Hi, thanks for the answer.

To clarify:

1. "What doesn't work?"

=> Command "sss_cache -E" on client host... doesn't have impact on possibility to logon with cached credentials. I can login again with debug info: "Authenticated with cached credentials." << which come from "pam_verbosity = 3" parameter inside sssd.conf

//of course I have disabled both (master and replica) IPA services by "ipactl stop" before testing off-line login.

2. "What are you expecting?" As an linux env admin(s) we are going to implement IdM/IPA solution for "ux" part of our mixed win-linux hosts env. We realized that "SSH key management with local accounts" is... let's say "not scalable" ;-)

...but in the other hand I need to be sure that in case of admin/user account modification or IPA server unavailability => user will not have a possibility to logon (there are some users from AD which should have acces to shell and they will be added via IPA<=>AD trust [final step of our deployment]. //I mean that this "off-line logon" is ...expectetd behavior, but I want to have full control over it.

I know that there is no possibility to turn of caching due to sofisticated architecture of sssd daemon (https://sssd.io/docs/architecture.html) but, as i described above, we need to know "what is going on under the hood".

3. Is there only solution for that - is a ...removing all files from '/var/lib/sss/db' from each client-host on which particular user has had an access?

Regards, M.

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

czwartek, 7 października 2021 14:51, Rob Crittenden rcritten@redhat.com napisał(a):

m57n2 via FreeIPA-users wrote:

...

Hello,

I have had set up a test-bed environment consist of:

IPA server [master] - OL8.4

IPA server [replica] - OL8.4

IPA client1 - OL8.4

IPA client2 - OL8.4

IPA client3 - Ubuntu20.04LTS

//I've installed "master" manually and the rest of hosts via ansible

playbooks.

All works fine: user created on IPA directory [let's say: "adminux"] can

succesfully login on clients with SUDO priviliges.

Now I started to test offline [sssd] login ....and it works [too]fine =>

user can log into system even though it was disabled on IPA server!

I started to tune-up sssd.conf parameters:

root@cl3:~# vim /etc/sssd/sssd.conf

[domain/ux.example.com]

id_provider = ipa

ipa_server = srv, idm1.ux.example.com

ipa_domain = ux.example.com

ipa_hostname = cl3.ux.example.com

auth_provider = ipa

chpass_provider = ipa

access_provider = ipa

cache_credentials = True

ldap_tls_cacert = /etc/ipa/ca.crt

dyndns_update = True

dyndns_iface = ens33

krb5_store_password_if_offline = True

*entry_cache_timeout = 60

account_cache_expiration = 1

[sssd]

services = nss, pam, ssh, sudo

domains = ux.example.com

[nss]

homedir_substring = /home

*enum_cache_timeout = 10

entry_cache_nowait_percentage = 0

[pam]

*pam_verbosity = 3

offline_credentials_expiration = 1

[sudo]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

[secrets]

[session_recording]

I was also trying to erase sssd cache with command:

#sss_cache -E

...but it doesn't work in my test env!

What doesn't work? What are you expecting?

...

I'll appreciate any suggestions "How can I control off-line logon

cache in case of user creation, user deletion, user rights change and

so on..." ?

If its offline then the client will not see user creation, deletion, etc

because it's offline, right?

rob

Hello again, thanks for quick answer ;-)

Meanwhile, I was dig man pages and solutions ...which led me to "sss_debuglevel" command and then to "sssctl" command.

The same situation => "sssctl cache-expire" ...didn't work but => "sssctl cache-remove" did the work as I expected!

I was interested what this particularo command do and ran it again with strace:

