sssd-1.14.3 milestone cleanup
by Jakub Hrozek
Hi,
despite new development happening in the sssd-1-15 branch (aka master),
there are still too many tickets in the 1.14.3 milestone. The tickets
should be moved out to current milestones unless someone is really
working on them.
These are:
* https://fedorahosted.org/sssd/ticket/3063 - add an integration test for the configuration include directories
- would it be enough to have two users in two search bases and drop
a snippet with the second base, then try to resolve a user? If yes,
this is a one-hour effort, any takers? If not, move to CI milestone
- Lukas said there would be issue with integration test would be
how to detect whether libini_config suports it (rhel6 does not
support it). Therefore I suggest we move the ticket to CI milestone.
* https://fedorahosted.org/sssd/ticket/3085 - looks fixed in
https://git.fedorahosted.org/cgit/sssd.git/commit/?id=11540d9efb85b9ed034...
OK to close?
- Lukas already added a +1 last week on our meeting, so I'll
probably close the ticket.
* https://fedorahosted.org/sssd/ticket/3197 - add a line to sssd-ad
man page on how does the POSIX attrs in GC work
- Someone suggested reverting the logic for POSIX-attrs-in-GC lately,
but I forgot the details, does anyone remember? Otherwise this is
a 5-minute patch, so I suggest just closing it.
* https://fedorahosted.org/sssd/ticket/3208 - Need detailed information
about config-check option
- what is this ticket about? Do we need it? I suggest we just close it
* https://fedorahosted.org/sssd/ticket/3222 - sssd still showing ipa
user after removed from last group
- unless anyone is actively working on the ticket, just move to
patches welcome
* https://fedorahosted.org/sssd/ticket/2554 - Update spec file according
to updated guidelines
- Unless anyone would like to clean up our reference upstream specfile,
I suggest we close the ticket
* https://fedorahosted.org/sssd/ticket/3113 - Please move sudo_timed option to sssd-sudo man page
- 5 minutes patch and George is unlikely to send a patch, any takers?
* https://fedorahosted.org/sssd/ticket/3074 - Move timestamp cache to tmpfs
* https://fedorahosted.org/sssd/ticket/3097 - Measure the difference between tmpfs database and NOSYNC database
- tmpfs provides very little benefit, close with an explanation
After this milestone is cleaned up, I'll finally populate the 1.15 Beta
milestone..
6 years, 4 months
[sssd PR#126][opened] ldap_child: Fix use after free
by fidencio
URL: https://github.com/SSSD/sssd/pull/126
Author: lslebodn
Title: #126: ldap_child: Fix use after free
Action: opened
PR body:
"""
In case on any krb5 related error, we tried to send string
interpretation of krb5 error tb parrent in prepare_response.
However, we cannot use global krb5 context (krb5_error_ctx)
because the context is every time released in done section of
ldap_child_get_tgt_sync.
This patch rather return duplicated string to prevent use after free.
Backtrace:
```
#0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
100 ../sysdeps/x86_64/multiarch/strchr.S: No such file or directory.
Thread 1 (Thread 0x7fc96cad5880 (LWP 11201)):
#0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
No locals.
#1 0x00007fc96be43725 in err_fmt_fmt (msg=0x7fc96d1cf8d0 "Cannot find KDC for requested realm",
code=-1765328230,
err_fmt=<optimized out>) at kerrs.c:152
buf = {buftype = K5BUF_DYNAMIC, data = 0x7fc96d1cdb10,
space = 128, len = 0}
p = <optimized out>
s = 0xdededededededede <Address 0xdededededededede out of bounds>
#2 krb5_get_error_message (ctx=<optimized out>,
code=code@entry=-1765328230) at kerrs.c:184
std = 0x7fc96d1cf8d0 "Cannot find KDC for requested realm"
#3 0x00007fc96cb224e5 in sss_krb5_get_error_message (ctx=<optimized out>,
ec=ec@entry=-1765328230) at src/util/sss_krb5.c:424
No locals.
