sssd-users October 2024

sssd-users@lists.fedorahosted.org

8 participants
9 discussions

filter_users using user id
by Francois Rigault 22 Mar '25

22 Mar '25

Greetings, we run some podman containers that come with their own local users, such as this one: ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent: (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461] I would hope to get rid of these requests against the domain. unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users. I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion. I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better. Thank you!

4 4

SSSD problem one-way trust GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)
by Omnis ludis - games 17 Feb '25

17 Feb '25

Good afternoon, please tell me there is such an infrastructure windows domain and samba domain between them, one-sided external outgoing trust relationships are set up, so that users from the windows domain can freely enter the samba domain, I entered the client into the samba domain and all users from the samba domain can safely pass to this client, but that's not the task of users they do not want to authenticate from the windows domain in any way when I try to log in to a client from the samba domain under them, I get the following error in sssd on the client, GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database), do I understand correctly that this works like this, the client accesses the samba domain controller, since there is no given user in samba, the request is redirected to the windows domain controller and that in turn must provide information about this to users from its database kerberos? but for some reason this does not happen, does anyone have at least some information on this error, I have already tried many different scenarios and can not log in as a user in any way, as if samba does not process information correctly, while if you build a two-way trusting relationship, then everything works as it should

2 1

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

Nuisance-level extraneous logging in /var/log/sssd/krb5_child.log file. How to suppress?
by Spike White 24 Oct '24

