[PATCH] autofs: load the correct option
by Jakub Hrozek
The feature works because most of the time we would load the id_provider
value. The two cases that were broken are loading the LDAP provider from
IPA domain and specifying "none" to disable the autofs provider altogether.
I pushed the patch under the one-liner rule.
12 years
[PATCH] Remove forgotten DEBUG message
by Jakub Hrozek
I left a level-0 DEBUG message behind from when I was debugging a
startup issue in the IPA autofs provider.
Pushed to master under the 1-liner rule.
12 years
pick up "EXTERNAL MECH" identity to log in
by Olivier
Hello there
Not sure that this is feasable nor that this is the right place
to submit this question but I think it is.
I use sssd to deal with authentication on my linux boxes :
OK
I also know how to use external SASL_MECH to bind my
ldap server : I have produced and install a certificate with
an appropriate subject and signed it by a CA that is known
by my ldap server. Like this, I can bind the server over TLS
with my identity and without providing any passwd.
$ ldapsearch -ZZ uid=olivier
SASL/EXTERNAL authentication started
SASL username: 0.9.2342.19200300.100.1.1=guillard,ou=staff,dc=example,dc=fr
SASL SSF: 0
...response...
Right : nothing new.
I was now wondering if there would have any way to annonce
my certificate using the "external SASL_MECH" mechanism
over a login process to a linux box (let say using ssh), so that
pam would not ask me to type a "login" and a "password" to
log in ?
Don't hesitate to fire if my question is stupid.
Thanks,
---
Olivier
PS, to rephrase that : I'm looking for a way to use a personnal key
to login without having to provide a password. ssh keys are not
the right solution because I would need to install the public key
in every authorized_key on my network ( I would like a centralized
solution ).
I also found this :
http://code.google.com/p/openssh-lpk/
But I don't want to patch ssh if possible since I highly prefere to
use standard tools provided as much as possible
I'm on RedHat6
12 years
Announcing SSSD 1.8.2
by Stephen Gallagher
The SSSD team is proud to announce the bugfix release of the System
Security Services Daemon version 1.8.2.
As usual, the source can be downloaded at https://fedorahosted.org/sssd
== Highlights ==
* Several fixes to case-insensitive domain functions
* Fix for GSSAPI binds when the keytab contains unrelated
principals
* Fixed several segfaults
* Workarounds added for LDAP servers with unreadable RootDSE
* SSH knownhostproxy will no longer enter an infinite loop
preventing login
* The provided SYSV init script now starts SSSD earlier at startup
and stops it later during shutdown
* Assorted minor fixes for issues discovered by static analysis
tools
== Tickets fixed ==
https://fedorahosted.org/sssd/ticket/1237
only free if sure data has been allocated
https://fedorahosted.org/sssd/ticket/1245
"Error looking up public keys" while ssh to replica using IP
address.
https://fedorahosted.org/sssd/ticket/1251
SSSD memory usage continuously growing
https://fedorahosted.org/sssd/ticket/1253
Service lookup shows case sensitive names twice with
case_sensitive=false
https://fedorahosted.org/sssd/ticket/1257
Unable to bind to IPA server when minssf set
https://fedorahosted.org/sssd/ticket/1259
Initial service lookups having name with uppercase alphabets
doesn't work.
https://fedorahosted.org/sssd/ticket/1260
RFE: support case-insensitive service lookups by port including
protocols
https://fedorahosted.org/sssd/ticket/1268
sss_ssh_knownhostproxy infinite loop hangs SSH login
https://fedorahosted.org/sssd/ticket/1269
sssd: Uses the wrong key for GSSAPI when there a multiple realms
in a single keytab.
https://fedorahosted.org/sssd/ticket/1270
sssd_nss crashes on request when no back end is running
https://fedorahosted.org/sssd/ticket/1272
Unable to lookup user, group, netgroup aliases with
case_sensitive=false.
https://fedorahosted.org/sssd/ticket/1273
SSSD should start before NFS processes
https://fedorahosted.org/sssd/ticket/1274
Wrong resolv_status might cause crash when name resolution times
out
https://fedorahosted.org/sssd/ticket/1282
Wrong attribute counter causing crash during IPA service lookups
https://fedorahosted.org/sssd/ticket/1283
accessing an undefined variable in list_missing_attrs might
crash SSSD
https://fedorahosted.org/sssd/ticket/1288
Invalid keytab path logged when using the default keytab
https://fedorahosted.org/sssd/ticket/1293
Building manpages in a parallel build dir is broken
== Detailed Changelog ==
Jakub Hrozek (17):
* Fix uninitialized variable
* Free entry found in negative cache
* Make the string_equal() function public
* Save alias of the primary name, too
* NSS: Look for services with correct case when cache is updated
* AUTOFS: fix copy-and-paste bug in the autofs client
* LDAP services: Keep the protocol around
* Silence Coverity warning in the autofs test tool
* Return correct resolv_status on resolver timeout
* Add sss_get_cased_name_list utility function
* LDAP services: Save lowercased protocol names in
case-insensitive domains
* Proxy services: Save lowercased protocol names and aliases in
case-insensitive domains
* Fix off-by-one error in principal selection
* Catch cases where D-Bus connection is NULL
* Fix regression in SSSDConfig.py
* Use the correct options counter
* netlink integration: ensure that interface name is
NULL-terminated
Jan Cholasta (3):
* SSH: Allow clients to explicitly specify host alias
* SSH: Canonicalize host name and do reverse DNS lookup in
sss_ssh_knownhostsproxy
* SSH: Fix infinite loop in sss_ssh_knownhostsproxy
Stephen Gallagher (10):
* Bumping version to 1.8.2
* IPA: Allow service lookups
* SYSDB: Save only lowercased aliases in case-insensitive domains
* LDAP: Errors retrieving the RootDSE should not be fatal
* Start SSSD earlier and stop it later
* LDAP: Add better error logging when ldap_result() fails
* LDAP: Fix memory leaks in synchronous_tls_setup
* Fix building manpages in parallel build dirs
* Clean up log messages about keytab_name
* Updating translation files for 1.8.2 release
Sumit Bose (1):
* Always initialize the returned data in sss_krb5_princ_realm()
Valid signature (Stephen Gallagher <sgallagh(a)redhat.com>)
12 years
[PATCH] Fix building manpages in parallel build dirs
by Stephen Gallagher
Commit 2ebb3cf3d7062860343c3db1b53173c9c6547038 introduced an issue
when building manpages in parallel build dirs. It unnecessarily
modified the XML_DOC definition to restrict it to basing its
contents on the man_MANS variable. Unfortunately, this means that
when we entered the recursion in all-local we would be effectively
turning XML_DOC into $(srcdir)/$(lang)/manpage.N.xml when we really
only care that the source language XML document exists.
This patch reverts that portion of the change.
Fixes https://fedorahosted.org/sssd/ticket/1293
12 years