sssd-users August 2023

sssd-users@lists.fedorahosted.org

8 participants
6 discussions

Starting SSSD without root
by Tero Saarni 20 Jan '26

20 Jan '26

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 21

filter_users using user id
by Francois Rigault 22 Mar '25

22 Mar '25

Greetings, we run some podman containers that come with their own local users, such as this one: ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent: (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461] I would hope to get rid of these requests against the domain. unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users. I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion. I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better. Thank you!

4 4

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

sssd-pac.service fails to start after Debian 12 upgrade (fatal error setting up backend connector)
by Adam Cecile 28 Aug '23

28 Aug '23

Hello, I am not sure to understand what is going on but all my servers being upgraded from Debian 11 to Debian 12 with MS Active Directory integration using SSSD starts reporting systemctl issues with sssd-pac service/socket failing to start. When being started manually with "/usr/libexec/sssd/sssd_pac --logger=stderr --socket-activated --debug-level=8": [pac] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (2023-06-14 15:21:20): [pac] [server_setup] (0x3f7c0): Starting with debug level = 0x37f0 (2023-06-14 15:21:20): [pac] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb (2023-06-14 15:21:20): [pac] [schedule_responder_idle_timer] (0x2000): Re- scheduling the idle timeout [responder_idle_timeout] for the responder [0x55892f921550] (2023-06-14 15:21:20): [pac] [setup_responder_idle_timer] (0x2000): Setting up the idle timeout [responder_idle_timeout] for the responder [0x55892f921550] (2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400): No enumeration for [ad.domain.com] (2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information (2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x1000): pwd_expiration_warning is 21 (2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x0100): Setting domain password expiration warning to 21 days (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/sh in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/bash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/bash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/rbash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/rbash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/dash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/dash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/screen in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/sh in /etc/shells (2023-06-14 15:21:20): [pac] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>.+)@(?P<domain>[^@]+$))|(^(?P<name>[^@\\]+)$))]. (2023-06-14 15:21:20): [pac] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. (2023-06-14 15:21:20): [pac] [sbus_dbus_request_name] (0x0020): Unable to request name on the system bus [3] (2023-06-14 15:21:20): [pac] [sss_dp_init] (0x0010): Failed to connect to backend server. (2023-06-14 15:21:20): [pac] [sss_process_init] (0x0010): fatal error setting up backend connector (2023-06-14 15:21:20): [pac] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (2023-06-14 15:21:20): [pac] [pac_process_init] (0x0010): sss_process_init() failed Such error does not occurs on Debian 11. Sadly Internet is not really helping on this one so I have no idea of what to look for. Everything seems to be working correctly despite the failing service. Any idea ? Best regards, Adam.

5 9

Doubt about integration between Samba 4 and OpenLDAP
by Cairo Campos 11 Aug '23

11 Aug '23

I need to continuously synchronize OpenLDAP users and passwords with a Samba 4 DC. However, this doesn't seem to be a good idea due to incompatibilities. Searching the internet, I saw some pages mentioning SSSD, so that I can use OpenLDAP as the basis of authentication for Samba 4. Currently, my production Samba 4 domain uses internal LDAP and DNS. I wanted material or documentation that showed me how to make the switch to using SSSD robustly. Can you help me?

3 2

best practice, using machine-account keytab for service SPNs
by Stefan Bauer 08 Aug '23

08 Aug '23

Dear Users, i really love SSSD and also the auto-renewal of the host-keytab file. On many hosts we add the SPNs HTTP/ SQL/... directly to the machine-account in Active-Directory. This is all fine and works. However i have a bad feeling about letting services read the keytab file as it gives access to the machine-account. Opinions? How do you handle service keytabs and it's rotation? Thank you. Stefan

4 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2023