sssd-users June 2023

sssd-users@lists.fedorahosted.org

9 participants
10 discussions

filter_users using user id
by Francois Rigault 22 Mar '25

22 Mar '25

Greetings, we run some podman containers that come with their own local users, such as this one: ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent: (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461] I would hope to get rid of these requests against the domain. unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users. I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion. I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better. Thank you!

4 4

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

Starting SSSD without root
by Tero Saarni 09 Apr '24

09 Apr '24

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 20

sssd-pac.service fails to start after Debian 12 upgrade (fatal error setting up backend connector)
by Adam Cecile 28 Aug '23

28 Aug '23

Hello, I am not sure to understand what is going on but all my servers being upgraded from Debian 11 to Debian 12 with MS Active Directory integration using SSSD starts reporting systemctl issues with sssd-pac service/socket failing to start. When being started manually with "/usr/libexec/sssd/sssd_pac --logger=stderr --socket-activated --debug-level=8": [pac] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (2023-06-14 15:21:20): [pac] [server_setup] (0x3f7c0): Starting with debug level = 0x37f0 (2023-06-14 15:21:20): [pac] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb (2023-06-14 15:21:20): [pac] [schedule_responder_idle_timer] (0x2000): Re- scheduling the idle timeout [responder_idle_timeout] for the responder [0x55892f921550] (2023-06-14 15:21:20): [pac] [setup_responder_idle_timer] (0x2000): Setting up the idle timeout [responder_idle_timeout] for the responder [0x55892f921550] (2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400): No enumeration for [ad.domain.com] (2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information (2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x1000): pwd_expiration_warning is 21 (2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x0100): Setting domain password expiration warning to 21 days (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/sh in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/bash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/bash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/rbash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/rbash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/dash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/dash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/screen in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/sh in /etc/shells (2023-06-14 15:21:20): [pac] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>.+)@(?P<domain>[^@]+$))|(^(?P<name>[^@\\]+)$))]. (2023-06-14 15:21:20): [pac] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. (2023-06-14 15:21:20): [pac] [sbus_dbus_request_name] (0x0020): Unable to request name on the system bus [3] (2023-06-14 15:21:20): [pac] [sss_dp_init] (0x0010): Failed to connect to backend server. (2023-06-14 15:21:20): [pac] [sss_process_init] (0x0010): fatal error setting up backend connector (2023-06-14 15:21:20): [pac] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (2023-06-14 15:21:20): [pac] [pac_process_init] (0x0010): sss_process_init() failed Such error does not occurs on Debian 11. Sadly Internet is not really helping on this one so I have no idea of what to look for. Everything seems to be working correctly despite the failing service. Any idea ? Best regards, Adam.

5 9

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell 22 Jul '23

22 Jul '23

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

2 3

Is there a way to restrict nss group membership searches for local users to only /etc/group?
by Spike White 10 Jul '23

10 Jul '23

All, Successful sssd consumer here. Have an app team running Hadoop. They're getting these performance errors in their app. This is from their app logs. ddlflhdm201.us.company.com WARN June 15, 2023 10:08 AM Groups Potential performance problem: getGroups(user=hbase) took 58022 milliseconds ddlflhdm304.us.company.com WARN June 15, 2023 8:38 AM Groups Potential performance problem: getGroups(user=mapred) took 39962 milliseconds ddlplhdm505.us.company.com WARN June 16, 2023 5:37 AM Groups Potential performance problem: getGroups(user=hdfs) took 62437 milliseconds. ddlplhdm305.us.company.com WARN June 15, 2023 9:36 PM Groups Potential performance problem: getGroups(user=hdfs) took 58017 milliseconds ddlplhdm505.us.company.com WARN June 10, 2023 8:01 AM Groups Potential performance problem: getGroups(user=yarn) took 58017 milliseconds. Interestingly, all these users are local users created by the Hadoop package installation. (hbase, mapred, hdfs, yarn are all local users). These local users are members only of local groups. So theoretically the search for group memberships should be lightning quick as the groups are found only in /etc/group. But since my /etc/nsswitch.conf looks like this: passwd: files systemd sss group: files systemd sss netgroup: files sss automount: files sss services: files shadow: files sss hosts: files dns myhostname It not only searches local files for group membership, it searches AD as well. And doesn't find it, as there is no such AD user or uid. Eventually timing out. In /var/log/messages we see this around the same time frame as Jun 15 10:08:09 ddlflhdm201 sssd[be[amer.company.com]]: GSSAPI Error: An invalid name was supplied (Success) Is there a way to restrict these particular local app accounts from having their group memberships looked up in AD? I.e., my [nss] section looks like this today: [nss] #debug_level = 9 filter_groups = root filter_users = root #override_homedir = /home/%u Can I do this? [nss] filter_users = root, hbase, mapred, hdfs, yarn And would I want to set filter_users_in_groups = false? Spike White

2 5

Group caching issue
by vivianne＠chinstrap.org 28 Jun '23

28 Jun '23

Hello, I'm using SSSD with LDAP and NSS enabled for user/group information. Originally, groups besides the primary group would be "forgotten"/no longer be present. Invalidating the cache with sss_cache -u (username) temporarily fixes it, and through testing I found it'd reoccur 5 minutes after forced cache invalidation. I realized NIS was mistakenly in our nsswitch.conf and removed it, and now it seems to happen about every 45 minutes consistently. If you leave the machine for a while and come back then they'll be present again. I've set debug_log=10 under all our conf sections but don't really see anything relevant in the logs watching them with tail while checking group presence. I'm not experienced with SSSD administration, so I'd appreciate any tips on triaging this further. Thanks all. Vivianne

2 1

Override an attribute for all users?
by Gökçe Aydos 28 Jun '23

28 Jun '23

Due to historical reasons I have different parent directories for `homeDirectory`, e.g., ``` /home/u1 /home-xx/u2 ``` I want to map all of them to `home`. In `nslcd` it is possible by using: ``` map passwd homeDirectory "/home/$uid" ``` Is it possible to override an attribute for all users in sssd?

1 1

[SSSD] Announcing SSSD 2.9.1
by Pavel Březina 23 Jun '23

23 Jun '23

# SSSD 2.9.1 The SSSD team is announcing the release of version 2.9.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * Passkey: added option to write key mapping data to file. ### Important fixes * A regression was fixed that prevented autofs lookups to function correctly when cache_first is set to True. Since this was set as a new default value in sssd-2.9.1, it is considered as a regression. * A regression where SSSD failed to properly watch for changes in '/etc/resolv.conf' when it was a symbolic link or was a relative path, was fixed.

1 0

id_provider from AD but groups from LDAP
by Francis Augusto Medeiros-Logeay 05 Jun '23

05 Jun '23

Hi, Is it possible to have groups fetched from LDAP while still having `ad` as the id_provider? The reason to do this is the following: Historically, our organization has had all linux machines to get its id data from LDAP. But now with NFSv4, we are joining the machines to AD, while still using id_provider=ldap and getting our groups from our ldap server. This works well. The challenge came when now we have to use certificate-based authentication. The certificates are in AD, and so far it has only worked when I had id_provider=ad. If I could still fetch the groups from ldap, that would be a win-win, as we still could use NFSv4 while being able to use certificate-based authentication. Any tips here? Best, Francis

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2023