24 Oct '24

All, This is not a problem. But it is annoying; how do I make it go away? Every time any user logs into any of our Linux servers, we get these messages in the /var/log/sssd/krb5_child.log file: (2024-07-23 11:20:44): [krb5_child[947088]] [main] (0x3f7c0): [RID#26239] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x3f7c0): [RID#27336] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] krb5_child started. * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x1000): [RID#27336] total buffer size: [92] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] cmd [249 (pre-auth)] uid [2025431] gid [2025431] validate [false] enterprise principal [true] offline [false] UPN [ AdmSpike_White(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] ccname: [KCM:] old_ccname: [KCM:] keytab: [not set] * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] Missing krb5_keytab option for domain, looking for default one * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_kt_default_name() returned: FILE:/etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_child will default to: /etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_use_fast] (0x0100): [RID#27336] Not using FAST. * (2024-07-23 14:14:10): [krb5_child[970533]] [become_user] (0x0200): [RID#27336] Trying to become user [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x2000): [RID#27336] Running as [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific renewable lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_canonicalize_option] (0x0100): [RID#27336] Canonicalization is set to [true] * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] Will perform pre-auth * (2024-07-23 14:14:10): [krb5_child[970533]] [tgt_req_child] (0x1000): [RID#27336] Attempting to get a TGT * (2024-07-23 14:14:10): [krb5_child[970533]] [get_and_save_tgt] (0x0400): [RID#27336] Attempting kinit for realm [AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_responder] (0x4000): [RID#27336] Got question [password]. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] Prompt [0][Password for AdmSpike_White\@ AMER.COMPANY.COM(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x0200): [RID#27336] Prompter interface isn't used for password prompts by SSSD. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-07-23 14:14:10): [krb5_child[970534]] [main] (0x3f7c0): [RID#27337] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. We’re ok with the krb5_validate message. We set: krb5_validate = False in /etc/sssd/sssd.conf file because KVNO of host principal gets out of sync between AD and /etc/krb5.keytab file frequently. So we’re comfortable with that one line of logging. It’s all the rest of the logging that we’d prefer not to see. How do we suppress them or eradicate the underlying condition that leads to them appearing? Here is our sssd.conf file. [nss] debug_backtrace_enabled = false #debug_level = 9 filter_groups = root mfe bladelogic_linux_users(a)amer.company.com bladelogic_linux_users(a)emea.company.com bladelogic_linux_users(a)apac.company.com bladelogic_linux_users(a)japn.company.com bladelogic_linux_users(a)company.com oracle filter_users = root mfe oracle [sssd] debug_backtrace_enabled = false #debug_level = 9 domains = amer.company.com domain_resolution_order = amer.company.com, emea.company.com, apac.company.com, japn.company.com, company.com config_file_version = 2 services = nss,pam,ifp reconnection_retries = 3 full_name_format = %1$s [pam] pam_verbosity = 3 #debug_level = 9 offline_credentials_expiration = 3 [ifp] #debug_level = 9 [domain/amer.company.com] filter_groups = root mfe bladelogic_linux_users oracle sudo_provider = none debug_backtrace_enabled = false #debug_level = 9 ad_enabled_domains = company.com, amer.company.com, apac.company.com, emea.company.com, japn.company.com ad_enabled_domains = amer.company.com, apac.company.com, emea.company.com, japn.company.com, company.com # If you enable ignore_group_members, it gives a small perf win, but then # "getent group XXX" shows no members. Perf win not worth the lack of # diagnostics. #ignore_group_members = true id_provider = ad access_provider = simple auth_provider = ad default_shell = /bin/bash ldap_id_mapping = False auto_private_groups = True realmd_tags = joined-with-adcli cache_credentials = True # Not set to true; Passwords stored in this way are kept in plaintext in the kernel keyring and are potentially accessible by the root user (with difficulty). #krb5_store_password_if_offline = True fallback_homedir = /home/%u ldap_sasl_authid = host/austgcore17.us.company.com(a)AMER.COMPANY.COM dyndns_update = False # Using tokengroups is usually a speed optimization #ldap_use_tokengroups = False ldap_search_base = dc=AMER,dc=COMPANY,dc=COM ldap_force_upper_case_realm = True # Set to False, because KVNO of host principal gets out of sync between # AD and /etc/krb5.keytab file frequently. krb5_validate = False simple_allow_groups = amerlinuxsup(a)amer.company.com, amerlinuxeng(a)amer.company.com, emealinuxsup(a)emea.company.com, emealinuxeng(a)emea.company.com, apaclinuxsup(a)apac.company.com, apaclinuxeng(a)apac.company.com, gbllinuxsuppw(a)amer.company.com, bladelogic_linux_users(a)amer.company.com, PRD-1004873-AMER-DBSPOTUNIX(a)amer.company.com, pptsupportpac(a)amer.company.com, unv_legato_admins(a)amer.company.com, scheduling_global(a)amer.company.com, engit-ebpa(a)amer.company.com, amerlinuxengtfssupt(a)amer.company.com, amerlnxsvcdelauttfs(a)apac.company.com, iasnprod(a)amer.company.com, fnms_ops(a)amer.company.com, zabbix-support(a)amer.company.com, globalinfosecopsadm(a)amer.company.com, prd-amer-fnmsopspac(a)amer.company.com, amerlinuxeng simple_allow_users = processehcprofiler(a)amer.company.com, svc_prdautovm(a)amer.company.com, processfoglight(a)amer.company.com, svc_prdprofoglight01(a)amer.company.com, service_ome_linux(a)amer.company.com, svc_prdesquadscounix(a)apac.company.com, serviceunixinstall(a)amer.company.com, admspike_white, oracle # look at https://docs.pagure.org/SSSD.sssd/design_pages/subdomain_configuration.html [domain/amer.company.com/company.com] ldap_search_base = dc=COMPANY,dc=COM [domain/amer.company.com/apac.company.com] ldap_search_base = dc=APAC,dc=COMPANY,dc=COM [domain/amer.company.com/emea.company.com] ldap_search_base = dc=EMEA,dc=COMPANY,dc=COM [domain/amer.company.com/japn.company.com] ldap_search_base = dc=JAPN,dc=COMPANY,dc=COM

2 11

How to notice/check SSSD is currently offline.
by seojeong kim 23 Oct '24

23 Oct '24

I didn't applied debug_level in sssd. so I can't get the status of SSSD from sssd_mydomain.log. Instead, I'm checking if SSSD is offline or not by the following command. netstat -nap | grep 389 | grep ESTABLISHED | wc -l if it's 0 then SSSD is currently offline. I wonder this way is right to check if SSSD is offline or not.. Is there any other port related to SSSD offline ? or any command to check SSSD offline ?

