sssd-users July 2024

sssd-users@lists.fedorahosted.org

13 participants
16 discussions

Nuisance-level extraneous logging in /var/log/sssd/krb5_child.log file. How to suppress?
by Spike White 24 Oct '24

24 Oct '24

All, This is not a problem. But it is annoying; how do I make it go away? Every time any user logs into any of our Linux servers, we get these messages in the /var/log/sssd/krb5_child.log file: (2024-07-23 11:20:44): [krb5_child[947088]] [main] (0x3f7c0): [RID#26239] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x3f7c0): [RID#27336] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] krb5_child started. * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x1000): [RID#27336] total buffer size: [92] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] cmd [249 (pre-auth)] uid [2025431] gid [2025431] validate [false] enterprise principal [true] offline [false] UPN [ AdmSpike_White(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] ccname: [KCM:] old_ccname: [KCM:] keytab: [not set] * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] Missing krb5_keytab option for domain, looking for default one * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_kt_default_name() returned: FILE:/etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_child will default to: /etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_use_fast] (0x0100): [RID#27336] Not using FAST. * (2024-07-23 14:14:10): [krb5_child[970533]] [become_user] (0x0200): [RID#27336] Trying to become user [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x2000): [RID#27336] Running as [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific renewable lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_canonicalize_option] (0x0100): [RID#27336] Canonicalization is set to [true] * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] Will perform pre-auth * (2024-07-23 14:14:10): [krb5_child[970533]] [tgt_req_child] (0x1000): [RID#27336] Attempting to get a TGT * (2024-07-23 14:14:10): [krb5_child[970533]] [get_and_save_tgt] (0x0400): [RID#27336] Attempting kinit for realm [AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_responder] (0x4000): [RID#27336] Got question [password]. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] Prompt [0][Password for AdmSpike_White\@ AMER.COMPANY.COM(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x0200): [RID#27336] Prompter interface isn't used for password prompts by SSSD. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-07-23 14:14:10): [krb5_child[970534]] [main] (0x3f7c0): [RID#27337] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. We’re ok with the krb5_validate message. We set: krb5_validate = False in /etc/sssd/sssd.conf file because KVNO of host principal gets out of sync between AD and /etc/krb5.keytab file frequently. So we’re comfortable with that one line of logging. It’s all the rest of the logging that we’d prefer not to see. How do we suppress them or eradicate the underlying condition that leads to them appearing? Here is our sssd.conf file. [nss] debug_backtrace_enabled = false #debug_level = 9 filter_groups = root mfe bladelogic_linux_users(a)amer.company.com bladelogic_linux_users(a)emea.company.com bladelogic_linux_users(a)apac.company.com bladelogic_linux_users(a)japn.company.com bladelogic_linux_users(a)company.com oracle filter_users = root mfe oracle [sssd] debug_backtrace_enabled = false #debug_level = 9 domains = amer.company.com domain_resolution_order = amer.company.com, emea.company.com, apac.company.com, japn.company.com, company.com config_file_version = 2 services = nss,pam,ifp reconnection_retries = 3 full_name_format = %1$s [pam] pam_verbosity = 3 #debug_level = 9 offline_credentials_expiration = 3 [ifp] #debug_level = 9 [domain/amer.company.com] filter_groups = root mfe bladelogic_linux_users oracle sudo_provider = none debug_backtrace_enabled = false #debug_level = 9 ad_enabled_domains = company.com, amer.company.com, apac.company.com, emea.company.com, japn.company.com ad_enabled_domains = amer.company.com, apac.company.com, emea.company.com, japn.company.com, company.com # If you enable ignore_group_members, it gives a small perf win, but then # "getent group XXX" shows no members. Perf win not worth the lack of # diagnostics. #ignore_group_members = true id_provider = ad access_provider = simple auth_provider = ad default_shell = /bin/bash ldap_id_mapping = False auto_private_groups = True realmd_tags = joined-with-adcli cache_credentials = True # Not set to true; Passwords stored in this way are kept in plaintext in the kernel keyring and are potentially accessible by the root user (with difficulty). #krb5_store_password_if_offline = True fallback_homedir = /home/%u ldap_sasl_authid = host/austgcore17.us.company.com(a)AMER.COMPANY.COM dyndns_update = False # Using tokengroups is usually a speed optimization #ldap_use_tokengroups = False ldap_search_base = dc=AMER,dc=COMPANY,dc=COM ldap_force_upper_case_realm = True # Set to False, because KVNO of host principal gets out of sync between # AD and /etc/krb5.keytab file frequently. krb5_validate = False simple_allow_groups = amerlinuxsup(a)amer.company.com, amerlinuxeng(a)amer.company.com, emealinuxsup(a)emea.company.com, emealinuxeng(a)emea.company.com, apaclinuxsup(a)apac.company.com, apaclinuxeng(a)apac.company.com, gbllinuxsuppw(a)amer.company.com, bladelogic_linux_users(a)amer.company.com, PRD-1004873-AMER-DBSPOTUNIX(a)amer.company.com, pptsupportpac(a)amer.company.com, unv_legato_admins(a)amer.company.com, scheduling_global(a)amer.company.com, engit-ebpa(a)amer.company.com, amerlinuxengtfssupt(a)amer.company.com, amerlnxsvcdelauttfs(a)apac.company.com, iasnprod(a)amer.company.com, fnms_ops(a)amer.company.com, zabbix-support(a)amer.company.com, globalinfosecopsadm(a)amer.company.com, prd-amer-fnmsopspac(a)amer.company.com, amerlinuxeng simple_allow_users = processehcprofiler(a)amer.company.com, svc_prdautovm(a)amer.company.com, processfoglight(a)amer.company.com, svc_prdprofoglight01(a)amer.company.com, service_ome_linux(a)amer.company.com, svc_prdesquadscounix(a)apac.company.com, serviceunixinstall(a)amer.company.com, admspike_white, oracle # look at https://docs.pagure.org/SSSD.sssd/design_pages/subdomain_configuration.html [domain/amer.company.com/company.com] ldap_search_base = dc=COMPANY,dc=COM [domain/amer.company.com/apac.company.com] ldap_search_base = dc=APAC,dc=COMPANY,dc=COM [domain/amer.company.com/emea.company.com] ldap_search_base = dc=EMEA,dc=COMPANY,dc=COM [domain/amer.company.com/japn.company.com] ldap_search_base = dc=JAPN,dc=COMPANY,dc=COM

