[PATCH] LDAP: Change the default rfc2307 autofs attribute mappings
by Jakub Hrozek
Hi,
our rfc2307 attribute mappings are wrongs. Because we are close to
releasing a major release, I think this is the time to change them.
Attached is a patch that changes the attributes and warns users who use
any of the changed attributes in default mappings. If we decide to
accept this patch, we should also file a ticket to remove the warnings
in the next release to avoid warning forever.
7 years, 8 months
[PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose
Hi,
this patch is the SSSD part of the Authentication Indicator related
changes in FreeIPA. The basic part is that now it is possible to
authenticate at will with either password or 2FA as described on
https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthent....
To test you need a FreeIPA server build from the FreeIPA master branch
and optionally Nathaniel's '[PATCH 0093] Enable service authentication
indicator management' which is currently under review for the kvno
related test. Additionally you need MIT Kerberos packages which contain
the fix for https://bugzilla.redhat.com//show_bug.cgi?id=1340304.
Since this patch changes how libkrb5 gets the password for password
authentication with newer version of MIT Kerberos it would be nice if
someone can run some regression tests with the AD or plain KRB5
auth_provider.
bye,
Sumit
7 years, 8 months
[PATCH] SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a local user
by Jakub Hrozek
Hi,
please see the attached patch. I didn't find any information in the ssh
man pages about the expected error codes from the AuthorizedKeysCommand,
but I think we should at least suppress the error messages..
I tested with:
$ sss_ssh_authorizedkeys root
$ sss_ssh_authorizedkeys user-from-passwd
$ sss_ssh_authorizedkeys user-from-ipa
$ sss_ssh_authorizedkeys non-existing-user
The first three should be silent, the last one still prints an error
message. I think that's acceptable, because I would expect ssh to call
getpwnam() on its own before calling the AuthorizedKeysCommand.
7 years, 9 months
[PATCH] IPA: Handle requests for netgroups from trusted domains gracefully
by Jakub Hrozek
To reproduce, just run:
getent netgroup some_name(a)trusted.domain
Please see the commit message for explanation. The other solution would
be the other way around, ie always go to the code that handles lookups
for trusted domains and shortcut if the lookup is for anything else than
a user or a group.
7 years, 9 months
Announcing SSSD 1.14 Beta
by Jakub Hrozek
== SSSD 1.14 Beta ===
The SSSD team is proud to announce the release of version 1.14 Beta of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* SSSD's cache performance was improved. SSSD now stores operational
attributes of cache entries to a separate database with asynchronous
writes mode, which results in substantially faster cache update times in
most cases. Note that the performance of the initial cache write with an
empty cache does not improve, only subsequent updates.
* SSSD is able to merge configuration file snippets from an include
directory. This functionality requires the latest libini release 1.3.0.
* The GPO evaluator is able to skip malformed INI files. This feature is
also only available with libini release 1.3.0 or newer.
* A new command line tool, called sssctl was added. This tool allows the
administrator to observe the status of SSSD. In this version, the tool
is able to:
* list SSSD domains and subdomains, including their online and
offline status
* print information about objects stored in the cache
* backup or remove the local databases
* help truncate SSSD logs
* SSSD is able to validate configuration files against a built-in
schema. To retain backwards-compatibility with configuration files that
would otherwise not validate, the validator only warns about errors in
the config file in this version.
* An ID-mapping plugin for the winbind deamon was added. With this plugin,
it's possible for winbind to use the same ID-mapping scheme as SSSD uses,
producing consistent ID values
* A new "secrets" responder was added. This responder allows an application
to communicate with SSSD over a UNIX socket using the Custodia API. SSSD
then stores the secrets either in its local database or proxies them to
a remote Custodia server.
== Packaging Changes ==
* SSSD stores ephemeral attributes in a new ldb database called
timestamps_$domain.ldb stored in the same directory as the regular caches.
* The winbind ID-mapping plugin is packages in its own subpackage called
winbind-idmap
* The SSSD configuration snippets are being read from a newly-owned
directory /etc/sssd/conf.d.
