[PATCHES] Enhancements for building on Gentoo
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Further patches submitted by Maxim through the upstream Trac at
https://fedorahosted.org/sssd/ticket/606
I rebased these patches atop the current master and tested them. I
squashed two of them together since they were mutually dependent and
very very small.
Ack.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxz3c4ACgkQeiVVYja6o6N14ACfffjeD+OYsU9Z8+L1HKgxqKTV
7lUAn2P9zDO1wRSMl8AiQjf8pPzko/6g
=jUC3
-----END PGP SIGNATURE-----
13 years, 7 months
remapping ldap_default_authtok_type
by Andy Kannberg
Hi all,
In our setup, we run into the following problem: When sssd is configured,
the authentication against ldap fails, but succeeds against kerberos/AD. Our
ldap/edirectory guru has, as far as he is concerned, pinned the problem down
due to the fact that ldap authentication fails with the logging saying
"password failed":
Here's the part in /var/log/secure:
Aug 30 11:45:36 hpdw0001 sshd[27645]: pam_sss(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=
hpdw0001.ddns.nl-htc01.nxp.com
user=nxp21358
Aug 30 11:45:36 hpdw0001 sshd[27645]: pam_sss(sshd:auth): received for user
nxp21358: 6 (Permission denied)
Aug 30 11:45:38 hpdw0001 sshd[27645]: Failed password for nxp21358 from
134.27.211.178 port 51963 ssh2
And the part in /var/log/sssd/
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (6):
calling ldap_search_ext with
[(&(uid=nxp21358)(objectclass=NxpUserAuxClass))][ou=TS
T_EMEA_NL-TST01,ou=Locations,ou=NXDI,o=NXP].
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [objectClass]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [uid]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [userPassword]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [uidNumber]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gidNumber]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [gecos]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [homeDirectory]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [loginShell]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbPrincipalName]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [cn]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [modifyTimestamp]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowLastChange]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowMin]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowMax]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowWarning]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowInactive]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowExpire]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [shadowFlag]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbLastPwdChange]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [krbPasswordExpiration]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7):
Requesting attrs: [pwdAttribute]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (8):
ldap_search_ext called, msgid = 9
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x4d1eeb0], connected[1], ops[0x4d5be80], ldap[0x4d1f060]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_parse_entry] (9):
OriginalDN: [cn=nxp21358,ou=Personal,ou=People,ou=NXDI,o=NXP].
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x4d1eeb0], connected[1], ops[0x4d5be80], ldap[0x4d1f060]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_done] (6):
Search result: Success(0),
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9):
Receiving info for the user
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: sh[0x4d1eeb0], connected[1], ops[(nil)], ldap[0x4d1f060]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8):
Trace: ldap_result found nothing!
Now, browsing through the options that can be set, we sat that we were able
to set an ldap_default_authtok_type. However, the only possible option here
is "password". However, the object "password" is unknown in eDirectory. All
other options can be set/remapped to other attributes, and this particular
one cannot. Is there a work around for this that anyone knows of ?
best regards,
Andy
13 years, 7 months
[PATCH] Support password obfuscation in sssd.conf
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[PATCH 1/7] Move crypto functions into its own subdir
A refactoring patch that creates a common util/crypto subdir with
per-implementation subdirectories for each underlying crypto library
supported by SSSD.
[PATCH 2/7] Add safe copy/move macros for uint16_t
These will be used later on in the code
[PATCH 3/7] Password obfuscation utility functions
This is where the actual obfuscation happens.
Adds two utility functions - one to obfuscate a password and inverse to
extract the cleartext password back. So far, only NSS-based
implementation is provided.
[PATCH 4/7] Fix pysss linking
I noticed that the python bindings were not properly linked so a simple
import pysss failed
[PATCH 5/7] Python bindings for obfuscation
Provides python bindings for utility functions from patch 3/7. These
will be used later on in the obfuscation tool itself.
[PATCH 6/7] sss_obfuscate tool
A tool to add obfuscated passwords into the SSSD config file
[PATCH 7/7] Deobfuscate password in back ends
When obfuscated password is used in config file, the LDAP backend
converts it back to clear text and uses it to authenticate to the
server.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkx7+ksACgkQHsardTLnvCWpMACeK0NuGKyhlowPR6LSX6eGtYzB
0EYAniANilgnHBHDBBpXNHTZjdxYrE/+
=fRlo
-----END PGP SIGNATURE-----
13 years, 7 months
Updates of sssd-ldap man page
by Jan Zelený
Hello everybody,
I've done review of sssd-ldap. Since I'm new here, I'd like to post my findings
here and consult them before I start posting patches to documentation.
The review is related to Ticket #601. Besides issue described in there I found
several other missing config options and some other inconsistencies:
ldap_schema is missing supported values AD and IPA, which seem to have the
same behavior as RFC2307bis. It would be good to at least mention this and
maybe a plan for future.
ldap_search_timeout is missing, but it is present in sssd 1.2.2. It seems it
is still used, so I'd like to know what is the plan here (if I should at least
put a note about it in documentation or not).
ldap_network_timeout and ldap_opt_timeout have both default values 6, not 5.
ldap_access_filter - is ldap even supported as access provider? I tried to find
this out for couple hours and it doesn't seem like it. But it is possible I
just don't see this in the code. If ldap isn't supported as access provider,
I'll mention it in the man page.
