sssd-users October 2022

sssd-users@lists.fedorahosted.org

4 participants
6 discussions

Starting SSSD without root
by Tero Saarni 09 Apr '24

09 Apr '24

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 20

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell 22 Jul '23

22 Jul '23

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

2 3

Re: AD refresh GPO to Ubuntu22.04
by Gregory Carter 26 Dec '22

26 Dec '22

There is no such thing as a GPO for a LINUX box. That being said I use Puppet to do basically the same thing. (i.e. Bring LINUX, MAC, Windows to bear on a common LDAP policy schema I created to enforce machine configurations, authentication and security policies.) On Fri, Sep 9, 2022 at 12:56 AM 任昭翰 <zhaohan.ren(a)hotmail.com> wrote: > Hi guys > > I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server > by sssd + realm, in the AD I have a customized GPO, is it possible that the > AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client > that also joined this AD, the win10 client could receive the GPO update > successfully from the AD. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

4 5

How to correctly omit the AD domain prefix from hostnames etc
by Kodiak Firesmith 18 Oct '22

18 Oct '22

Hi Folks, I currently have SSSD-AD working exactly as I want it, less one drawback - I have to include the AD domain prefix everywhere to get things working. For example, we are whoi.edu, and in non-AD DNS, all of our hosts are $hostname.whoi.edu. We'll call our AD domain 'adwhoi' for this discussion. To get things working cleanly, Ansible reconfigures each host right before the AD join to use the hostname $hostname.adwhoi.whoi.edu instead of $hostname.whoi.edu. Hosts join AD via adcli and set the usual UPN and SPNs. AD-based identity and authentication works just fine. GSSAPI auth works fine. Users are granted a valid TGT upon login. Root can kinit the host keytab fine. Deploying a new major release of Linux is always an opportunity to make a clean break and fix annoyances like this, so I'd love to know how we can get all of the above working, but without having to include the domain prefix in our hostnames and in our ssh references. I've done a fair bit of digging on this while setting up our AD join scheme and authoring our Ansible code, but I've never been able to crack this issue, so I'd love it if someone could clue me in. Here's some of the relevant files in case they are helpful: =========================================================================================== /etc/sssd/sssd.conf: [sssd] domains = adwhoi.whoi.edu services = nss, pam debug_level = 3 [domain/adwhoi.whoi.edu] krb5_store_password_if_offline = True cache_credentials = True krb5_realm = ADWHOI.WHOI.EDU id_provider = ad fallback_homedir = /home/%u override_homedir = /home/%u default_shell = /bin/bash ad_domain = adwhoi.whoi.edu use_fully_qualified_names = False ldap_id_mapping = False access_provider = ad ad_gpo_access_control = disabled ad_server = jimbob.adwhoi.whoi.edu,cleetus.adwhoi.whoi.edu ad_backup_server = jedidiah.adwhoi.whoi.edu ad_maximum_machine_account_password_age = 0 ldap_referrals = False =========================================================================== /etc/krb5.conf [libdefaults] default_realm = ADWHOI.WHOI.EDU rdns = False dns_canonicalize_hostname = False # The following krb5.conf variables are only for MIT Kerberos. kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. fcc-mit-ticketflags = true [realms] ADWHOI.WHOI.EDU = { kdc = jimbob.adwhoi.whoi.edu kdc = cleetus.adwhoi.whoi.edu kdc = jedidiah.adwhoi.whoi.edu admin_server = jimbob.adwhoi.whoi.edu default_domain = adwhoi.whoi.edu } [domain_realm] .adwhoi.whoi.edu = ADWHOI.WHOI.EDU adwhoi.whoi.edu = ADWHOI.WHOI.EDU =========================================================================== Example keytab: Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 SOMEHOST$(a)ADWHOI.WHOI.EDU (arcfour-hmac) 2 SOMEHOST$(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96) 2 SOMEHOST$(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96) 2 host/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (arcfour-hmac) 2 host/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96) 2 host/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96) 2 host/SOMEHOST(a)ADWHOI.WHOI.EDU (arcfour-hmac) 2 host/SOMEHOST(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96) 2 host/SOMEHOST(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96) 2 RestrictedKrbHost/SOMEHOST(a)ADWHOI.WHOI.EDU (arcfour-hmac) 2 RestrictedKrbHost/SOMEHOST(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96) 2 RestrictedKrbHost/SOMEHOST(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96) 2 RestrictedKrbHost/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (arcfour-hmac) 2 RestrictedKrbHost/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96) 2 RestrictedKrbHost/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96) ========================================================================== Thanks! - Kodiak Firesmith Sent with [Proton Mail](https://proton.me/) secure email.