#strace sssctl cache-remove |\truncated output from above command/|: ********************************************************************* write(1, "SSSD must not be running. Stop S"..., 56SSSD must not be running. Stop SSSD now? (yes/no) [yes] ) = 56 read(0, yes "yes\n", 1024) = 4 getresuid([0], [0], [0]) = 0 getresgid([0], [0], [0]) = 0 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0) = 9 connect(9, {sa_family=AF_UNIX, sun_path="/var/run/dbus/system_bus_socket"}, 33) = 0 fcntl(9, F_GETFL) = 0x2 (flags O_RDWR) fcntl(9, F_SETFL, O_RDWR|O_NONBLOCK) = 0 geteuid() = 0 getsockname(9, {sa_family=AF_UNIX}, [128->2]) = 0 poll([{fd=9, events=POLLOUT}], 1, 0) = 1 ([{fd=9, revents=POLLOUT}]) sendto(9, "\0", 1, MSG_NOSIGNAL, NULL, 0) = 1 sendto(9, "AUTH EXTERNAL 30\r\n", 18, MSG_NOSIGNAL, NULL, 0) = 18 poll([{fd=9, events=POLLIN}], 1, -1) = 1 ([{fd=9, revents=POLLIN}]) read(9, "OK 965e44f2f27fc580d53341ec615ea"..., 2048) = 37 poll([{fd=9, events=POLLOUT}], 1, -1) = 1 ([{fd=9, revents=POLLOUT}]) sendto(9, "NEGOTIATE_UNIX_FD\r\n", 19, MSG_NOSIGNAL, NULL, 0) = 19 poll([{fd=9, events=POLLIN}], 1, -1) = 1 ([{fd=9, revents=POLLIN}]) read(9, "AGREE_UNIX_FD\r\n", 2048) = 15 poll([{fd=9, events=POLLOUT}], 1, -1) = 1 ([{fd=9, revents=POLLOUT}]) sendto(9, "BEGIN\r\n", 7, MSG_NOSIGNAL, NULL, 0) = 7 poll([{fd=9, events=POLLIN|POLLOUT}], 1, -1) = 1 ([{fd=9, revents=POLLOUT}]) sendmsg(9, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="l\1\0\1\0\0\0\0\1\0\0\0n\0\0\0\1\1o\0\25\0\0\0/org/fre"..., iov_len=128}, {iov_base="", iov_len=0}], msg_iovlen=2, msg_controllen=0, msg_flags=0}, MSG_NOSIGNAL) = 128 poll([{fd=9, events=POLLIN}], 1, 25000) = 1 ([{fd=9, revents=POLLIN}]) recvmsg(9, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="l\2\1\1\v\0\0\0\1\0\0\0=\0\0\0\6\1s\0\6\0\0\0:1.114\0\0"..., iov_len=2048}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 262 recvmsg(9, {msg_namelen=0}, MSG_CMSG_CLOEXEC) = -1 EAGAIN (Resource temporarily unavailable) sendmsg(9, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="l\1\0\1 \0\0\0\2\0\0\0\240\0\0\0\1\1o\0\31\0\0\0/org/fre"..., iov_len=176}, {iov_base="\f\0\0\0sssd.service\0\0\0\0\7\0\0\0replace\0", iov_len=32}], msg_iovlen=2, msg_controllen=0, msg_flags=0}, MSG_NOSIGNAL) = 208 poll([{fd=9, events=POLLIN}], 1, 120000) = 1 ([{fd=9, revents=POLLIN}]) recvmsg(9, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="l\2\1\1(\0\0\0S\34\0\0-\0\0\0\5\1u\0\2\0\0\0\6\1s\0\6\0\0\0"..., iov_len=2048}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 104 recvmsg(9, {msg_namelen=0}, MSG_CMSG_CLOEXEC) = -1 EAGAIN (Resource temporarily unavailable) write(1, "Creating backup of local data..."..., 33Creating backup of local data... ) = 33 umask(077) = 022 mkdir("/var/lib/sss/backup", 0700) = -1 EEXIST (File exists) umask(022) = 077 access("/var/lib/sss/backup/sssd_user_overrides.bak", F_OK) = 0 write(1, "SSSD backup of local data alread"..., 66SSSD backup of local data already exists, override? (yes/no) [no] ) = 66 read(0, yes "yes\n", 1024) = 4 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fbde72f3b90) = 79307 wait4(79307, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 79307 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=79307, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fbde72f3b90) = 79308 wait4(79308, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 79308 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=79308, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- write(1, "Removing cache files...\n", 24Removing cache files... ) = 24 openat(AT_FDCWD, "/var/lib/sss/db", O_RDONLY|O_NOFOLLOW|O_CLOEXEC|O_DIRECTORY) = 10 fstat(10, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 fcntl(10, F_GETFL) = 0x38000 (flags O_RDONLY|O_LARGEFILE|O_NOFOLLOW|O_DIRECTORY) fcntl(10, F_SETFD, FD_CLOEXEC) = 0 getdents64(10, /* 8 entries */, 32768) = 320 newfstatat(10, "fast_ccache_UX.EXAMPLE.COM", {st_mode=S_IFREG|0600, st_size=756, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlinkat(10, "fast_ccache_UX.EXAMPLE.COM", 0) = 0 newfstatat(10, "ccache_UX.EXAMPLE.COM", {st_mode=S_IFREG|0600, st_size=1462, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlinkat(10, "ccache_UX.EXAMPLE.COM", 0) = 0 newfstatat(10, "timestamps_ux.EXAMPLE.COM.ldb", {st_mode=S_IFREG|0600, st_size=1286144, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlinkat(10, "timestamps_ux.EXAMPLE.COM.ldb", 0) = 0 newfstatat(10, "config.ldb", {st_mode=S_IFREG|0600, st_size=1286144, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlinkat(10, "config.ldb", 0) = 0 newfstatat(10, "sssd.ldb", {st_mode=S_IFREG|0600, st_size=1286144, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlinkat(10, "sssd.ldb", 0) = 0 newfstatat(10, "cache_ux.EXAMPLE.COM.ldb", {st_mode=S_IFREG|0600, st_size=1609728, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlinkat(10, "cache_ux.EXAMPLE.COM.ldb", 0) = 0 getdents64(10, /* 0 entries */, 32768) = 0 close(10) = 0 openat(AT_FDCWD, "/var/run/sssd.pid", O_RDONLY) = -1 ENOENT (No such file or directory) write(1, "SSSD needs to be running. Start "..., 57SSSD needs to be running. Start SSSD now? (yes/no) [yes] ) = 57 read(0, yes "yes\n", 1024) *************************************************************

...shows that this actually removes files from /var/lib/sss/db

Thanks again! REgards

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

czwartek, 7 października 2021 15:47, Alexander Bokovoy via FreeIPA-users freeipa-users@lists.fedorahosted.org napisał(a):

On to, 07 loka 2021, m57n2 via FreeIPA-users wrote:

...