Then there are some directives, which are missing in the documentation and
they seem to be recognized by sssd. Please correct me if I've put in this list
directives which aren't recognized and therefore shouldn't be documented.
ldap_search_timeout
ldap_user_search_scope
ldap_user_search_filter
ldap_group_search_scope
ldap_group_search_filter
ldap_offline_timeout
ldap_purge_cache_timeout
entry_cache_timeout
account_cache_expiration
ldap_entry_usn
ldap_rootdse_last_usn
ldap_user_pwd
ldap_user_modify_timestamp
ldap_user_shadow_last_change
ldap_user_shadow_min
ldap_user_shadow_max
ldap_user_shadow_warning
ldap_user_shadow_inactive
ldap_user_shadow_expire
ldap_user_shadow_flag
ldap_user_krb_last_pwd_change
ldap_user_krb_password_expiration
ldap_pwd_attribute
ldap_group_pwd
ldap_group_modify_timestamp
--
Jan
13 years, 8 months
[PATCH] Don't build SSSDConfig API when configured with --without-python-bindings
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
If the --without-python-bindings argument was passed to configure, the
SSSD would fail to build. Prior to this patch, it was only controlling
whether to build the C bindings (for use with the local provider), but
the configure script was written such that it wouldn't look up the path
to python. This broke the SSSDConfig API build.
This patch skips building the SSSDConfig API when
- --without-python-bindings is specified (since presumably the reason for
using this option is that the target system doesn't have python (e.g. an
appliance)
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxpebAACgkQeiVVYja6o6PcMQCgnG7wh/2LM59hGVMQalRQkhT4
HiUAoJVmFDS4qOCLQ6RVVHa4nHjEDCFv
=GMCc
-----END PGP SIGNATURE-----
13 years, 8 months
[PATCH] Remove src/Makefile.am and src/configure.ac
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
They are no longer used. The toplevel Makefile.am builds
everything now. I forgot to remove them when I moved the Makefile
commands up to the root.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxydQYACgkQeiVVYja6o6OmrgCfTJpv48M1tjaDsjnispJ0V0CB
9nkAni8Ib+UOTr3otD1VbCqS9OptEwAo
=Iauc
-----END PGP SIGNATURE-----
13 years, 8 months
[PATCHES] Fix builds on Gentoo
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Two patches submitted by Maxim <kolmax94(a)gmail.com>
I ack them both.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxydUYACgkQeiVVYja6o6P+fgCeOn4B4U3io10QL0ff/VbkbIFS
G0gAoIIvf7sVR2SJHkNy8TRCIYw9Zjo8
=vwWJ
-----END PGP SIGNATURE-----
13 years, 8 months
[PATCH] Fix two problems with --as-needed
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
On Fedora, I saw two problems when building and using sssd with
- -Wl,--as-needed:
The configure-time check for HAVE_DBUS_WATCH_GET_UNIX_FD wasn't run
correctly which resulted in using the deprecated DBus function and
subsequent GCC warning. The other issue was that the LDAP backend
wouldn't start and complained about "libsss_ldap.so: undefined symbol:
hash_error_string".
The attached patch addresses them. It is at least partial fix for #559.
Jakub
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxO5PEACgkQHsardTLnvCVqzACfVKjUjDMLP5OWK9md9hoL7nbU
TNcAn2fXTvI1SIPlxJ5faPYgO23zAnCp
=OUib
-----END PGP SIGNATURE-----
13 years, 8 months
how does enumeration work
by Eric Doutreleau
hi
i m trying to use sssd 1.2.2-19 on my fedora 13 machine and i have some
questions about enumeration.
Here is my sssd.conf ( ldap part )
[domain/default]
ldap_id_use_start_tls = False
ldap_tls_reqcert = never
cache_credentials = True
ldap_search_base = dc=int-evry,dc=fr
ldap_user_search_base = ou=People,dc=int-evry,dc=fr
ldap_group_search_base = ou=Group,ou=System,dc=int-evry,dc=fr
#ldap_group_search_base = ou=Groups,dc=int-evry,dc=fr
chpass_provider = none
id_provider = ldap
auth_provider = ldap
debug_level = 3
min_id = 1
ldap_uri = ldap://ldap2.int-evry.fr/ , ldap://ldap3.int-evry.fr/ ,
ldap://ldap1.int-evry.fr/
ldap_schema = rfc2307
access_provider = permit
ldap_default_bind_dn = cn=mcibind,ou=System,dc=int-evry,dc=fr
ldap_default_authtok_type = password
ldap_default_authtok = xxxxx
enumerate = True
create_homedir = True
tested is an account that have never logged on the computer.
when the network is out
i type
getent passwd | grep tested
tested:*:14501:145:RASSAR:/mci/mci/tested:/usr/local/bin/bash
the account tested is here
but i can't log with this account
here is the message on the secure log file
Aug 23 11:44:39 b008-07 login: pam_unix(login:auth): authentication
failure; logname=LOGIN uid=0 euid=0 tty=tty4 ruser= rhost= user=tested
Aug 23 11:44:39 b008-07 login: pam_sss(login:auth): authentication
failure; logname=LOGIN uid=0 euid=0 tty=tty4 ruser= rhost= user=tested
Aug 23 11:44:39 b008-07 login: pam_sss(login:auth): received for user
tested: 9 (Authentication service cannot retrieve authentication info)
Aug 23 11:44:40 b008-07 login: FAILED LOGIN 1 FROM (null) FOR tested,
Authentication failure
Does enumeration permit to store credentials for people that have never
logged in the machine?
13 years, 8 months