#4 0x00007fc96cb1fbb0 in prepare_response (rsp=<synthetic pointer>,
kerr=-1765328230, expire_time=0,
ccname=0x0,
mem_ctx=0x7fc96d1cb390) at src/providers/ldap/ldap_child.c:553
ret = <optimized out>
r = 0x7fc96d1cd8b0
krb5_msg = 0x0
```
Related parts of logs:
```
[System Logs]:
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database
Jan 17 06:20:08 fserver-1658118.example.com kernel: traps: ldap_child[15788] general protection ip:7f7faf2e505a sp:7ffd3f768478 error:0 in libc-2.17.so[7f7faf260000+1b6000]
Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core
[User Logs]:
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database
Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/126/head:pr126
git checkout pr126
6 years, 4 months
Identification with openLDAP and authorization with MIT KDC
by Michaël Van de Borne
Hello list,
I know this is a devel list, but I didn't find a user list.
Here's my situation:
I'm installing Hadoop for a customer, and the Hadoop cluster is secured
with Kerberos. I used FreeIPA as a KDC.
The customer uses openLDAP as a directory server.
Fo now, our solution is to copy the whole openLDAP user base to FreeIPA,
and then use FreeIPA for the identification and authorization (all the
keytab stuff).
But keeping openLDAP and FreeIPA in sync is a nightmare, and I was
wondering something:
Would it be possible to configure SSSD to simultaneously target the
openLDAP server to identify a user, and the FreeIPA server to get the
tickets?
That way, we can avoid having to keep openLDAP and FreeIPA in sync...
All ideas are welcome!!
Thank you guys,
Cheers,
m.
6 years, 4 months
[RFC] Discussion about enabling socket-activate services to refresh configuration
by Fabiano Fidêncio
Last Thursday we had a face to face discussion about how
socket-activate services could refresh the confdb before starting.
There were five of us attending the discussion (Pavel Březina, Lukáš
Slebodnik, Simo Sorce, Stephen Gallagher and myself) and the main
focus of the discussion was on what to do in a near-future scenario
where the monitor won't be present anymore.
So, keeping in mind the "no monitor" scenario what has been suggested
by Simo is:
- Have some sort of inotify in the confdb that, when updated, will
trigger the restart of the services. It's really important to note
that we want a way to be notified that the file was changed as a whole
and not trigger several restarts for each small change possible done
in the file;
- There were some ideas suggested about adding a timestamp to the
confdb or a hash of the file (?) in order to keep track of the latest
changes;
- As we will restart the services when notified that the confdb
changes, we have to be more robust when shutting down any service: as
far as I understand/remember it means we must answer the requests
already done while not accepting any new request. It applies pretty
much to any running service at the moment the confdb becomes updated;
- sssd --genconf may be one way to regenerate the confdb and could be
used as ExecPreStart in the SSSD unit.
For the scneario where the monitor is still around Simo suggested to:
- sssd --genconf may be one way to regenerate the confdb (but in the
end we won't do that)
- SSSD will log that the admin must restart SSSD service in order to
have the confdb updated.
I'm really not sure about the technical details of this discussion as
I didn't have time enough to dig into any of the topics I mentioned in
the email.
For those who also where in the meeting, please, politely provide some
feedback on what I've missed, on what you'd like to expand and so on.
Best Regards,
--
Fabiano Fidêncio
6 years, 4 months
Announcing SSSD 1.15.0
by Jakub Hrozek
== SSSD 1.15.0 ===
The SSSD team is proud to announce the release of version 1.15.0 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* SSSD now allows the responders to be activated by the systemd service
manager and exit when idle. This means the services line in sssd.conf is
optional and the responders can be started on-demand, simplifying the sssd
configuration. Please note that this change is backwards-compatible and
the responders listed explicitly in sssd.conf's services line are managed
by sssd in the same manner as in previous releases. Please refer to man
sssd.conf(5) for more information
* The sudo provider is no longer disabled for configurations that do not
explicitly include the sudo responder in the services list. In order to
disable the sudo-related back end code that executes the periodic LDAP
queries, set the sudo_provider to none explicitly
* The watchdog signal handler no longer uses signal-unsafe functions. This
bug was causing a deadlock in case the watchdog was about to kill a
stuck process
* A bug that prevented TLS to be set up correctly on systems where libldap
links with GnuTLS was fixed
* The functionality to alter SSSD configuration through the D-Bus interface
provided by the IFP responder was removed. This functionality was not used to
the best of our knowledge, had no tests and prevented the InfoPipe responder
from running as a non-privileged user.