2 1

SSH with KbdInteractiveAuthentication - pam_sssd activates wrong credentials cache on login
by Sam Morris 12 Oct '22

12 Oct '22

Posting this here before I file a bug because there are a few similar bugs which have been closed, and so I don't know if I'm seeing one of them or whether this is a new one. On the server, before I SSH in, my credentials cache collection looks like this: $ printenv KRB5CCNAME KCM: $ klist -l Principal name Cache name -------------- ---------- user(a)EXAMPLE.COM KCM:1011:48623 (Expired) user(a)EXAMPLE.COM KCM:1011:1518 (Expired) user(a)EXAMPLE.COM KCM:1011:12525 (Expired) user(a)EXAMPLE.COM KCM:1011:95695 (Expired) user(a)EXAMPLE.COM KCM:1011:19607 (Expired) user(a)EXAMPLE.COM KCM:1011:25261 (Expired) $ klist Ticket cache: KCM:1011:95695 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 06/22/22 00:03:52 06/23/22 00:01:49 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM The TGT in the primary credentials cache is an old one that expired a few days ago. Now I SSH into the server, using keyboard-interactive authentication, so sshd calls into pam_sss to authenticate me with Kerberos. $ ssh -v -l user server.example.com debug1: Next authentication method: keyboard-interactive (user(a)server.example.com) First Factor: (user(a)server.example.com) Second Factor: Authenticated to server.example.com (via proxy) using "keyboard-interactive". $ klist Ticket cache: KCM:1011:48623 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 05/24/22 23:39:09 05/25/22 23:16:16 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM 05/25/22 19:31:42 05/25/22 23:16:16 HTTP/server.example.com(a)EXAMPLE.COM The primary credential cache has been changed to a different cache, that contains an old, expired ticket. So the I can't use my TGT to access network services. If I then list the contents of the original primary credential cache: $ klist -c KCM:1011:95695 Ticket cache: KCM:1011:95695 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 09/28/22 09:37:09 09/29/22 09:36:36 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM SSSD put the new TGT into the former primary credential cache, and then changed the primary credential cache to one of the other caches within the collection. I expected that, regardless of whether the new TGT goes into a new credential cache or an existing one, the destination credential cache is set as the primary so that it can be used by the user. In particular this looks like <https://github.com/SSSD/sssd/issues/4988>, but a comment says that that has been fixed in RHEL 8 some time ago, nonetheless I'm seeing this problem on both RHEL 9.0 (sssd-common-2.6.2-4.el9_0.1.x86_64) and RHEL 8.6 (sssd-common-2.6.2-4.el8_6.1.x86_64). The workaround is to identify the credential cache that contains non-expired credentials and then make it the primary: $ klist -l Principal name Cache name -------------- ---------- user(a)EXAMPLE.COM KCM:1011:48623 (Expired) user(a)EXAMPLE.COM KCM:1011:1518 (Expired) user(a)EXAMPLE.COM KCM:1011:12525 (Expired) user(a)EXAMPLE.COM KCM:1011:19607 (Expired) user(a)EXAMPLE.COM KCM:1011:95695 $ kswitch -c KCM:1011:95695 If I perform the same test but using gssapi-with-mic authentication in combination with GSSAPIDelegateCredentials, then I see that the TGT is stored in a new credentials cache, which is then set as the primary, e.g. everything works! I also think that sssd should be cleaning up these old credential caches. AFAIK, there's no perfect forward secrecy with Kerberos, so can these old tickets can be used to decrypt captured network traffic? Regards, -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 1

[SSSD] Announcing SSSD 2.8.0
by Pavel Březina 07 Oct '22

07 Oct '22

# SSSD 2.8.0 The SSSD team is announcing the release of version 2.8.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.8.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.8.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * The new D-Bus function ListByAttr() allows the caller to look for users that have an attribute with a certain value. For performance reasons, it is recommended that the attribute is indexed both on the remote server and on the local cache. The sssctl tool now provides the cache-index command to help you manage indexes on the local cache. ### New features * Introduced the dbus function org.freedesktop.sssd.infopipe.Users.ListByAttr(attr, value, limit) listing upto limit users matching the filter attr=value. * sssctl is now able to create, list and delete indexes on the local caches. Indexes are useful for the new D-Bus ListByAttr() function. * sssctl is now able to read and set each component's debug level independently. ### Important fixes * `domains` option in `[sssd]` section can now be completely omitted if domains are enabled via `domains/enabled` option ### Configuration changes * New option 'core_dumpable' to manage 'PR_SET_DUMPABLE' flag of SSSD processes. Enabled by default. * New option 'ldap_enumeration_refresh_offset' to set the maximum period deviation between enumeration updates. Defaults to 30 seconds. * New option 'subdomain_refresh_interval_offset' to set the maximum period deviation when refreshing the subdomain list. * New option 'dyndns_refresh_interval_offset' to set the maximum period deviation when updating the client's DNS entry. Defaults to 0. * New option 'refresh_expired_interval_offset' to set the maximum period deviation when refreshing expired entries in background. * New option 'ldap_purge_cache_offset' to set the maximum time deviation between cache cleanups. Defaults to 0. * Option 'ad_machine_account_password_renewal_opts' now accepts an optional third part as the maximum deviation in the provided period (first part) and initial delay (second part). If the period and initial delay are provided but not the offset, the offset is assumed to be 0. If no part is provided, the default is 86400:750:300. * override_homedir now recognizes the %h template which is replaced by the original home directory retrieved from the identity provider, but in lower case.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2022