2 2

How to configure multi prompt even in SSSD offline mode
by seojeong kim 21 Oct '24

21 Oct '24

here is my sssd.conf [domain/mydomain.com] filter_users=root,ubuntu,ec2-user,centos filter_groups=root,ubuntu,ec2-user,centos offline_timeout = 60 ignore_group_members = true cache_credentials = true krb5_store_password_if_offline = True ipa_hbac_refresh = 60 auth_provider = ipa access_provider = ipa chpass_provider = ipa sudo_provider = ipa dns_discovery_domain = mydomain.com ldap_tls_cacert = /etc/ipa/ca.crt ldap_sudo_use_host_filter = false ldap_sudo_refresh_enabled = true ldap_sudo_full_refresh_interval=86400 ldap_sudo_smart_refresh_interval=200 ldap_sudo_search_base = ou=sudoers,dc=mydomain,dc=com?subtree?(|(sudoHost=ip-10-10-247-202-3456.ipa-dev)(sudoHost=+.svc_ipa-dev*)(sudoHost=ALL)) ldap_connection_expire_timeout = 87473 entry_cache_timeout = 172800 krb5_auth_timeout = 30 debug_level = 9 [sssd] reconnection_retries = 3 config_file_version = 2 services = nss, sudo, pam, ssh domains = mydomain.com debug_level = 9 [nss] homedir_substring = /home debug_level = 9 [pam] debug_level = 9 [sudo] debug_level = 9 [autofs] [ssh] debug_level = 9 [pac] [ifp] [secrets] [session_recording] [prompting/password] password_prompt = Password : [prompting/2fa] single_prompt = False first_prompt = First Factor: second_prompt = Second Factor: When SSSD is online, ssh prompt for 2fa user asks like below. First Factor: Second Factor: but if SSSD goes to offline, ssh prompt asks only password like password : How can I configure to get multi prompt asking for 2fa user even in SSSD offline mode? Of course, otp validation will be ignored even though user inputs otp. I just want to keep multi prompt even in both SSSD online and SSSD offline. Is it possible to be configured ?

2 1

[SSSD] Announcing SSSD 2.10.0
by Pavel Březina 15 Oct '24

15 Oct '24

# SSSD 2.10.0-beta2 The SSSD team is announcing the release of version 2.10.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.10.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.10.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.10.0 Release Notes ## Highlights ### General information * **IMPORTANT note for downstream maintainers!** This release features significant improvements of "running with less privileges (under unprivileged service user)" feature. There is still a `./configure` option `--with-sssd-user=` available that allows downstream package maintainers to choose if support of non-root service user should be built. In case such support is built, a preferred way to configure service user is simply by starting SSSD under this user; for example, using `User=/Group=` options of systemd sssd.service file. Upstream defaults are to build `--with-sssd-user=sssd` and to install systemd service with `User=/Group=sssd`. In this case, only several helper processes - `ldap_child`, `krb5_child` and `selinux_child` - are executed with elevated capabilities (that are now granted using fine grained file capabilities instead of SUID bit). All other SSSD components run without any capabilities. In this scenario it's still possible to re-configure SSSD to run under `root` (if needed for some reason): besides changing `User/Group=` options, some other tweaks of systemd service files are required. A legacy method to configure a service user - sssd.conf `user` option - is now deprecated and its support isn’t built by default. It can be enabled using `--with-conf-service-user-support` `./configure` option if needed (for example, due to backward compatibility requirements of stable releases). Further, no matter if SSSD is built `--with-sssd-user=sssd` or `--with-sssd-user=root`, when it's configured to run under `root` (in both cases) it still runs without capabilities, the same way as when it's configured to run under `sssd` user. The only difference is from the DAC perspective. Important note: owner of `/etc/sssd/sssd.conf` file (and snippets) should match the user configured to start SSSD service. Upstream spec file and service files change ownership of existing `sssd.conf` to sssd during package installation and at runtime for seamless upgrades / transition period only. Additionally, this release fixes a large number of issues with "socket activation of responders" feature, making it operable out-of-the-box when the package is built `--with-sssd-user=sssd`. Please take a note, that user configured to run main sssd.service and socket activated responders (if used) should match (i.e. if sssd.service is re-configured from upstream defaults to `root` then responders services also should be re-configured). Downstream package maintainers are advised to carefully inspect changes in `contrib/sssd.spec.in`, `src/sysv/systemd/*` and `./configure` options that this release brings! * sssctl `cache-upgrade` command was removed. SSSD performs automatic upgrades at startup when needed. * Support of `enumeration` feature (i.e. ability to list all users/groups using `getent passwd/group` without argument) for AD/IPA providers is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-extended-enumeration-support` ./configure option. * A number of minor glitches of `sssd-2.10.0-beta1` around building and packaging were fixed. ### New features * The new tool `sss_ssh_knownhosts` can be used with ssh's `KnownHostsCommand` configuration option to retrieve the host's public keys from a remote server (FreeIPA, LDAP, etc.). This new tool, which is more reliable, replaces `sss_ssh_knownhostsproxy`. The latter is no longer built by default, but its build can be forced with the `./configure` option `--with-ssh-known-hosts-proxy`. ### Packaging changes * Building SSSD now unconditionally requires availability of `ucred`/ `SO_PEERCRED` to enforce certain security checks at runtime (see `man 7 unix` for details). * SSSD now requires `libini` not older than v1.3 * Explicit `--with-semanage` ./configure switch was removed, going forward `--with-selinux` includes this. * `sssd_pam` binary lost public `rx` bits and got `cap_dac_read_search=p` file capability to be able to use GSSAPI * Support of OpenSSL older than 1.0.1 was dropped * Support of `--without-infopipe` `./configure` option was dropped. Feature is long time out of experimental state. Since building it doesn't require any additional dependencies, there is not much sense to keep option available. Those who not interested in feature can skip installing sssd-ifp sub-package. ### Configuration changes * Default `ldap_id_use_start_tls` value changed from `false` to `true` for improved security. * Added a `ldap_use_ppolicy` option for backends with broken ppolicy extension handling. * Obsolete `config_file_version` option was removed. * Option `reconnection_retries` was removed since it is no longer used. SSSD switch to a new architecte of internal IPC between SSSD processes where responders do not connect to backend anymore and therefore this option is no longer used.