* A bug that prevented statically-linked applications from using libnss_sss
was fixed by removing dependency on -lpthreads from the libnss_sss library
(please see https://sourceware.org/bugzilla/show_bug.cgi?id=20500 for
an example on why linking with -lpthread from an NSS modules is problematic)
* Previously, SSSD did not ignore GPOs that were missing the
gPCFunctionalityVersion attribute and failed the whole GPO
processing. Starting with this version, the GPOs without the
gPCFunctionalityVersion are skipped.
== Packaging Changes ==
* The Augeas development libraries are no longer required since the
configuration manipulation interface was dropped from the InfoPipe responder
* The libsss_config.so internal library was removed as well due to removal
of the InfoPipe config management
* In order to manage socket-activated or bus activated responders,
each responder is now represented by a systemd service file
(e.g. sssd-nss.service). All responders except InfoPipe, which is
bus-activated, are also managed by a socket unit file (e.g. sssd-nss.socket)
== Documentation Changes ==
* The sssd-secrets responder gained a new option max_payload_size that
allows the administrator to limit the maximum size of a secret
* A new option responder_idle_timeout was added to support idle termination
of socket-activated responders
* The sssd-ad and sssd-ipa man pages now summarize differences between
the generic Kerberos/LDAP back end and the specialized IPA/AD back ends
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/697
Use command line arguments instead env vars for krb5_child
https://fedorahosted.org/sssd/ticket/2201
Man pages do not specify that sssd dyndns_refresh_interval < 60 is pulled to 60 seconds
https://fedorahosted.org/sssd/ticket/2243
[RFE] Socket-activate responders
https://fedorahosted.org/sssd/ticket/2517
krb5_child: Remove getenv() ran as root
https://fedorahosted.org/sssd/ticket/3060
better debugging of timestamp cache modifications
https://fedorahosted.org/sssd/ticket/3129
[RFE] socket-activate the IFP responder
https://fedorahosted.org/sssd/ticket/3151
cache_req: complete the needs of NSS responders
https://fedorahosted.org/sssd/ticket/3156
nss_sss might leak memory when calling thread goes away
https://fedorahosted.org/sssd/ticket/3214
Update man pages for any AD provider config options that differ from ldap/krb5 providers defaults
https://fedorahosted.org/sssd/ticket/3215
Review and update SSSD's wiki pages for 1.15 Alpha release
https://fedorahosted.org/sssd/ticket/3235
SSSCTL should not be case sensitive when searching for usernames or groups in a case-insensitive domain
https://fedorahosted.org/sssd/ticket/3245
[RFE] Shutdown timeout for {socket,bus}-activated responders
https://fedorahosted.org/sssd/ticket/3275
Unchecked return value of sss_cmd_empty_packet(pctx->creq->out);
https://fedorahosted.org/sssd/ticket/3283
getsidbyid can fail in some cases due to cache_req refactoring
https://fedorahosted.org/sssd/ticket/3284
getsidbyname does not work properly with case insensitive domains
== Detailed Changelog ==
Amith Kumar (1):
* MAN: Updation of sssd-ad man page for case when dyndns_refresh_interval < 60 seconds
Carl Henrik Lunde (1):
* Prevent use after free in fd_input_available
David Michael (1):
* BUILD: Find a host-prefixed krb5-config when cross-compiling
Fabiano Fidêncio (34):
* SECRETS: Fix secrets rule in the allowed sections
* SECRETS: Add allowed_sec_users_options
* SECRETS: Delete all secrets stored during "max_secrets" test
* SECRETS: Add configurable payload size limit of a secret
* BUILD: Drop libsss_config
* IFP: Remove "ChangeDebugTemporarily?" method
* AUTOFS: Check return of sss_cmd_empty_packet()
* SUDO: Drop logic to disable the backend in case the provider is not set
* MONITOR: Expose the monitor's services type
* MONITOR: Pass the service type to the RegisterService? method
* UTIL: Introduce --socket-activated cmdline option for responders
* UTIL: Introduce --dbus-activated cmd option for responders
* RESPONDER: Make responders' common code ready for socket activation
* AUTOFS: Make AutoFS responder socket-activatable
* NSS: Make NSS responder socket-activatable
