sssd-devel December 2024

sssd-devel@lists.fedorahosted.org

4 participants
3 discussions

Announcing SSSD 2.10.1
by Pavel Březina 10 Dec '24

10 Dec '24

# SSSD 2.10.1 The SSSD team is announcing the release of version 2.10.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.10.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.10.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.10.1 Release Notes ## Highlights ### General information * `krb5-child-test` was removed. Corresponding tests under 'src/tests/system/' are aimed to provide a comprehensive test coverage of 'krb5_child' functionality. * SSSD doesn't create anymore missing path components of DIR:/FILE: ccache types while acquiring user's TGT. The parent directory of requested ccache directory must exist and the user trying to log in must have 'rwx' access to this directory. This matches behavior of 'kinit'. * The DoT (DNS over TLS) for dynamic DNS updates is supported now. It requires new version of `nsupdate` from BIND 9.19+. * The option default_domain_suffix is deprecated. Consider using the more flexible domain_resolution_order instead. ### Packaging changes * **Important note for downstream maintainers.** A set of capabilities required by privileged binaries was further reduced to: ``` krb5_child cap_dac_read_search,cap_setgid,cap_setuid=p ldap_child cap_dac_read_search=p selinux_child cap_setgid,cap_setuid=p sssd_pam cap_dac_read_search=p ``` Keep in mind that even with a limited set of fine grained capabilities, usual precautions still should be taken while packaging binaries with file capabilities: it's very important to make sure that those are executable only by root/sssd service user. For this reason upstream spec file packages it as: ``` -rwxr-x---. 1 root sssd ``` Failing to do so (i.e. allowing non-privileged users to execute those binaries) can impose systems installing the package to a security risk. * Support of deprecated 'ad_allow_remote_domain_local_groups' sssd.conf option isn't built by default. It can be enabled using '--with-allow-remote-domain-local-groups' ./configure option. ### Configuration changes * `ad_allow_remote_domain_local_groups` option is deprecated and will be removed in future releases. * the `dyndns_server` option is extended so it can be in form of URI (dns+tls://1.2.3.4:853#servername). New set of options `dyndns_dot_cacert`, `dyndns_dot_cert` and `dyndns_dot_key` allows to configure DNS-over-TLS communication. * Added `exop_force` value for configuration option `ldap_pwmodify_mode`. This can be used to force a password change even if no grace logins are left. Depending on the configuration of the LDAP server it might be expected that the password change will fail.

1 0

id_provider = ad ; ldap_disable_range_retrieval = false; why getent group <large_group> limited to 1500 members?
by Bob Green 09 Dec '24

09 Dec '24

sssd correctly identifies that an account is a member of a large 1501+ member AD group via "id <account>". However getent group <1501+_member_group> does not list the account. Only the first 1500 members are displayed. Is this a limitation of getent group ? Or is there a way to configure sssd to display all group members via getent group <group>? AD groups are not nested. OS: SUSE Linux Enterprise Server 12 SP5 sssd version: 1.16.1 Release: 7.65.1 # cat /etc/sssd/sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = DOM.CORP.COM [domain/DOM.CORP.COM] entry_cache_timeout = 14400 refresh_expired_interval = 10800 cache_credentials = true id_provider = ad auth_provider = ad access_provider = simple dyndns_update = false full_name_format = %1$s use_fully_qualified_names = false ldap_referrals = false ldap_id_mapping = false ldap_disable_range_retrieval = false ldap_force_upper_case_realm = true ldap_group_nesting_level = 0 ldap_use_tokengroups = false ldap_search_base = OU=my_ou,DC=dom,DC=corp,DC=com krb5_canonicalize = false krb5_validate = false Thanks, Bob

3 3

Announcing SSSD 2.9.6
by Pavel Březina 05 Dec '24

05 Dec '24

# SSSD 2.9.6 The SSSD team is announcing the release of version 2.9.6 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.6 Note that this is the latest release of 2.9.x LTM branch. See the full release notes at: https://sssd.io/release-notes/sssd-2.9.6.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.6 Release Notes ## Highlights ### General information * The DoT for dynamic DNS updates is supported now. It requires new version of `nsupdate` from BIND 9.19+. * The option `default_domain_suffix` is deprecated. Consider using the more flexible `domain_resolution_order` instead. ### Important fixes * When the `DP_OPT_DYNDNS_REFRESH_OFFSET` enumerator was created, the associated `struct dp_option` was not. Because these structures are part of an array and the enumerator is used as the index, the wrong structure would be accessed when trying to use this index. This problem was fixed by creating the missing structure. ### Configuration changes * The `dyndns_server` option is extended so it can be in form of URI (`dns+tls://1.2.3.4:853#servername`). New set of options `dyndns_dot_cacert`, `dyndns_dot_cert` and `dyndns_dot_key` allows to configure DNS-over-TLS communication. * Added `exop_force` value for configuration option `ldap_pwmodify_mode`. This can be used to force a password change even if no grace logins are left. Depending on the configuration of the LDAP server it might be expected that the password change will fail.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2024