2 11

what sections of sssd's AD integration break if default_ccache_name changed to FILE:/tmp/krb5cc_%{uid}
by Spike White 31 Jul '24

31 Jul '24

All, On a RHEL8 server, an app team got an /etc/krb5.conf.d/ file put in that changed default_ccache_name from the expected: default_ccache_name = KCM (as set up by sssd) to: [libdefaults] default_ccache_name = FILE:/tmp/krb5cc_%{uid} Far as I can tell, sssd is still functioning. But I seem to recall that some portions of sssd (in RHEL8 and RHEL9) break if it's not set to KCM. KCM server for SSSD — SSSD documentation (pagure.org) <https://docs.pagure.org/sssd.sssd/design_pages/kcm.html> and sssd-kcm man page describe the sssd-kcm service, but not what breaks if you don't use it. Spike

1 0

Large number of long running processes hold on to deleted files
by Sergei Gerasenko 31 Jul '24

31 Jul '24

Hello, I recently upgraded to centos9 and I'm seeing quite a few cache files marked deleted under /var/lib/sss/mc. According to lsof, the majority of them are owned by bash processes but they were originally spawned by sshd. I've tried adding SSS_NSS_USE_MEMCACHE=NO to the environment of the sshd daemon, but that doesn't seem to help. The partition on which the cache files reside is only 1G and it does create a problem when the number of ssh sessions is large. Currently there are ~140 such deleted files with unique i-nodes. The version is I'm running on c9 is 2.9.4-7. Same version was running on this host on c8 where this issue didn't occur though I didn't ever look there because there were no alerts on the space usage. So I assume it wasn't an issue. Is there something that can be done to improve the situation?

1 0

SSSD not recovered after being killed by watchdog
by Grigory Trenin 23 Jul '24

23 Jul '24

Hello, Sometimes SSSD is not recovered after being killed by own watchdog. This is a DEV environment, somewhat poorly monitored, OOM kills are common (but SSSD is not killed). RHEL8.8, sssd-2.8.2 with Active Directory. 1. Under the memory pressure, the system becomes unresponsive, and SSSD's own watchdog terminates sssd_be and restarts it. 2. Since the system is still operating very slowly, it takes quite a while to start sssd_be. From the output of “ps” command I can see that sssd_be start time is 09:32:13, but sssd_be’s initial message in its logs “Starting with debug level = 0x0070” is dated 9:34:02. So it took almost 2 minutes to start sssd_be. 3. Meanwhile, nss/pam responders tried to connect to the backend 3 times and gave up with a message “Unable to reconnect: maximum retries exceeded”. 4. OOM killer finally kills some process (not SSSD ones) and the system performance returns back to normal. So we end up with SSSD up and running, but not functioning, because nss/pam responders will never try connecting to the backend again. And it was caused by its own watchdog. It looks like if watchdog hadn't killed sssd_be, it would have recovered after OOM killer killed the memory hog process. I still cannot believe that SSSD cannot recover on its own from such a simple situation. To my mind it should try reconnecting to the backend every 60s or something like that. Is it expected behaviour or am I missing something? Kind regards, Grigory Trenin