* PAC: Make PAC responder socket-activatable
* PAM: Make PAM responder socket-activatable
* SSH: Make SSH responder socket-activatable
* SUDO: Make Sudo responder socket-activatable
* IFP: Make IFP responder dbus-activatable
* MONITOR: Split up check_services()
* MONITOR: Deal with no services set up
* MONITOR: Deal with socket-activated responders
* MAN: Mention that the services' list is optional
* MAN: "user" doesn't work with socket-activated services
* MONITOR: Don't expose monitor_common_send_id()
* SBUS: Add a time_t pointer to the sbus_connection
* SBUS: Add destructor data to sbus_connection
* RESPONDER: Make clear {reset_,}idle_timer() are related to client
* RESPONDER: Don't expose client_idle_handler()
* RESPONDER: Shutdown {dbus,socket}-activated responders in case they're idle
* RESPONDER: Change how client timeout is calculated
* SERVER: Set the process group during server_setup()
* WATCHDOG: Avoid non async-signal-safe from the signal_handler
Howard Guo (1):
* sss_client: Defer thread cancellation until completion of nss/pam operations
Jakub Hrozek (16):
* Updating the version for the 1.14.3 development
* Updating the version to track sssd-1-15 development
* SYSDB: Split sysdb_try_to_find_expected_dn() into smaller functions
* SYSDB: Augment sysdb_try_to_find_expected_dn to match search base as well
* MONITOR: Do not set up watchdog for monitor
* MONITOR: Remove deprecated pong sbus method
* MONITOR: Remove unused shutDown sbus method
* Qualify ghost user attribute in case ldap_group_nesting_level is set to 0
* tests: Add a test for group resolution with ldap_group_nesting_level=0
* BUILD: Fix a typo in inotify.m4
* SSH: Use default_domain_suffix for users' authorized keys
* SYSDB: Suppress sysdb_delete_ts_entry failed: 0
* STAP: Only print transaction statistics if the script caught some transactions
* test_sssctl: Add an integration test for sssctl netgroup-show
* KRB5: Advise the user to inspect the krb5_child.log if the child fails with a System Error
* IFP: Fix GetUserAttr?
Justin Stephenson (2):
* MAN: Document different defaults for AD provider
* MAN: Document different defaults for IPA provider
Lukas Slebodnik (45):
* crypto: Port libcrypto code to openssl-1.1
* BUILD: Fix build without samba
* libcrypto: Check right value of CRYPTO_memcmp
* crypto-tests: Add unit test for sss_encrypt + sss_decrypt
* crypto-tests: Rename encrypt decrypt test case
* BUILD: Accept krb5 1.15 for building the PAC plugin
* dlopen-test: Use portable macro for location of .libs
* dlopen-test: Add missing libraries to the check list
* dlopen-test: Move libraries to the right "sections"
* dlopen-test: Add check for untested libraries
* BUILD: Fix linking with librt
* KRB5: Remove spurious warning in logs
* TESTS: Check new line at end of file
* UTIL: Fix implicit declaration of function 'htobe32'
* SYSDB: Remove unused prototype from header file
* sssctl: Fix missing declaration
* UTIL: Fix compilation of sss_utf8 with libunistring
* CONFDB: Supress clang false passitive warnings
* SIFP: Fix warning format-security
* RESPONDER: Remove dead assignment to the variable ret
* Fix compilation with python3.6
* intg: Generate tmp dir with lowercase
* LDAP: Fix debug messages after errors in *_get_send
* LDAP: Removed unused attr_type from users_get_send
* LDAP: Remove unused parameter attr_type from groups_get_send
* DP: Remove unused constants BE_ATTR_*
* DP: Remove unused attr_type from struct dp_id_data
* LDAP: Remove attrs_type related TODO comments
* sssd_ldb.py: Remove a leftover debug message
* intg: Fix python2,3 urllib
* intg: Avoid using xrange in tests
* intg: Avoid using iteritems for dictionary
* intg: Use bytes with hash function
* intg: Fix creating of slapd configuration
* intg: Use bytes for value of attributes in ldif
* intg: Use bytes as input in ctypes
* intg: Return strings from ctypes wrappers
* intg: Convert output of executed commands to strings
* intg: Return list for enumeration functions
* SYSDB: Update filter for get object by id
* sysdb-tests: Add test for sysdb_search_object_by_id
* sysdb: Search also aliases in sysdb_search_object_by_name