1 0

How to tell which AD group membership conferred login?
by Spike White 02 Oct '24

02 Oct '24

All, I know sssctl user-checks <user> will tell you whether this account is conferred login or not. You're looking for line: pam_acct_mgmt: Success Is there a utility (or some verbose output on sssctl user-checks) that tells you membership in which group is conferring you access? I know a commercial product where the equivalent login test outputs something like this: [root@gordita root]# vastool user checkaccess admben_lee Access allowed. (RULE ALLOWING: membership in group gbllinuxsup) Particularly with nested subgroups (bad practice I know) and a user member of 10 - 12 AD groups, it's often a challenge to chase which group membership is allowing login. Do the sssd logs in debug level 9 give this info? I just tried this, running sssctl user-checks against myself. I just checked the sssd logs and it says I'm a member of 110 supplemental AD groups! (Luckily not all are UNIX-enabled, so cannot confer me login access).. I see this in the sssd logs: (2024-10-02 10:22:53): [be[amer.company.com]] [simple_check_groups] (0x4000): [RID#2] Checking against allow list group name [ amerlinuxsup(a)amer.company.com] (2024-10-02 10:22:53): [be[amer.company.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain amer.company.com is Active (2024-10-02 10:22:53): [be[amer.company.com]] [simple_check_groups] (0x4000): [RID#2] Checking against allow list group name [ amerlinuxeng(a)amer.company.com] (2024-10-02 10:22:53): [be[amer.company.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain amer.company.com is Active (2024-10-02 10:22:53): [be[amer.company.com]] [simple_check_groups] (0x1000): [RID#2] Group [AmerLinuxEng(a)amer.company.com] found in allow list, access granted. (2024-10-02 10:22:53): [be[amer.company.com]] [simple_access_check_done] (0x2000): [RID#2] Group check done (2024-10-02 10:22:53): [be[amer.company.com]] [simple_access_check_recv] (0x1000): [RID#2] Access granted So it's in the sssd logs. Is there a simpler command that will give this same info? Spike White

1 0

devcontainer
by Ryan Slominski 01 Oct '24

01 Oct '24

Hi, I'm looking for tips on building sssd in a devcontainer. The simplest naive thing: https://github.com/slominskir/sssd-devcontainer/blob/main/Dockerfile ```Dockerfile FROM fedora:40 RUN dnf install 'dnf-command(builddep)' tini git -y ; dnf builddep sssd -y ENTRYPOINT ["/usr/bin/tini", "--"] CMD ["sleep", "infinity"] ``` Configure step fails with: checking for CAP... no configure: error: libcap is missing Ran with: docker build . -t dev docker run --rm --name dev dev docker exec -it dev bash cd /opt git clone https://github.com/SSSD/sssd cd sssd autoreconf -if ./configure Regards, Ryan

4 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2024