[PATCH] Add support for delayed kinit if offline (rebase for master) and offline fix
by Sumit Bose
Hi,
the first patch is the rebased version of the delayed authentication
patch for 1.2.
The second patch moves the deletion of the old ccache file to the point
where we already have a new ccache file. Currently it is removed before
we access the server and it is lost if the server does not reply. I
needed this patch to get the delayed authentication patch work properly
with the master branch, but have not seen similar problems with 1.2 so
far. But in general it might be needed for 1.2, too.
bye,
Sumit
13 years, 11 months
[PATCH] Try all servers during Kerberos auth
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The Kerberos backend would previously try only the first server and if
it was unreachable, it immediatelly went offline.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvYKEIACgkQHsardTLnvCXzaQCgsqdFvrQd2ht0jf8x5m0Ktc8r
y7wAmgL37AN17gXBBn9j3vFlSmXSsdfi
=dkCL
-----END PGP SIGNATURE-----
13 years, 11 months
fun with fc13, ldaps, uids
by Bobby Krupczak
Hi!
(I subscribed to the list but am not receiving the email yet. I'm
reading replies via the archive.)
>I'm guessing rdk has a UID < 1000. This is generally a bad idea for
>network accounts, as they're vulnerable to colliding with local
>accounts. It sounds like in your case you actually have control over
>the UID range, so it might be possible for you to change the UID.
>Otherwise, change the min_id setting in sssd.conf to something more
>appropriate for your environment. (We have that there to try to
>protect against network vs. local ID conflicts)
[root@columbia openldap]# id rdk
uid=6169(rdk) gid=100(users) groups=100(users),109(slide),110(www)
My account is old as the hills and so I've kept my uid. I agree that
standardized numbering ranges is a very good thing.
What are the defaults for sssd for uid ranges? I see were the options
can be set but dont know what msSFU30UidNumber is.
# ldap_user_uid_number = msSFU30UidNumber
# ldap_user_gid_number = msSFU30GidNumber
Thanks,
Bobby
13 years, 11 months
min_ids in sssd.conf
by Bobby Krupczak
Hi!
Sorry, botched my last post.
smyrna.krupczak.org%id
uid=6169(rdk) gid=100(users) groups=100(users),109(slide),110(www)
[root@indianapolis sssd]# grep min_id /etc/sssd/sssd.conf
# min_id = 500
# min_id = 1000
min_id = 1000
So, presumably, my uid of 6169 is in the range. Or, is there some
default ldap min_id I'm running up against?
(I probably ought to download the source . . . was hoping to avoid that.)
Thanks,
Bobby
13 years, 11 months
Re: [SSSD] fun with sssd, fc13, ldaps, start_tls?
by Bobby Krupczak
Hi!
[Just subscribed so I'll see replies to the list.]
>This is almost certainly your problem. The server is not allowing access
>to the RootDSE (probably by misconfigured ACI). Without the RootDSE, we
>can't detect the capabilities of the server and cannot proceed.
>
>The LDAP specification requires that the RootDSE be readable by all. I'm
>not sure why the ldapsearch tool works, but it shouldn't.
>
>Also, what version of the SSSD are you running?
I'm sure its my problem -- I've got a lot of them! :)
I used the ORA LDAP book, originally, to set up my ldap server and
clients but I found the book a really difficult read. Thats neither
here nor there though.
I'm using sssd 1.1.1-3 fc13.x86_64
Linux indianapolis.krupczak.org 2.6.33.4-95.fc13.x86_64 #1 SMP Thu May
13 05:16:23 UTC 2010 x86_64 x86_64 x86_64 GNU/Linux
I went to my slapd.conf file, on my ldap server, and configured what I
think is rootdse read permissions and restarted everything.
access to dn.base="" by * read
No luck though. The dse error message goes away but still cannot
resolve usernames.
# cd ~rdk
-bash: cd: ~rdk: No such file or directory
In the log file, I get this now.
# tail sssd_default.log
[sssd[be[default]]] [set_server_common_status] (4): Marking server
'columbia.krupczak.org' as 'name resolved'
[sssd[be[default]]] [be_resolve_server_done] (4): Found address for server
columbia.krupczak.org: [192.24.251.115]
[sssd[be[default]]] [simple_bind_send] (4): Executing simple bind as: (null)
[sssd[be[default]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[default]]] [simple_bind_done] (3): Bind result: Success(0), (null)
[sssd[be[default]]] [fo_set_port_status] (4): Marking port 636 of server 'columbia.krupczak.org' as 'working'
[sssd[be[default]]] [set_server_common_status] (4): Marking server
'columbia.krupczak.org' as 'working'
[sssd[be[default]]] [sdap_save_user_send] (2): User [rdk] filtered out! (id out of range)
[sssd[be[default]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring.
[sssd[be[default]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success
My apologies if these are stupid ldap admin errors on my part . . .
Thanks,
Bobby
13 years, 11 months
fun with sssd, fc13, ldaps, start_tls?
by Bobby Krupczak
Hi!
I'm installing a new fc13 machine and want it to authenticate to my
existing (working) ldap server.