* SSSD ships a file with rules for the configuration validator. In Fedora,
this file is located at /var/lib/sss/cfg_rules.ini
== Tickets Fixed ==
#385
[RFE] Provide a Method to Display SSSD Status Information
#1662
[RFE] Provide a force reload utility
#1800
[RFE] create a generic sssdctl utility
#1937
[RFE] Improve LDAP error logging
#2028
sssd does not detail which line in configuration is invalid
#2166
[RFE] SSSD cache database reporting
#2247
[RFE] SSSD should be able to merge configuration from multiple files
#2466
[RFE] Method for setting custom shells without Unix Attributes in AD account
#2602
Optimize cache writes to sysdb
#2671
RFE: sss_cache: Add an option to rm the database files
#2735
Document best practices from security standpoint for OpenScap team
#2751
SSSD can't process GPO from Active Directory when it contains lines with no equal sign
#2913
Add a Secrets as a Service component
#2918
Make cli_ctx more generic
#2921
Replace the monitor ping with an in-process heartbeat
#2957
Extend interface between DP and IFP
#3070
Add infrastructure for socket-activated responders
== Detailed Changelog ==
Christian Heimes (1):
* Secrets: m4 macros for jansson and http-parser
Jakub Hrozek (19):
* Updating the version for the 1.14 beta release
* SYSDB: Move sysdb initialization into a new module sysdb_init.c
* UTIL: Add error codes for sysdb too old or too new
* SYSDB: Refactor database connection
* SYSDB: Add a second, timestamp-only ldb cache
* SYSDB: Open a timestamps cache for caching domains
* SYSDB: Wrap sysdb_store_group in a transaction and split it into smaller functions
* SYSDB: Search the timestamp caches in addition to the sysdb cache
* SYSDB: If modifyTimestamp is the same, only update the TS cache
* SYSDB: Check if group attributes differ before saving a group
* SYSDB: Refactor sysdb_store_user
* SYSDB: Only update user attributes if needed
* TESTS: Add a unit test for timestamps caches
* TESTS: Add an integration test for the timestamps cache
* LDAP: Shortcut looking up for group members sooner
* Contrib: Add a gdbinit file
* BUILD: Fall back to non-strict http parser, if strict is not available
* MAN: Include idmap_sss.8.xml in the manpage sources
* Updating the translations for the 1.14 beta release
Lukas Slebodnik (6):
* Prepare ini schema with rules for validation
* UTIL: Fix debug message in sssd_async_connect_done
* UTIL: Revent connection handling in sssd_async_connect_send
* Downcast to errno_t after tevent_req_is_error
* BUILD: Fix detection of systemd
* BUILD: Detect libsystemd-daemon or libsystemd
Michal Židek (3):
* GPO: ignore non-KVP lines if possible
* confdb: Make it possible to use config snippets
* confdb: Check for config file errors on sssd startup
Pavel Březina (25):
* IFP: Add domain nodes
* IFP: new header file that contains interface definitions
* sss_sifp: make it compatible with latest version of the infopipe
* sss_sifp: return context even on IO error
* sss_sifp: bump version to 1:0:1
* sss_tools: add command description
* sss_tools: add help commands to usage message
* sss_tools: unify description of --debug
* sss_tools: tell whether an option was provided
* sss_tools: add commands delimiter
* sss_tools: pad help message properly
* sss_tools: return errno_t instead of system code
* sss_tools: add test if sssd is running
* sss_tools: create confdb if not exist
* sss_override: return EXIT_SUCCESS even when no overrides are found
* sss_override: return EXIT_FAILURE if file does not exist during import
* ERRORS: Add errors to indicated whether SSSD is running or not
* SBUS ERRORS: Add unknown domain
* SBUS: Fix typo in comment
* SBUS: Add string helper macros
* DP: Add function to get be_ctx directly from dp_client
* DP: Add org.freedesktop.sssd.DataProvider?.Backend
* DP: Add org.freedesktop.sssd.DataProvider?.Failover
* IFP: Provide domain and failover status
* sssctl: new tool
Simo Sorce (14):
* Util: Add watchdog helper
* Server: Enable Watchdog in all daemons
* Monitor: Remove ping infrastructure
* Responders: Make the client context more generic
* Responders: Add support for socket activation
* ConfDB: Add helper function to get "subsections"
* Secrets: Add autoconf macros to build with secrets
* Secrets: Add initial responder code for secrets service
* Add initial providers infrastructure.