* sysdb-tests: Add test for sysdb_search_object_by_name
* MONITOR: Fix warning with undefined macro HAVE_SYSTEMD
* UTIL: Unset O_NONBLOCK for ldap connection
Michal Židek (7):
* sssctl: Flags for command initialization
* ipa: Nested netgroups do not work
* common: Fix domain case sensitivity init
* sssctl: Search by alias
* sssctl: Case insensitive filters
* tests: sssctl user/group-show basic tests
* MAN: sssctl debug level
Mike Ely (1):
* ad_access_filter search for nested groups
Pavel Březina (40):
* cache_req: move from switch to plugins; add logic
* cache_req: move from switch to plugins, add plugins
* cache_req: switch to new code
* cache_req: delete old code
* sudo: do not store usn if no rules are found
* nss: move nss_ctx->global_names to rctx
* ifp: remove unused fields from state
* setent_notify: remove unused private context
* sss_crypto.h: include required headers
* sss_output_name: do not require fq name
* cache_req: fix initgroups by name
* cache_req: skip first search on bypass cache
* cache_req: encapsulate output data into structure
* cache_req: add ability to gather result from all domains
* cache_req: add ability to filter domains by enumeration
* cache_req: add user enumeration
* cache_req: add group enumeration
* cache_req: add support for service by name
* cache_req: add support for service by port
* cache_req: add support for services enumeration
* cache_req: add support for netgroups
* cache_req: allow shallow copy of result
* cache_req: allow to return well known object as result
* cache_req: return well known objects in object by sid
* cache_req: make sure that we always fetch default attrs
* cache_req: allow upn search with attrs
* cache_req: add object by name
* cache_req: add object by id
* cache_req: make plug-ins definition const
* cache_req: improve debugging
* cache_req: fix plugin function description
* cache_req: allow to search subdomains without fqn
* cache_req: do not set ncache if dp request fails
* responders: unify usage of sss_cmd_send_empty and _error
* responders: remove checks that are handled inside cache_req
* responders: do not try to contact DP with LOCAL provider
* utils: add sss_ptr_hash module
* nss: rewrite nss responder so it uses cache_req
* nss: make nss responder tests work with new code
* nss: remove the old code
Petr Cech (2):
* SYSDB: Adding message to inform which cache is used
* SYSDB: Adding message about reason why cache changed
Petr Čech (5):
* SYSDB: Adding lowercase sudoUser form
* TESTS: Extending sysdb sudo store tests
* RESPONDER: Adding of return value checking
* UTIL: Removing of never read value
* SYSDB: Fixing of sudorule without a sudoUser
Sorah Fukumori (1):
* BUILD: Fix installation without samba
Sumit Bose (11):
* sysdb: add parent_dom to sysdb_get_direct_parents()
* sdap: make some nested group related calls public
* LDAP/AD: resolve domain local groups for remote users
* PAM: add a test for filter_responses()
* PAM: add pam_response_filter option
* IPA/AD: check auth ctx before using it
* krb5: Use command line arguments instead env vars for krb5_child
* krb5: fix two memory leaks
* krb5: add tests for common functions
* sss_ptr_hash_delete_all: use unsigned long int
* libwbclient-sssd: wbcLookupSid() allow NULL arguments
Victor Tapia (1):
* MONITOR: Create pidfile after responders started
6 years, 4 months
[sssd PR#135][opened] BUILD: Fix linking of test_wbc_calls
by fidencio
URL: https://github.com/SSSD/sssd/pull/135
Author: lslebodn
Title: #135: BUILD: Fix linking of test_wbc_calls
Action: opened
PR body:
"""
Client code does not anymore depend on libpthread in master.
This is a reason why we didn't notice any linking failure
in master. But the test should be inked with CLIENT_LIBS.
```
CCLD test_wbc_calls
/usr/bin/ld: src/sss_client/test_wbc_calls-common.o: undefined reference
to symbol 'pthread_mutexattr_setrobust@(a)GLIBC_2.12'
//lib/x86_64-linux-gnu/libpthread.so.0: error adding symbols: DSO missing
from command line
collect2: error: ld returned 1 exit status
Makefile:12460: recipe for target 'test_wbc_calls' failed
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/135/head:pr135
git checkout pr135
6 years, 4 months