)sample.college.edu for login name if default_domain_suffix is not set. #use_fully_qualified_names = True # The following allows xxxxxxx to login with default_domain_suffix is not set. use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = ad subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout ignore_group_members = True krb5_lifetime = 7h krb5_renewable_lifetime = 7d krb5_renew_interval = 60s dyndns_update = true dyndns_refresh_interval = 60 dyndns_update_ptr = true dyndns_ttl = 60 debug_level = 9 dyndns_iface = enp0s3 #dyndns_auth = none dyndns_server = 131.x.x.x ad_hostname = sp20client.sample.college.edu

2 4

Is there a way to disable Mozilla NSS?
by Sad Clouds 14 Jan '20

14 Jan '20

When I build sssd from source, I specify "--with-crypto=libcrypto" during configure stage, however during the build and install stage, sssd is linked with both libcrypto.so and libnss3.so+libnssutil3.so Is there a way to completely disable all Mozilla NSS libraries with sssd?

3 8

Provider clarifications
by Lars Francke 10 Jan '20

10 Jan '20

Hi, I've got a question that seems pretty trivial to me so it feels like I'm missing something obvious. I know that there are different provider types: id, auth, chpass, access (and maybe others) But what I don't quite understand is what they actually do. The documentation says: id -> "The identification provider" auth -> "The authentication provider" access -> "The access control provider" chpass -> "The provider which should handle change password operations for the domain." (The first three are not very helpful ;-) ) I understand chpass and I can make a guess about the others but I'm not sure: id: Just returns information about some object auth: Validates credentials for an object access: Checks authorization? But I'm very vague on the details. Is there any more information I can refer to? What are the differences/can anyone point me at an API description or some other documentation? One very specific question for example: What does the krb5 auth mean? Does it retrieve a ticket and try to decrypt that? Thank you! Cheers, Lars

2 3

managing authorization without AD/LDAP
by francois-oss＠avalenn.eu 10 Jan '20

10 Jan '20

Hello, I have a use case of ssh authentication to some server which for various reasons (one of them being network isolation) cannot access to Directory. With ssh I can use ssh certificates to do the authentication part "offline" without the need for the server to access any centralized service. But I still need LDAP connexion to get directory information (numeric uid, groups, etc.) I would like a mechanic which allows to transmit this information along with the connexion initiation. For example the ssh certificate could have some extension options like uid(a)example.com=1234 and groups(a)example.com=wheel,admin,mygroup and this certificate would create the corresponding entries in SSSD in passwd and groups databases which would be valid for the duration of the certificate. Do anyone knows of such a setup or have any pointer to similar ideas ? Do you think it would be possible for SSSD to be extended to support this use case ? Would it be easy to implement ? (a bunch of AuthorizedKeyCommand shell scripts interacting with SSSD D-Bus interface would suit me) François

1 0

Realm permit with bogus AD domain disallows any subsequent legal login
by Spike White 10 Jan '20

