sssd-users September 2024

sssd-users@lists.fedorahosted.org

8 participants
7 discussions

filter_users using user id
by Francois Rigault 22 Mar '25

22 Mar '25

Greetings, we run some podman containers that come with their own local users, such as this one: ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent: (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461] I would hope to get rid of these requests against the domain. unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users. I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion. I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better. Thank you!

4 4

SSSD problem one-way trust GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)
by Omnis ludis - games 17 Feb '25

17 Feb '25

Good afternoon, please tell me there is such an infrastructure windows domain and samba domain between them, one-sided external outgoing trust relationships are set up, so that users from the windows domain can freely enter the samba domain, I entered the client into the samba domain and all users from the samba domain can safely pass to this client, but that's not the task of users they do not want to authenticate from the windows domain in any way when I try to log in to a client from the samba domain under them, I get the following error in sssd on the client, GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database), do I understand correctly that this works like this, the client accesses the samba domain controller, since there is no given user in samba, the request is redirected to the windows domain controller and that in turn must provide information about this to users from its database kerberos? but for some reason this does not happen, does anyone have at least some information on this error, I have already tried many different scenarios and can not log in as a user in any way, as if samba does not process information correctly, while if you build a two-way trusting relationship, then everything works as it should

2 1

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

Nuisance-level extraneous logging in /var/log/sssd/krb5_child.log file. How to suppress?
by Spike White 24 Oct '24

24 Oct '24

All, This is not a problem. But it is annoying; how do I make it go away? Every time any user logs into any of our Linux servers, we get these messages in the /var/log/sssd/krb5_child.log file: (2024-07-23 11:20:44): [krb5_child[947088]] [main] (0x3f7c0): [RID#26239] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x3f7c0): [RID#27336] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] krb5_child started. * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x1000): [RID#27336] total buffer size: [92] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] cmd [249 (pre-auth)] uid [2025431] gid [2025431] validate [false] enterprise principal [true] offline [false] UPN [ AdmSpike_White(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] ccname: [KCM:] old_ccname: [KCM:] keytab: [not set] * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] Missing krb5_keytab option for domain, looking for default one * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_kt_default_name() returned: FILE:/etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_child will default to: /etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_use_fast] (0x0100): [RID#27336] Not using FAST. * (2024-07-23 14:14:10): [krb5_child[970533]] [become_user] (0x0200): [RID#27336] Trying to become user [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x2000): [RID#27336] Running as [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific renewable lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_canonicalize_option] (0x0100): [RID#27336] Canonicalization is set to [true] * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] Will perform pre-auth * (2024-07-23 14:14:10): [krb5_child[970533]] [tgt_req_child] (0x1000): [RID#27336] Attempting to get a TGT * (2024-07-23 14:14:10): [krb5_child[970533]] [get_and_save_tgt] (0x0400): [RID#27336] Attempting kinit for realm [AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_responder] (0x4000): [RID#27336] Got question [password]. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] Prompt [0][Password for AdmSpike_White\@ AMER.COMPANY.COM(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x0200): [RID#27336] Prompter interface isn't used for password prompts by SSSD. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-07-23 14:14:10): [krb5_child[970534]] [main] (0x3f7c0): [RID#27337] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. We’re ok with the krb5_validate message. We set: krb5_validate = False in /etc/sssd/sssd.conf file because KVNO of host principal gets out of sync between AD and /etc/krb5.keytab file frequently. So we’re comfortable with that one line of logging. It’s all the rest of the logging that we’d prefer not to see. How do we suppress them or eradicate the underlying condition that leads to them appearing? Here is our sssd.conf file. [nss] debug_backtrace_enabled = false #debug_level = 9 filter_groups = root mfe bladelogic_linux_users(a)amer.company.com bladelogic_linux_users(a)emea.company.com bladelogic_linux_users(a)apac.company.com bladelogic_linux_users(a)japn.company.com bladelogic_linux_users(a)company.com oracle filter_users = root mfe oracle [sssd] debug_backtrace_enabled = false #debug_level = 9 domains = amer.company.com domain_resolution_order = amer.company.com, emea.company.com, apac.company.com, japn.company.com, company.com config_file_version = 2 services = nss,pam,ifp reconnection_retries = 3 full_name_format = %1$s [pam] pam_verbosity = 3 #debug_level = 9 offline_credentials_expiration = 3 [ifp] #debug_level = 9 [domain/amer.company.com] filter_groups = root mfe bladelogic_linux_users oracle sudo_provider = none debug_backtrace_enabled = false #debug_level = 9 ad_enabled_domains = company.com, amer.company.com, apac.company.com, emea.company.com, japn.company.com ad_enabled_domains = amer.company.com, apac.company.com, emea.company.com, japn.company.com, company.com # If you enable ignore_group_members, it gives a small perf win, but then # "getent group XXX" shows no members. Perf win not worth the lack of # diagnostics. #ignore_group_members = true id_provider = ad access_provider = simple auth_provider = ad default_shell = /bin/bash ldap_id_mapping = False auto_private_groups = True realmd_tags = joined-with-adcli cache_credentials = True # Not set to true; Passwords stored in this way are kept in plaintext in the kernel keyring and are potentially accessible by the root user (with difficulty). #krb5_store_password_if_offline = True fallback_homedir = /home/%u ldap_sasl_authid = host/austgcore17.us.company.com(a)AMER.COMPANY.COM dyndns_update = False # Using tokengroups is usually a speed optimization #ldap_use_tokengroups = False ldap_search_base = dc=AMER,dc=COMPANY,dc=COM ldap_force_upper_case_realm = True # Set to False, because KVNO of host principal gets out of sync between # AD and /etc/krb5.keytab file frequently. krb5_validate = False simple_allow_groups = amerlinuxsup(a)amer.company.com, amerlinuxeng(a)amer.company.com, emealinuxsup(a)emea.company.com, emealinuxeng(a)emea.company.com, apaclinuxsup(a)apac.company.com, apaclinuxeng(a)apac.company.com, gbllinuxsuppw(a)amer.company.com, bladelogic_linux_users(a)amer.company.com, PRD-1004873-AMER-DBSPOTUNIX(a)amer.company.com, pptsupportpac(a)amer.company.com, unv_legato_admins(a)amer.company.com, scheduling_global(a)amer.company.com, engit-ebpa(a)amer.company.com, amerlinuxengtfssupt(a)amer.company.com, amerlnxsvcdelauttfs(a)apac.company.com, iasnprod(a)amer.company.com, fnms_ops(a)amer.company.com, zabbix-support(a)amer.company.com, globalinfosecopsadm(a)amer.company.com, prd-amer-fnmsopspac(a)amer.company.com, amerlinuxeng simple_allow_users = processehcprofiler(a)amer.company.com, svc_prdautovm(a)amer.company.com, processfoglight(a)amer.company.com, svc_prdprofoglight01(a)amer.company.com, service_ome_linux(a)amer.company.com, svc_prdesquadscounix(a)apac.company.com, serviceunixinstall(a)amer.company.com, admspike_white, oracle # look at https://docs.pagure.org/SSSD.sssd/design_pages/subdomain_configuration.html [domain/amer.company.com/company.com] ldap_search_base = dc=COMPANY,dc=COM [domain/amer.company.com/apac.company.com] ldap_search_base = dc=APAC,dc=COMPANY,dc=COM [domain/amer.company.com/emea.company.com] ldap_search_base = dc=EMEA,dc=COMPANY,dc=COM [domain/amer.company.com/japn.company.com] ldap_search_base = dc=JAPN,dc=COMPANY,dc=COM

