[sssd PR#138][opened] IPA: Skip conflict entries associated with sudo rules
by fidencio
URL: https://github.com/SSSD/sssd/pull/138
Author: justin-stephenson
Title: #138: IPA: Skip conflict entries associated with sudo rules
Action: opened
PR body:
"""
SSSD retrieves sudo rule information from the IPA LDAP tree, conflict entries will cause problems for SSSD and disallow sudo access when SSSD code is parsing entries associated with sudo rules. This PR sets a skip_entry boolean when it is appropriate and skips over these conflict entries.
Ticket: https://fedorahosted.org/sssd/ticket/3288
Reproducer steps: Create host conflict entry and associate it with a sudo rule that is assigned to certain hosts, attempt to sudo as IDM user. I had some difficulty attempting to force replication issues causing the creation of a conflict entry, the below manual ldapmodify steps will work also:
- Retrieve the DN of the sudoRule
`# ipa sudorule-find --all --raw | grep 'dn: '
dn: ipaUniqueID=e9025c46-ddab-11e6-9096-525400af7498,cn=sudorules,cn=sudo,dc=jstephen,dc=local`
- Run ldapmodify similar to below
dn: ipaUniqueID=e9025c46-ddab-11e6-9096-525400af7498,cn=sudorules,cn=sudo,dc=jstephen,dc=local
changetype: modify
add: memberHost
memberHost: fqdn=testhost.jstephen.local+nsuniqueid=cb3d7383-ddb511e6-8c9996c1-71a1e36a,cn=computers,cn=accounts,dc=jstephen,dc=local
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/138/head:pr138
git checkout pr138
7 years, 2 months
[sssd PR#108][opened] Partially revert "CONFIG: Use default config when none provided"
by fidencio
URL: https://github.com/SSSD/sssd/pull/108
Author: lslebodn
Title: #108: Partially revert "CONFIG: Use default config when none provided"
Action: opened
PR body:
"""
This reverts part of commit 59744cff6edb106ae799b2321cb8731edadf409a.
Removed is copying of default configuration into /etc/sssd/sssd.conf
Sample configurations is still part of installation.
Copying default configuration from /usr/lib64/sssd/conf/sssd.conf -> /etc/sssd/sssd.conf
is not the best idea. There are better way how to use default configuration
and we will need to change anyway due to files provider.
I can revert sample configuration as well.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/108/head:pr108
git checkout pr108
7 years, 2 months
[sssd PR#112][opened] FAILOVER: Improve port status log messages
by fidencio
URL: https://github.com/SSSD/sssd/pull/112
Author: justin-stephenson
Title: #112: FAILOVER: Improve port status log messages
Action: opened
PR body:
"""
This PR is created to ensure administrators do not follow the wrong path troubleshooting issues, especially with messages such as:
`Port status of port 636 for server 'server' is 'not working'`
This patch should help to clarify that there is no direct relationship between port status and actual networking status.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/112/head:pr112
git checkout pr112
7 years, 2 months
[sssd PR#142][opened] Fix breakage caused by having the NSS responder socket-activated
by fidencio
URL: https://github.com/SSSD/sssd/pull/142
Author: fidencio
Title: #142: Fix breakage caused by having the NSS responder socket-activated
Action: opened
PR body:
"""
**MONITOR: Don't return an error in case we fail to register a service**
This patch is a pre-requisite for the next one and both patches could be squashed. Although, I've decided to keep this patch separated as it brings back a behaviour that has been used before the socket-activation series.
**MONITOR: Avoid starting an already started service**
This patch basically prevents that we end up socket-activating (or systemd enabling) a service that has been explicitly enabled in the services' line.
**NSS: Make sssd-nss.service a hard requirement**
This patch takes a step back and do not allow the NSS responder to be socket-activated.
Instead, it's added as a hard requirement for SSSD (in sssd.service) and will be running whenever SSSD is running. Thankfully to our previous patch we ensure that the only one instance of the responder will be running. So, if nss is not present in the services' line, it will be started as a dep. In case it's part of the services' line, it will be started by the monitor and later on started by systemd. The second instance will be killed during the services' registration part.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/142/head:pr142
git checkout pr142
7 years, 2 months
sssd-1.14.3 milestone cleanup
by Jakub Hrozek
Hi,
despite new development happening in the sssd-1-15 branch (aka master),
there are still too many tickets in the 1.14.3 milestone. The tickets
should be moved out to current milestones unless someone is really
working on them.