10 Jan '20

All, Another engineer fat-fingered a ‘realm permit’ invocation and discovered this problem. Brought this to my attention. (This is on RHEL7). We are using the simple access provider in sssd.conf. So we have simple_allow_groups and simple_allow_users lines in sssd.conf: Example allow lines: simple_allow_groups = amerlinuxeng(a)amer.company.com, amerlinuxengtfssupt(a)amer.company.com, amerlinuxsup(a)amer.company.com, amerlnxsvcdelauttfs(a)amer.company.com, fnms_ops(a)amer.company.com, gbllinuxsuppw(a)amer.company.com, pptsupportpac(a)amer.company.com, scheduling_global(a)amer.company.com, unv_legato_admins(a)amer.company.com, zabbix-support(a)amer.company.com, apaclinuxeng(a)apac.company.com, apaclinuxsup(a)apac.company.com, emealinuxeng(a)emea.company.com, emealinuxsup(a)emea.company.com, vra_users(a)amer.company.com simple_allow_users = processdaceaccount(a)amer.company.com, processdisco05(a)amer.company.com, processdisco06a(a)amer.company.com, processehcprofiler(a)amer.company.com, processfoglight(a)amer.company.com, svc_prdprofoglight01(a)amer.company.com, john2_nolan(a)emea.company.com <john2_nolan(a)emea.dell.com> amer.company.com and emea.company.com are legal AD child domains. If we mistakenly do a ‘realm permit’ for any bogus AD domain, it breaks any subsequent legal logins. Examples: realm permit processdaceaccount(a)us.company.com <processdaceaccount(a)us.dell.com> realm permit -g vra_users(a)us.company.com <vra_users(a)us.dell.com> If I attempt to log in now, the authentication fails. (& my login is legal – I’m a member of a couple of these permitted AD groups.) Here’s the log lines from /var/log/secure: Jan 9 11:21:54 spikev2stest01 sshd[68160]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost= spikev2stest01.us.company.com user=admspike_white Jan 9 11:21:54 spikev2stest01 sshd[68160]: Accepted password for admspike_white from 10.179.253.197 port 47334 ssh2 Jan 9 11:21:54 spikev2stest01 sshd[68160]: pam_sss(sshd:account): Access denied for user admspike_white: 6 (Permission denied) Jan 9 11:21:54 spikev2stest01 sshd[68160]: fatal: Access denied for user admspike_white by PAM account configuration So the PAM auth phase still succeeds, but now the access phase fails. This is for a legal login. If I remove the bogus entries, access of legal logins again succeeds. realm permit -x processdaceaccount(a)us.company.com <processdaceaccount(a)us.dell.com> realm permit -g -x vra_users(a)us.company.com <vra_users(a)us.dell.com> Now my legal login again succeeds. Here’s the auth and access section of the /etc/pam.d/system-auth file: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so # OL7 version. Per Company I/T's stated policy for service & process accounts, lock-out time = 30 mins auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800 auth sufficient pam_sss.so forward_pass auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth required pam_deny.so account [default=ignore success=ok perm_denied=bad user_unknown=ignore] pam_sss.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account required pam_permit.so Spike

2 1

Exclude users who will become root from SSSD control
by Soham Chakraborty 10 Jan '20

10 Jan '20

Hi all, I have a requirement where my client is requesting to exclude all users who will become root (by sudo) out of SSSD control. The way I think it is possible is to not add those users into the sudo rule. Or create those users on the linux side and not keep them on AD at all. Has anyone encountered something like this? I am trying to gather information as to why they need this. In the meantime if anyone knows how to achieve this, it would be much appreciated. Thanks,

2 1

Re: Using Multiple Matchrules
by Roy Presley 10 Jan '20

10 Jan '20

Sumit, The '||' or operator worked like a charm! I missed that tidbit in the "Matching and Mapping Certificates" doc. Thanks.

1 0

Bug: Trying to get hostent from a name-less server
by Orion Poplawski 10 Jan '20

10 Jan '20

I'm seeing the following in my sssd_DOMAIN.log: (Thu Jan 9 15:03:30 2020) [sssd[be[DOMAIN]]] [be_resolve_server_process] (0x0200): Found address for server SERVER.DOMAIN: [XX.XX.XX.XX] TTL 86400 (Thu Jan 9 15:03:30 2020) [sssd[be[DOMAIN]]] [ipa_resolve_callback] (0x0400): Constructed uri 'ldap://SERVER.DOMAIN' (Thu Jan 9 15:03:30 2020) [sssd[be[DOMAIN]]] [fo_get_server_hostent] (0x0020): Bug: Trying to get hostent from a name-less server (Thu Jan 9 15:03:30 2020) [sssd[be[DOMAIN]]] [write_krb5info_file_from_fo_server] (0x0020): Server without name and address found in list. (Thu Jan 9 15:03:30 2020) [sssd[be[DOMAIN]]] [krb5_add_krb5info_offline_callback] (0x4000): Removal callback already available for service [IPA]. Are the messages in the middle anything to worry about? Doesn't sound particularly good. Thanks, Orion -- Orion Poplawski Manager of NWRA Technical Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 1

Using Multiple Matchrules
by Roy Presley 10 Jan '20

10 Jan '20

I have a use case with a local domain (files) that requires a one-to-many relationship between a Linux user account and alternate smartcard token user names, i.e., I have multiple users with individual smartcards that need to be able to authenticate to a single Linux user account. Based on the sssd documentation and my observation, the sssd.conf file only matches the last matchrule supplied. This appears to force a one-to-one relationship between a Linux user account and a smartcard token user name. Is there a way to create a matchrule (or rules) that will allow the use of multiple smartcards with a single Linux user account? Thanks.

3 2

Re: BV test
by WORLDS VALVE 09 Jan '20

09 Jan '20

1 0

Re: BV test
by WORLDS VALVE 09 Jan '20

09 Jan '20

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users January 2020