I went through authconfig and set up ldaps for authentication.
ldapsearch works fine (but uses /etc/ldap.conf and
/etc/openldap/ldap.conf)
I cant get my sssd to authenticate properly. After getting the
debugging to work, I see this in debug ouput:
[sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
[sssd[be[default]]] [resolv_gethostbyname_send] (4): Trying to resolve
A record of 'columbia.krupczak.org'
[sssd[be[default]]] [set_server_common_status] (4): Marking server
'columbia.krupczak.org' as 'resolving name'
[sssd[be[default]]] [set_server_common_status] (4): Marking server
'columbia.krupczak.org' as 'name resolved'
[sssd[be[default]]] [be_resolve_server_done] (4): Found address for server
columbia.krupczak.org: [192.24.251.115]
[sssd[be[default]]] [sdap_get_rootdse_done] (2): No RootDSE for server ?!
[sssd[be[default]]] [fo_set_port_status] (4): Marking port 636 of
server 'columbia.krupczak.org' as 'not working'
[sssd[be[default]]] [acctinfo_callback] (4): Request
processed. Returned 3,2,Enum Users Failed
[sssd[nss]] [sss_dp_get_reply] (4): Got reply (3, 2, Enum Users
Failed) from Data Provider
[sssd[nss]] [nss_cmd_getpwnam_dp_callback] (2): Unable to get
information from Data Provider Error: 3, 2, Enum Users Failed
So, it looks like ldap connection is made and then tossed. My ldap
server is using ssl but not start_tls.
Any suggestions as to config settings to try/change?
I do have ldaps set for the URI. All the settings are virtually
default and vanilla fc13 install.
I commented out "ldap_is_use_start_tls" so my understanding is that is
default False.
Thanks,
Bobby
13 years, 11 months
Questions about sssd-krb5
by David O'Brien
I have a few questions about configuring SSSD to use KRB5
authentication, mostly taken from the man page. I've made lots of
abbreviations, just leaving in the critical bits. Options with no
description are there for a reason.
CONFIGURATION OPTIONS
"If the auth−module krb5 is used in a SSSD domain,..."
- Is this the same as saying, "If you use Kerberos as your auth provider"?
"... the following options must be used."
- Is krb5_kpasswd an exception to this? That is, if the change
password service *is* running on the KDC, then there is no reason or
requirement to define alternative servers, right? In the example that I
have in the user doc (see bottom of page), isn't this defined as follows:
chpass_provider = krb5
(I'm still getting a handle on this change password provider part)
krb5_kdcip (string)
krb5_realm (string)
krb5_changepw_principal (string)
krb5_kpasswd (string)
If the change password service is not running on the KDC
alternative servers can be defined here.
krb5_ccachedir (string)
krb5_ccname_template (string)
krb5_auth_timeout (integer)
The following three options are included in the man page "must be used"
list, but do not appear in the example that I currently have in the user
doc (shown at bottom). Should they be?
krb5_validate (boolean)
krb5_keytab (string)
krb5_store_password_if_offline (boolean)
======
Current User Doc Example
[domain/KRBDOMAIN]
enumerate = false
id_provider = ldap
chpass_provider = krb5
ldap_uri = ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
auth_provider = krb5
krb5_kdcip = 192.168.1.1
krb5_realm = EXAMPLE.COM
krb5_changepw_principal = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
At this point I'll probably head off home and read the next section in
my Kerberos book...
cheers
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
13 years, 11 months
Announcing the System Security Services (SSSD) 1.2.0 Release
by Stephen Gallagher
The System Security Services Daemon team is proud to announce the
release of SSSD 1.2.0, our newest stable release. As usual, it is
available for download at https://fedorahosted.org/sssd
This is a very exciting release for the SSSD, as 1.2.0 is planned to be
included as a part of Red Hat Enterprise Linux 6. It should appear in
the upcoming second beta release of Red Hat Enterprise 6.
As for the changes since the last development release (1.1.92):
== Highlights ==
* Support ServiceGroups for FreeIPA v2 HBAC rules
* Fix long-standing issue with auth_provider = proxy
* Better logging for TLS issues in LDAP
== Detailed Release Notes ==
David O'Brien (1):
* Copy-edit and format review sssd.conf
Jakub Hrozek (1):
* SSSDConfigAPI fixes
Petter Reinholdtsen (1):
* Remove bash-isms from configure macros
Piotr Drąg (1):
* Update pl translation
Stephen Gallagher (9):
* Add a better error message for TLS failures
* Add enumerate details to the manpage and examples
* Make data provider id_callback public
* Fix error reporting for be_pam_handler
* Proxy provider PAM handling in child process
* Display name of PAM action in pam_print_data()
* Fix queuing bug in proxy provider
* Support password changes in chpass_provider = proxy
* Release SSSD version 1.2.0
Sumit Bose (9):
* Reset run_online_cb flag even if there are no callbacks
* Fix check if LDAP id provider is already initialized
* Defer sbus_dispatch() for 30ms during reconnect
* Copy pam data from DBus message
* Remove signal event if child was terminated by a signal
* Do not modify IPA_DOMAIN when setting Kerberos realm
* Move parse_args() to util
* Check ipaEnabledFlag
* Use new schema for HBAC service checks
Yuri Chornoivan (1):
* Update uk translation
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months