These are:
* https://fedorahosted.org/sssd/ticket/3063 - add an integration test for the configuration include directories
- would it be enough to have two users in two search bases and drop
a snippet with the second base, then try to resolve a user? If yes,
this is a one-hour effort, any takers? If not, move to CI milestone
- Lukas said there would be issue with integration test would be
how to detect whether libini_config suports it (rhel6 does not
support it). Therefore I suggest we move the ticket to CI milestone.
* https://fedorahosted.org/sssd/ticket/3085 - looks fixed in
https://git.fedorahosted.org/cgit/sssd.git/commit/?id=11540d9efb85b9ed034...
OK to close?
- Lukas already added a +1 last week on our meeting, so I'll
probably close the ticket.
* https://fedorahosted.org/sssd/ticket/3197 - add a line to sssd-ad
man page on how does the POSIX attrs in GC work
- Someone suggested reverting the logic for POSIX-attrs-in-GC lately,
but I forgot the details, does anyone remember? Otherwise this is
a 5-minute patch, so I suggest just closing it.
* https://fedorahosted.org/sssd/ticket/3208 - Need detailed information
about config-check option
- what is this ticket about? Do we need it? I suggest we just close it
* https://fedorahosted.org/sssd/ticket/3222 - sssd still showing ipa
user after removed from last group
- unless anyone is actively working on the ticket, just move to
patches welcome
* https://fedorahosted.org/sssd/ticket/2554 - Update spec file according
to updated guidelines
- Unless anyone would like to clean up our reference upstream specfile,
I suggest we close the ticket
* https://fedorahosted.org/sssd/ticket/3113 - Please move sudo_timed option to sssd-sudo man page
- 5 minutes patch and George is unlikely to send a patch, any takers?
* https://fedorahosted.org/sssd/ticket/3074 - Move timestamp cache to tmpfs
* https://fedorahosted.org/sssd/ticket/3097 - Measure the difference between tmpfs database and NOSYNC database
- tmpfs provides very little benefit, close with an explanation
After this milestone is cleaned up, I'll finally populate the 1.15 Beta
milestone..
7 years, 2 months
[sssd PR#126][opened] ldap_child: Fix use after free
by fidencio
URL: https://github.com/SSSD/sssd/pull/126
Author: lslebodn
Title: #126: ldap_child: Fix use after free
Action: opened
PR body:
"""
In case on any krb5 related error, we tried to send string
interpretation of krb5 error tb parrent in prepare_response.
However, we cannot use global krb5 context (krb5_error_ctx)
because the context is every time released in done section of
ldap_child_get_tgt_sync.
This patch rather return duplicated string to prevent use after free.
Backtrace:
```
#0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
100 ../sysdeps/x86_64/multiarch/strchr.S: No such file or directory.
Thread 1 (Thread 0x7fc96cad5880 (LWP 11201)):
#0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100
No locals.
#1 0x00007fc96be43725 in err_fmt_fmt (msg=0x7fc96d1cf8d0 "Cannot find KDC for requested realm",
code=-1765328230,
err_fmt=<optimized out>) at kerrs.c:152
buf = {buftype = K5BUF_DYNAMIC, data = 0x7fc96d1cdb10,
space = 128, len = 0}
p = <optimized out>
s = 0xdededededededede <Address 0xdededededededede out of bounds>
#2 krb5_get_error_message (ctx=<optimized out>,
code=code@entry=-1765328230) at kerrs.c:184
std = 0x7fc96d1cf8d0 "Cannot find KDC for requested realm"
#3 0x00007fc96cb224e5 in sss_krb5_get_error_message (ctx=<optimized out>,
ec=ec@entry=-1765328230) at src/util/sss_krb5.c:424
No locals.
#4 0x00007fc96cb1fbb0 in prepare_response (rsp=<synthetic pointer>,
kerr=-1765328230, expire_time=0,
ccname=0x0,
mem_ctx=0x7fc96d1cb390) at src/providers/ldap/ldap_child.c:553
ret = <optimized out>
r = 0x7fc96d1cd8b0
krb5_msg = 0x0
```
Related parts of logs:
```
[System Logs]:
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database
Jan 17 06:20:08 fserver-1658118.example.com kernel: traps: ldap_child[15788] general protection ip:7f7faf2e505a sp:7ffd3f768478 error:0 in libc-2.17.so[7f7faf260000+1b6000]
Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core
[User Logs]:
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database
Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/126/head:pr126
git checkout pr126
7 years, 2 months