Problems with enumerate=true
by Trent Johnson
Hi,
After upgrading from rhel6.3 to the 6.4 sssd-1.9.2-82.7.el6_4.x86_64 we can no longer use enumerate=true with active directory and rfc2307bis.
Upon starting the service, sssd_be consumes 100% of the cpu and getent takes a long time to return results. In the logs we see:
/var/log/messages sssd[be[TESTWIN]]: dereference processing failed : Input/output error
/var/log/sssd/sssd.log [sssd] [mt_svc_sigkill] (0x0010): [TESTWIN][10702] is not responding to SIGTERM. Sending SIGKILL.
Thanks,
Trent
10 years, 11 months
[PATCH] Add 'description' attribute to SSSDConfig API
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
It was mentioned in the manpages, but not accepted by the API
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlGeCicACgkQeiVVYja6o6ODjQCfbouPvjhDqtby51rnflsZvFSk
5PoAnA4CeTZtq52dib8M+j1kjFs1MMly
=62L2
-----END PGP SIGNATURE-----
10 years, 11 months
[PATCH] Fixing critical format string issues.
by Lukas Slebodnik
ehlo,
This week Ondra fix segfault, which was caused by missing argument
in debug message.
> ("nsupdate_get_addrs_done failed: [%d]: [%s]\n",
> sss_strerror(ret)));
I was working on another ticket and I spotted similar bug.
So I decided to enable printf format checking in debug_fn.
There was a huge number of warnings. Attached patch fixes the most critical.
--missing argument(s).
--format '%s', but argument is integer.
--wrong format string, example: '%\n'
There are another 150 warnings, but they aren't critical.
for example:
format '%d' expects argument of type 'int', but argument 2 has type 'size_t'
LS
10 years, 11 months
[PATCH] Adding option to disable retrieving large AD groups.
by Lukas Slebodnik
ehlo,
Jakub, Pavel and me disscus about ticket
https://fedorahosted.org/sssd/ticket/1823
"getgrnam / getgrgid for large user groups is too slow due to range retrieval
functionality"
We decided to add new option to turn the range retrieval with AD. Another
solution could be to add new option to limit the number of group members
processed.
Any comments are welcomed.
This commit adds new option ldap_disable_large_groups with default value FALSE.
If this option is enabled, large groups(>1500) will not be retrieved and
behaviour will be similar like was before commit ae8d047122c
"LDAP: Handle very large Active Directory groups"
LS
10 years, 11 months
sssd pam backend crashing once in a while.
by Steve Traylen
Hi,
We are experienced trouble in our interactive login service where sssd in crashing every few hours in most of the nodes.
We run on Scientific Linux CERN SLC release 6.4 (Carbon) (which is RH 6.4 based), more precisely:
sssd-1.9.2-82.7.el6_4.x86_64
sssd-client-1.9.2-82.7.el6_4.x86_64
We have some logs
(Mon May 20 14:31:27 2013) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services.
(Mon May 20 14:31:27 2013) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector
which is the restart of the backed failing?
Here is our sssd.conf
sssd]
config_file_version = 2
services = nss, pam
domains = CERN
[nss]
filter_groups = pulse,lemon,glance,cvmfs,qemu,root
filter_users = pulse,lemon,glance,cvmfs,qemu,nova,sshd,apache,lsfadmin,root
[pam]
[domain/CERN]
min_id = 101
id_provider = ldap
access_provider = ldap
ldap_uri = ldap://137.138.145.182:389,ldap://137.138.240.48:389,ldap://137.138.144.149:389,ldap://137.138.240.49:389,ldap://137.138.142.25:389,ldap://137.138.145.178:389
ldap_id_use_start_tls = False
ldap_search_base = DC=cern,DC=ch
ldap_user_search_base = OU=Users,OU=Organic Units,DC=cern,DC=ch
ldap_user_search_scope = one
ldap_user_object_class = person
ldap_user_name = sAMAccountName
ldap_user_home_directory = unixHomeDirectory
#
ldap_user_principal = extensionAttribute4
ldap_group_search_base = OU=Unix,OU=Workgroups,DC=cern,DC=ch
ldap_group_search_scope = one
ldap_group_object_class = group
Denied-Users,OU=e-groups,OU=Workgroups,DC=cern,DC=ch))
ldap_access_filter = (&(|(|(&(objectClass=user) (cn=*)))(|(memberOf:1.2.840.113556.1.4.1941:=CN=exampleallowedgroup,OU=e-groups,OU=Workgroups,DC=cern,DC=ch)))(!(memberOf:1.2.840.113556.1.4.1941:=CN=LxPlus-Denied-Users,OU=e-groups,OU=Workgroups,DC=cern,DC=ch))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
ldap_force_upper_case_realm = True
krb5_realm = CERN.CH
krb5_server = cerndc.cern.ch
auth_provider = krb5
chpass_provider = none
cache_credentials = True
ldap_tls_cacertdir = /etc/openldap/cacerts
enumerate = false
# End of puppet managed sssd.conf file.
and a backtrace below. I can provide a core file.
Cheers; Steve
# ls -ltd /core.18894
-rw-------. 1 root root 1253376 May 14 20:10 /core.18894
# file /core.18894
/core.18894: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/libexec/sssd/sssd_pam --debug-to-files'
#
.....does this ring a bell?
# gdb /usr/libexec/sssd/sssd_pam /core.18894
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
....
(gdb) where
#0 0x00007f297c2778a5 in raise () from /lib64/libc.so.6
#1 0x00007f297c279085 in abort () from /lib64/libc.so.6
#2 0x00007f297f41cc3c in ?? () from /usr/lib64/libtalloc.so.2
#3 0x00007f297f41cdf1 in talloc_get_name () from /usr/lib64/libtalloc.so.2
#4 0x00007f297f41ce1e in talloc_check_name () from /usr/lib64/libtalloc.so.2
#5 0x0000000000410e0a in ?? ()
#6 0x00007f297edb161a in ?? () from /lib64/libdbus-1.so.3
#7 0x00007f297edb386f in dbus_connection_dispatch () from /lib64/libdbus-1.so.3
#8 0x000000000045425e in ?? ()
#9 0x00007f297f62bbd9 in tevent_common_loop_timer_delay () from /usr/lib64/libtevent.so.0
#10 0x00007f297f62b2ab in ?? () from /usr/lib64/libtevent.so.0
#11 0x00007f297f6278f0 in _tevent_loop_once () from /usr/lib64/libtevent.so.0
#12 0x00007f297f62795b in tevent_common_loop_wait () from /usr/lib64/libtevent.so.0
#13 0x0000000000455bb3 in ?? ()
#14 0x0000000000409b32 in ?? ()
#15 0x00007f297c263cdd in __libc_start_main () from /lib64/libc.so.6
#16 0x0000000000406859 in ?? ()
#17 0x00007fffadb98f88 in ?? ()
#18 0x000000000000001c in ?? ()
#19 0x0000000000000002 in ?? ()
#20 0x00007fffadb99f02 in ?? ()
#21 0x00007fffadb99f1d in ?? ()
#22 0x0000000000000000 in ?? ()
(gdb)
<core.18894>
10 years, 11 months