2 6

Schema for sss_ssh_knownhostsproxy support
by Christopher Byrne 19 Jul '24

19 Jul '24

I'm one of the maintainers of sssd in Gentoo. I have separate openldap, kerberos and DNS servers. I would like the use sss_ssh_knownhostsproxy but I cannot find a schema for the the attributes sssd wants. Here's what is displays when looking it up: (2024-03-27 20:20:10): [be[EXAMPLE.COM]] [sdap_get_generic_ext_step] (0x0400): [RID#8] calling ldap_search_ext with [(&(objectClass=ipHost)(fqdn=ldap.example.com))][dc=example,dc=com]. (2024-03-27 20:20:10): [be[EXAMPLE.COM]] [sdap_get_generic_ext_step] (0x1000): [RID#8] Requesting attrs: [objectClass] (2024-03-27 20:20:10): [be[EXAMPLE.COM]] [sdap_get_generic_ext_step] (0x1000): [RID#8] Requesting attrs: [cn] (2024-03-27 20:20:10): [be[EXAMPLE.COM]] [sdap_get_generic_ext_step] (0x1000): [RID#8] Requesting attrs: [fqdn] (2024-03-27 20:20:10): [be[EXAMPLE.COM]] [sdap_get_generic_ext_step] (0x1000): [RID#8] Requesting attrs: [serverHostname] (2024-03-27 20:20:10): [be[EXAMPLE.COM]] [sdap_get_generic_ext_step] (0x1000): [RID#8] Requesting attrs: [sshPublicKey] sshPublicKey is part of openssh-lpk, but I cannot find "fqdn" or "serverHostname" anywhere.

4 9

Removing "Authenticated Users" from "Pre-Windows 2000 Compatible Access" breaks group enumeration
by Steve Scotter 12 Jul '24

12 Jul '24

Hi, This is likely a newbie issue and I apologize in advance. I've only been working with sssd for a matter of weeks and until I hardened Active Directory (as a result of an internal penetration test) sssd had been reliable and robust. Over the past few days I've been harding an Active Directory in a testing environment. It seems as though removing "Authenticated Users" from "Pre-Windows 2000 Compatible Access" (as is recommended best practice) breaks sssd's ability to perform group enumeration. With "Authenticated Users" in "Pre-Windows 2000 Compatible Access" group # id firstname.lastname uid=XXXXX01148(firstname.lastname) gid= XXXXX00513(domain users) groups=XXXXX01605(redactedgroup1),XXXXX01267(redactedgroup2),XXXXX02621(redactedgroup3),XXXXX01230(redactedgroup4),XXXXX00513(domain users),XXXXX01154(redactedgroup5),XXXXX01257(redactedgroup6),XXXXXX01307(redactedgroup7),XXXXX01156(redactedgroup8),XXXXX01111(redactedgroup9) With "Authenticated Users" removed from the "Pre-Windows 2000 Compatible Access" group # id firstname.lastname uid=XXXXX01148(firstname.lastname) gid=XXXXX00513(domain users) groups=XXXXX00513(domain users) I've had a good rummage around the internet, but not found a solution, or even anyone else reporting this issue before. Any help gratefully received! Active Directory is Windows Server 2022 based. Test client machines Debian 12 - sssd v2.8.2-4 Ubuntu 22 - sssd v2.6.3-1ubuntu3.3 # cat /etc/sssd/sssd.conf [sssd] domains = redacted.co.uk config_file_version = 2 services = nss, pam default_domain_suffix = redacted.co.uk full_name_format = %1$s [domain/redacted.co.uk] default_shell = /bin/bash krb5_store_password_if_offline = True cache_credentials = True krb5_realm = REDACTED.CO.UK realmd_tags = manages-system joined-with-adcli id_provider = ad fallback_homedir = /home/%u override_homedir = /home/%u ad_domain = redacted.co.uk use_fully_qualified_names = True ldap_id_mapping = True access_provider = ad # So that ssh public keys works when a users key is stored in altSecurityIdentities ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities ldap_user_ssh_public_key = altSecurityIdentities # Removes requirement for host to communicate with DC's over port 445 ad_gpo_access_control = disabled # Removes requirement for host to communicate with DC's over port 3268 ad_enable_gc = false Kind Regards Steve

