sssd-users January 2024

sssd-users@lists.fedorahosted.org

10 participants
15 discussions

[SSSD] Announcing SSSD 2.9.4
by Pavel Březina 12 Jan '24

12 Jan '24

# SSSD 2.9.4 The SSSD team is announcing the release of version 2.9.4 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.4 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.4.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.4 Release Notes ## Highlights ### Important fixes * Fixes a crash when PAM passkey processing incorrectly handles non-passkey data. * A workaround was implemented to handle gracefully misbehaving applications that destroy internal state of SSSD client librarires. A particular example of such application is described in https://github.com/TigerVNC/tigervnc/issues/1709. * An error when rotating KCM's logs was fixed. When KCM's logs were rotated by logrotate, KCM would still use the old file (renamed sssd_kcm.log.1). Only after KCM was restarted (either manually or automatically) the new log file would be used. This problem is now solved and KCM uses the new file immediately. * Fixed group membership handling when members are coming from different forest domains and using ldap token groups is prohibited. * Files provider was erroneously taking into consideration `local_auth_policy` config option, thus breaking smartcard authentication of local user in setups that didn't explicitly specify this option. This is now fixed.

1 0

Does sssd (on RHEL8 and RHEL9) RPM have an implied dependency on sssd-kcm RPM?
by Spike White 11 Jan '24

11 Jan '24

All, Is there a packaging problem on the latest version of RHEL8 sssd? On several of our RHEL8 servers during the last update cycle, sssd logins start failing. It appears to be when upgrading to version sssd-2.9.1-4.0.1.el8_9.x86_64. Upon deep dive, it turns out the sssd-kcm RPM is missing. The sssd-kcm service fails to start, complaining about missing symbols in /usr/libexec/sssd_kcm file. Sure enough, there is a problem with that file: [root@mftplat1wplp105 ~]# rpm -qf /usr/libexec/sssd/sssd_kcm file /usr/libexec/sssd/sssd_kcm is not owned by any package Once the sssd-kcm RPM is installed, then this looks normal: [root@mftplat1wplp105 ~]# rpm -qf /usr/libexec/sssd/sssd_kcm sssd-kcm-2.9.1-4.0.1.el8_9.x86_64 Then sssd-kcm service will restart fine. and then sssd logins again work fine. Also, it appears that a yum downgrade of sssd seems to work too -- presumably because this downgrade also triggers an install of sssd-kcm RPM. I see that the sssd RPM has no direct explicit RPM dependency on sssd-kcm. But is there some indirect or implied dependency that was missed on this latest packaging for sssd-2.9.1-4.0.1.el8_9.x86_64? We've run sssd for years and never had significant sssd-kcm problems until last month. BTW, another clue that it was KCM is that 'kinit -k' fails with error: # knit -k Cannot update default cache But if you tell it to store creds under /tmp, it works: # export KRB5CCNAME="FILE:/tmp/krb5cc_0" # kinit -k Spike

3 4

Re: sssd losing track of uid after existing kvm
by Alexey Tikhonov 10 Jan '24

10 Jan '24

On Tue, Jan 9, 2024 at 7:34 PM Charles Hedrick <hedrick(a)rutgers.edu> wrote: > > ubuntu 22.04.3, sssd 2.6.3-1ubuntu3.2 > will be doing updates tomorrow to latest 22.04 code > files sss > ipa [we're a highly kerberized site] > > I'll do strace if it happens again. So far it hasn't. I hate intermittent bugs. If you are able to reproduce, then it also makes sense to set 'debug_level=9' in [nss] and [$domain] section of sssd.conf (or use `sssctl debug-level` in runtime) and capture /var/log/sssd/* covering failed attempt. > > ________________________________ > From: Alexey Tikhonov <atikhono(a)redhat.com> > Sent: Tuesday, January 9, 2024 1:15 PM > To: End-user discussions about the System Security Services Daemon <sssd-users(a)lists.fedorahosted.org> > Subject: [SSSD-users] Re: sssd losing track of uid after existing kvm > > Hi, > > On Tue, Jan 9, 2024 at 4:50 PM Charles Hedrick <hedrick(a)rutgers.edu> wrote: > > > > We want to use user-mode kvm for students. I've set up a VM. It uses 9p to mount the user's home directory. After connecting to the VM with "virsh console", and then exiting, sssd on the host (not in the VM, in the main host) loses track of the user's UID. "getent passwd UNAME" works "getent passwd UID" does not, and "whoami" says cannot find name. > > > > It doesn't always happen immediately. It's not quite reproducible. But it's close. > > > > Any idea what's going on? Logging in again will fix it. > > What is: > - platform, SSSD version > - in /etc/nsswitch.conf::passwd > - what id_provider is used in sssd.conf? > > Did you try to run `getnet -s sss passwd ...` under strace? > -- > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue > -- > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 0

Re: sssd losing track of uid after existing kvm
by Alexey Tikhonov 09 Jan '24

09 Jan '24

Hi, On Tue, Jan 9, 2024 at 4:50 PM Charles Hedrick <hedrick(a)rutgers.edu> wrote: > > We want to use user-mode kvm for students. I've set up a VM. It uses 9p to mount the user's home directory. After connecting to the VM with "virsh console", and then exiting, sssd on the host (not in the VM, in the main host) loses track of the user's UID. "getent passwd UNAME" works "getent passwd UID" does not, and "whoami" says cannot find name. > > It doesn't always happen immediately. It's not quite reproducible. But it's close. > > Any idea what's going on? Logging in again will fix it. What is: - platform, SSSD version - in /etc/nsswitch.conf::passwd - what id_provider is used in sssd.conf? Did you try to run `getnet -s sss passwd ...` under strace?

2 1

sssd losing track of uid after existing kvm
by Charles Hedrick 09 Jan '24

09 Jan '24

We want to use user-mode kvm for students. I've set up a VM. It uses 9p to mount the user's home directory. After connecting to the VM with "virsh console", and then exiting, sssd on the host (not in the VM, in the main host) loses track of the user's UID. "getent passwd UNAME" works "getent passwd UID" does not, and "whoami" says cannot find name. It doesn't always happen immediately. It's not quite reproducible. But it's close. Any idea what's going on? Logging in again will fix it.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users January 2024