2 11

devcontainer
by Ryan Slominski 01 Oct '24

01 Oct '24

Hi, I'm looking for tips on building sssd in a devcontainer. The simplest naive thing: https://github.com/slominskir/sssd-devcontainer/blob/main/Dockerfile ```Dockerfile FROM fedora:40 RUN dnf install 'dnf-command(builddep)' tini git -y ; dnf builddep sssd -y ENTRYPOINT ["/usr/bin/tini", "--"] CMD ["sleep", "infinity"] ``` Configure step fails with: checking for CAP... no configure: error: libcap is missing Ran with: docker build . -t dev docker run --rm --name dev dev docker exec -it dev bash cd /opt git clone https://github.com/SSSD/sssd cd sssd autoreconf -if ./configure Regards, Ryan

4 7

Fwd: LDAP via SSSD identifies users but won't authenticate.
by GrahamC 14 Sep '24

14 Sep '24

Hi, I have existing systems that authenticate via LDAP using SSSD and have recently added a Fedora 40 system, except that it denies login to all of the LDAP users. It can see the users (user and groups owning files are displayed correctly, and the "finger" command finds the users), however for some reason it always fails to authenticate passwords. The following is from /var/log/secure Sep 15 11:26:27 ext5 sshd[265914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.131.55 user=graham Sep 15 11:26:29 ext5 sshd[265914]: Failed password for graham from 192.168.131.55 port 60366 ssh2 The LDAP server is a Fedora 34 but there are many older systems (back to Fedora 19) still authenticating via LDAP. I remember many years ago (I think it was when I was converting from NIS) that I had to change the password format, so maybe I have something old in my setup (passwords appear to be stored as a 52 character encrypted string). I am looking for some pointers as to where to look for testing and troubleshooting this issue. Are there any tools to test sssd authentication? Or any other information that may help me? Thank you /etc/nsswitch contains (on both the working Fedora 34 and the not working Fedora 40 systems) passwd: sss files systemd shadow: files group: sss files systemd hosts: files myhostname dns services: sss files netgroup: sss files automount: sss files aliases: files ethers: files gshadow: files networks: files dns protocols: files publickey: files rpc: files /etc/sssd/sssd.conf contains (on both the working Fedora 34 and the not working Fedora 40 systems) - domain name changed. [sssd] config_file_version = 2 domains = LDAP services = nss, pam [nss] filter_groups = root filter_users = root [pam] [domain/LDAP] id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.mydomain.net ldap_chpass_uri = ldap://ldap.mydomain.net ldap_search_base = dc=mydomain,dc=net ldap_id_use_start_tls = True cache_credentials = True ldap_tls_cacertdir = /etc/openldap/certs ldap_tls_reqcert = allow -- This email has been checked for viruses by AVG antivirus software. www.avg.com

2 2

proper sssd timeout configuration to prevent NAT timeout
by Jaehwan Kim 03 Sep '24

03 Sep '24

Hello. We've got a number (thousands) of hosts inside a private network of cloud environment. These all query the FreeIPA server for user and group information using NAT and a gateway server. However we're having issues with the LDAP queries timing out or becoming unresponsive due to NAT timeout. In order to prevent hosts (clients) from being disconnected due to NAT timeout, we wish to try some sssd timeout values. Because we have difficulty to find out proper timeout of sssd.conf.5 manual pages (website), can you advice us on the proper timeout or propose other way? Thank you. JHK

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users September 2024