2 4

Re: 2FA is being enforced after upgrading 2.9.1->2.9.4
by Sumit Bose 12 Jul '24

12 Jul '24

Am Mon, Jun 24, 2024 at 08:23:54AM +0000 schrieb Grzegorz Sobański: > Hi, > Thanks for working on this. > Could you please share a source diff for this change? We can’t use this private build - we will need to build it ourselves. Hi, please check https://github.com/sumit-bose/sssd/commit/464a7ec2793a82c83330cb3a10b114d1c… HTH bye, Sumit > > Regards, > > Grzegorz > www.payu.com<http://www.payu.com/> > > > From: Sumit Bose <sbose(a)redhat.com> > Date: Friday, 21 June 2024 at 16:18 > To: End-user discussions about the System Security Services Daemon <sssd-users(a)lists.fedorahosted.org> > Subject: External : [SSSD-users] Re: 2FA is being enforced after upgrading 2.9.1->2.9.4 > Attention: This email originated outside trusted domains. > > > Am Fri, Jun 21, 2024 at 11:47:54AM +0000 schrieb Grzegorz Sobański: > > > Am Tue, Jun 18, 2024 at 10:14:29AM +0000 schrieb Grzegorz Sobański: > > > > Hi, > > > > after updating Rocky Linux from 9.3 to 9.4 sssd started to enforce 2FA for our sudo configuration, while before it was optional, and we can’t find why did it change. > > > > We downgraded sssd packages from 2.9.4 to 2.9.1 and 2FA went back to being optional, so we are sure it’s because sssd version change from 2.9.1->2.9.4, all other configuration is the same. > > > > > > > > I looked through changelogs and skimmed through the list of commits, but I couldn’t find anything obvious that should change this. Has anyone seen something similar? Do you know if it’s a result of an intended change or some side-effect of other changes? Or a bug? > > > > > > > > We are using IPA as Kerberos provider, users do have OTP set up. > > > > Up to 2.9.1 sudoing worked either with only password or password+otp. > > > > On 2.9.4 (and 2.9.5) sudoing is not working with only password, both password+otp are required. > > > > > > Hi, > > > > > > this might be related to https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co…<https://github.com/SSSD/sssd/issues/7152but> > > > this should be fixed in 2.9.5. Would it be possible to send full debug > > > logs for sssd-2.9.5 with `debug_level = 9` at least in the [domain/...] > > > section of sssd.conf covering a failed login attempt? > > > > Hi, > > I attach full debug logs with level 9 from sssd 2.9.5. > > Hi, > > thanks for the logs, please find a test build which should fix the issue > at > https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsbose.fed…<https://sbose.fedorapeople.org/otp_password/sssd-2.9.4-6.el9_4.1sb1.tar.gz>. > Please let me know if it works for you or not. > > If you don't mind it would be nice if you can open a ticket for this > issue at https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co…<https://github.com/SSSD/sssd/issues/new>. > > Thanks. > > bye, > Sumit > > > > > Bye, > > Grzegorz > > > > > -- > > _______________________________________________ > > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > > Fedora Code of Conduct: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…<https://docs.fedoraproject.org/en-US/project/code-of-conduct/> > > List Guidelines: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…<https://fedoraproject.org/wiki/Mailing_list_guidelines> > > List Archives: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…<https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.…> > > Do not reply to spam, report it: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure.io…<https://pagure.io/fedora-infrastructure/new_issue> > -- > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…<https://docs.fedoraproject.org/en-US/project/code-of-conduct/> > List Guidelines: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…<https://fedoraproject.org/wiki/Mailing_list_guidelines> > List Archives: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…<https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.…> > Do not reply to spam, report it: https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpagure.io…<https://pagure.io/fedora-infrastructure/new_issue> > -- > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

2 6

custom prompt text not applied.
by seojeong kim 12 Jul '24

12 Jul '24

ubuntu18 and current sssd version is 1.16.1 /etc/sssd/sssd.conf [prompting/password] password_prompt = Password : [prompting/2fa] first_prompt = 2fa_Password : second_prompt = 2fa_otp : single_prompt = False service sssd restart sssctl config-check Issues identified by validators: 2 [rule/allowed_sections]: Section [prompting/password] is not allowed. Check for typos. [rule/allowed_sections]: Section [prompting/2fa] is not allowed. Check for typos. Messages generated during configuration merging: 0 Used configuration snippet files: 0 ================ I can't find any typos in sssd.conf . Is it happening because sssd is version low ?

2 1

Test build for SSSD integration with Keycloak and Entra ID
by Sumit Bose 10 Jul '24

10 Jul '24

Hi, I created a repository at https://copr.fedorainfracloud.org/coprs/sbose/sssd-idp/ which contains the current state of the direct integration of SSSD with IdPs, currently Keycloak and Entra ID are supported. Instructions and additional links can be found there as well. bye, Sumit

3 7

SSSD cache credential
by seojeong kim 08 Jul '24

08 Jul '24

/var/lib/sss/db/ I try to use SSSD offline authentication. under /var/lib/sss/db/ cache_mydomain.ldb ccache_mydomain.ldb config.ldb fast_ccache_mydomain.ldb sssd.ldb timestamps_samsungsre.com.ldb SSSD offline authentication works with the cached credential and credential will be stored after the last successful login. How can I check if SSSD credential cached properly after the successful login? Which file should I check ?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users July 2024