* Secrets: Add encryption at rest
* Secrets: Add Proxy backend
* Local secrets provider Content-Type handling
* Secrets: Add local container entries support
* Monitor: Add mode to generate confdb only
Sumit Bose (1):
* Add winbind idmap plugin
7 years, 9 months
[PATCH SET} A new Secrets service
by Simo Sorce
This patchset implements a new responder like service in SSSD called
secrets. It uses the Custodia project API to offer a service where
applications/users can store secrets in a way that makes requests
remotizable and routable with a high degree of configurability (esp, in
conjunction with a Custodia proxy).
Included are also accessory patches to change the monitor and other
aspects of service startup and monitoring necessary to have this new
kind of service which is more independent than the pam/nss based
services.
There is no testsuite for the service yet.
The work is also not complete in that the monitor does not start the
service yet, I have an experimental unit file I am working on but it is
not fully functional and not included yet..
I do not expect all patches to be accepted right away, but they all work
individually (manually tested), but I think it is a good time to start
review and bring in what works, as we are going to spread some of the
remaining work across multiple people.
HTH,
Simo.
--
Simo Sorce * Red Hat, Inc * New York
7 years, 9 months
[PATCH] UTIL: Use errno_t in TEVENT_REQ_RETURN_ON_ERROR
by Lukas Slebodnik
ehlo,
attached is a patch for TEVENT_REQ_RETURN_ON_ERROR
which was discussed in dp_provider related thread.
It "fixes" 6 clang warnings
and 150 UNINIT from coverity (visible only in --agresive mode)
BTW feel fre to prose different error code
for result of down casting == 0.
It should not happen but one never knows.
LS
7 years, 9 months
[PATCH 2/2] UTIL: Revent connection handling in sssd_async_connect_send
by Lukas Slebodnik
ehlo,
Simo
Did you have a special reason for changing
connection handling in commit
https://git.fedorahosted.org/cgit/sssd.git/commit/?id=e05d3f5872263aadfbc...
Because with such change it takes mugh longer unit sssd go into offline mode.
I added few debug messages into sssd_async_connect_done.
But most important is time of operations.
old behaviour with TEVENT_FD_READ | TEVENT_FD_WRITE
---------------------------------------------------
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [110]: Connection timed out
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://ibm-x3650m4-01-vm-07.example.com'
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [21] for the connection.
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Creating request
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Before connect
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): After connect ret:-1
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Calling tevent_add_fd TEVENT_FD_READ | TEVENT_FD_WRITE
(Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): Before connect
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): After connect ret:-1 errno:113
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): connect failed [113][No route to host].
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [113]: No route to host.
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_socket_state_destructor] (0x0400): closing socket [21]
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [113]: No route to host.
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [113]: No route to host.
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'ibm-x3650m4-01-vm-07.example.com' is 'not working'
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP'
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: [5]: Input/output error
(Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
current behaviour with TEVENT_FD_WRITE
--------------------------------------
(Sat Jun 18 12:04:27 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [110]: Connection timed out
(Sat Jun 18 12:04:27 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://ibm-x3650m4-01-vm-07.example.com'
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Creating request
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Before connect
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): After connect ret:-1
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Calling tevent_add_fd
(Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sssd_async_connect_timeout] (0x0100): The connection timed out
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [110]: Connection timed out.
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [110]: Connection timed out.
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [110]: Connection timed out.
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0xfe49dc0], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0]
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'ibm-x3650m4-01-vm-07.example.com' is 'not working'
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP'
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: [5]: Input/output error
(Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error])
If you did not have a special reason for this change then
I would appreciate if we could change it back.
Two patches attached.
LS
7 years, 9 months