Hi,

thanks for the answer.

To clarify:

1. "What doesn't work?"

=> Command "sss_cache -E" on client host... doesn't have impact on

possibility to logon with cached credentials. I can login again with

debug info: "Authenticated with cached credentials." << which come from

"pam_verbosity = 3" parameter inside sssd.conf

//of course I have disabled both (master and replica) IPA services by

"ipactl stop" before testing off-line login.

'sss_cache -E' invalidates entries, it does not remove them completely.

Man page for sss_cache says about it quite clearly:

Invalidated records are forced to be reloaded from server as soon as

related SSSD backend is online.

So if you are offline, the database will still be present and if you

have cached credentials, you'll be able to login with the data stored in

the database content.

You certainly should not use sss_cache to imitate offline mode.

If you have removed the cache with 'sssctl cache-remove', then you'd be

unable to login at all when an SSSD backend is offline.

...

2. "What are you expecting?"

   As an linux env admin(s) we are going to implement IdM/IPA solution for

   "ux" part of our mixed win-linux hosts env. We realized that "SSH key

   management with local accounts" is... let's say "not scalable" ;-)

...but in the other hand I need to be sure that in case of admin/user

account modification or IPA server unavailability => user will not have

a possibility to logon (there are some users from AD which should have

acces to shell and they will be added via IPA<=>AD trust [final step of

our deployment]. //I mean that this "off-line logon" is ...expectetd

behavior, but I want to have full control over it.

As long as SSSD backend provider is offline, it will rely on the data it

has in the local cache to allow or deny access, if you have enabled the

ability to handle offline cached authentication. This pretty much

corresponds to a similar behavior within Active Directory environment as

well.

If there is no cached information about a specific user locally, then

login will not succeed in offline state of SSSD backend.

...

I know that there is no possibility to turn of caching due to

sofisticated architecture of sssd daemon

(https://sssd.io/docs/architecture.html) but, as i described above, we

need to know "what is going on under the hood".

3. Is there only solution for that - is a ...removing all files from

   '/var/lib/sss/db' from each client-host on which particular user has

   had an access?

Either disable offline cached authentication or remove those databases

with 'sssctl cache-remove'.

You have

krb5_store_password_if_offline = True

this is what triggers offline cached authentication.

...

Regards,

M.

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

czwartek, 7 października 2021 14:51, Rob Crittenden rcritten@redhat.com napisał(a):

...

m57n2 via FreeIPA-users wrote:

...

Hello,

I have had set up a test-bed environment consist of:

IPA server [master] - OL8.4

IPA server [replica] - OL8.4

IPA client1 - OL8.4

IPA client2 - OL8.4

IPA client3 - Ubuntu20.04LTS

//I've installed "master" manually and the rest of hosts via ansible

playbooks.

All works fine: user created on IPA directory [let's say: "adminux"] can

succesfully login on clients with SUDO priviliges.

Now I started to test offline [sssd] login ....and it works [too]fine =>

user can log into system even though it was disabled on IPA server!

I started to tune-up sssd.conf parameters:

root@cl3:~# vim /etc/sssd/sssd.conf

[domain/ux.example.com]

id_provider = ipa

ipa_server = srv, idm1.ux.example.com

ipa_domain = ux.example.com

ipa_hostname = cl3.ux.example.com

auth_provider = ipa

chpass_provider = ipa

access_provider = ipa

cache_credentials = True

ldap_tls_cacert = /etc/ipa/ca.crt

dyndns_update = True

dyndns_iface = ens33

krb5_store_password_if_offline = True

*entry_cache_timeout = 60

account_cache_expiration = 1

[sssd]

services = nss, pam, ssh, sudo

domains = ux.example.com

[nss]

homedir_substring = /home

*enum_cache_timeout = 10

entry_cache_nowait_percentage = 0

[pam]

*pam_verbosity = 3

offline_credentials_expiration = 1

[sudo]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

[secrets]

[session_recording]

I was also trying to erase sssd cache with command:

#sss_cache -E

...but it doesn't work in my test env!

What doesn't work? What are you expecting?

...

I'll appreciate any suggestions "How can I control off-line logon

cache in case of user creation, user deletion, user rights change and

so on..." ?

If its offline then the client will not see user creation, deletion, etc

because it's offline, right?

rob

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org

To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

--

/ Alexander Bokovoy

Sr. Principal Software Engineer

Security / Identity Management Engineering

Red Hat Limited, Finland

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org

To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure