[Bug 1857104] New: Using FreeIPA breaks IPv4/IPv6 flags for SSH
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1857104
Bug ID: 1857104
Summary: Using FreeIPA breaks IPv4/IPv6 flags for SSH
Product: Fedora
Version: 32
Status: NEW
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: ossman(a)cendio.se
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
mzidek(a)redhat.com, pbrezina(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
If a client is configured using ipa-client-install then the -4 and -6 flags
stop working for ssh.
Version-Release number of selected component (if applicable):
Doesn't matter. Seen on RHEL 6 through 8, and on current Fedora.
How reproducible:
100%
Steps to Reproduce:
1. ipa-client-install
2. ssh -4 host.example.com
Actual results:
Connected via IPv6
Expected results:
Connected via IPv4
Additional info:
The bug is that sss_ssh_knownhostsproxy is configured on the client and that
command doesn't respect the flags given to ssh.
The issue affects all hosts, not just those part of the same FreeIPA domain.
A practical effect of this is that connections get rejected or misbehave
because of IP based rules in place for this connection.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
3 months, 1 week
[Bug 1853261] New: sssd fails to start on read-only filesystem
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1853261
Bug ID: 1853261
Summary: sssd fails to start on read-only filesystem
Product: Fedora
Version: rawhide
Status: NEW
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: zbyszek(a)in.waw.pl
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
mzidek(a)redhat.com, pbrezina(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
sssd refuses to start when /var/log is read-only. It is obviously a problem
when trying to recover
from a file system issue. Since logging is non-essential, sssd should just
continue. At most is
should emit a warning.
$ touch /var/tmp/foo
touch: cannot touch '/var/tmp/foo': Read-only file system
$ sudo systemctl start sssd.service
Job for sssd.service failed because the control process exited with error code.
See "systemctl status sssd.service" and "journalctl -xe" for details.
[fedora@workstation-uefi ~]$
Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02
11:16:46 CEST):
sssd[900]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only
file system]
Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02
11:16:47 CEST):
sssd[903]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only
file system]
Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02
11:16:47 CEST):
sssd[905]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only
file system]
Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02
11:16:47 CEST):
sssd[906]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only
file system]
Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02
11:16:47 CEST):
sssd[907]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only
file system]
We see multiple issues here:
- the main one is that sssd should not fail to start as described above
- but also, why is sssd not just logging to the journal? Why is it spamming
with broadcast messages?
If sssd would just log to the journal like any modern service, all those
problems
would be avoided.
Version-Release number of selected component (if applicable):
sssd-2.3.0-2.fc33.x86_64
How reproducible:
Deterministic
Steps to Reproduce:
1. Make /var/log read-only, either by not remounting the filesystems rw, or by
using udev.blockdev-read-only with systemd-246+
2. Try to start sssd
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
1 year, 3 months
[Bug 1868696] New: sssd_kcm loops on NFS server occasionally after an NFSv4.0 mount using Kerberos
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1868696
Bug ID: 1868696
Summary: sssd_kcm loops on NFS server occasionally after an
NFSv4.0 mount using Kerberos
Product: Fedora
Version: 32
Hardware: All
OS: Linux
Status: NEW
Component: sssd
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: chuck.lever(a)oracle.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
mzidek(a)redhat.com, pbrezina(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
Multi-homed Fedora 32 NFS client and server, both with keytabs. Sometimes after
performing an NFSv4.0 mount, the sssd_kcm daemon on the server runs at 100% and
fills up the sssd_kcm.log file (and eventually, the root partition).
(2020-08-10 15:03:04:680265): [kcm] [kcm_input_parse] (0x1000): Received
message with length 0
(2020-08-10 15:03:04:680284): [kcm] [kcm_input_parse] (0x0020): Illegal
zero-length message
(2020-08-10 15:03:04:680302): [kcm] [kcm_recv] (0x0010): Failed to parse
data (74, Bad message), aborting client
(2020-08-10 15:03:04:680319): [kcm] [kcm_reply_error] (0x0040): KCM
operation returs failure [74]: Bad message
(2020-08-10 15:03:04:680353): [kcm] [kcm_failbuf_construct] (0x1000): Sent
reply with error -1765328188
Version-Release number of selected component (if applicable):
sssd-kcm-2.3.1-2.fc32.x86_64
How reproducible:
Happens every second or third mount operation.
Steps to Reproduce:
1. Set up NFS client and server with keytabs
2. Repeat: "mount -o vers=4.0,sec=sys" / do some operations / umount
3. Watch the server with "top"
Actual results:
Sometimes sssd_kcm goes to 100% of a CPU and must be killed.
Expected results:
No looping.
Additional info:
The NFSv4.0 backchannel, in this case, is secured with GSS krb5i. It appears
that gssd on the server is accessing the Kerberos ticket cache while setting up
the backchannel, and sometimes this triggers the kcm loop.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
1 year, 10 months
[Bug 1881630] New: ipatests-only: kinit_as_user should collect kdcinfo.REALM on failure
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1881630
Bug ID: 1881630
Summary: ipatests-only: kinit_as_user should collect
kdcinfo.REALM on failure
Product: Red Hat Enterprise Linux 8
Version: 8.3
Status: NEW
Component: ipa
Assignee: twoerner(a)redhat.com
Reporter: fcami(a)redhat.com
QA Contact: ipa-qe(a)redhat.com
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
extras-qa(a)fedoraproject.org, jhrozek(a)redhat.com,
lslebodn(a)redhat.com, mzidek(a)redhat.com,
nalin(a)redhat.com, npmccallum(a)redhat.com,
pbrezina(a)redhat.com, rcritten(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org,
tibbs(a)math.uh.edu, tscherf(a)redhat.com
Depends On: 1850445
Target Milestone: rc
Classification: Red Hat
Pool ID: sst_identity_management_rhel_8
When requesting a tgt fails after a password reset, collecting:
/var/lib/sss/pubconf/kdcinfo.$REALM
will help determine how SSSD was selecting which KRB5KDC to use.
See https://pagure.io/freeipa/issue/8510 for details.
+++ This bug was initially created as a clone of Bug #1850445 +++
kinit switches KDC for each action.
It would be better if it kept track of which KDC to use, because on password
change, it sometimes contacts one KDC to change the password and then another
one, immediately, to get a TGT, which fails because replication between the two
KDCs has not completed yet.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:513 RUN
KRB5_TRACE=/dev/stdout kinit nonadmin
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325347: Resolving unique ccache of type KCM
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325348: Getting initial credentials for nonadmin(a)IPA.TEST
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325350: Sending unauthenticated request
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325351: Sending request (172 bytes) to IPA.TEST
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325352: Resolving hostname master.ipa.test
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325353: Initiating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325354: Sending TCP request to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325355: Received answer (147 bytes) from stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325356: Terminating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325357: Response was from master KDC
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325358: Received error from KDC: -1765328361/Password has expired
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325359: Principal expired; getting changepw ticket
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325360: Getting initial credentials for nonadmin(a)IPA.TEST
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325361: Setting initial creds service to kadmin/changepw
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325363: Sending unauthenticated request
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325364: Sending request (172 bytes) to IPA.TEST (master)
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325365: Resolving hostname master.ipa.test
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325366: Initiating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325367: Sending TCP request to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325368: Received answer (496 bytes) from stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325369: Terminating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325370: Received error from KDC: -1765328359/Additional
pre-authentication required
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325373: Preauthenticating using KDC method data
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325374: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST
(136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151),
PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325375: Selected etype info: etype aes256-cts, salt
".\#7bJ)L)J"mP,T7", params ""
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325376: Received cookie:
MIT1\x00\x00\x00\x01\xe0w\xf7\xd1|$\xa4\x14\x01\xea\x08\x0c\xe7\xf6&\xd6\xb0\x8d\xd1\x9dw/\x98\x14\x81\xe2\xf372\xc5\xb6\xc0k^\xd1\x9b\xe3R\xd4?^\x11\xecyd\x05\xb5>\x93\xdd\x94\x0e\x0a\xc7.\xb2\x84E\xb7El\x87\xbaa\x9b\xae\x9e\xa6d\xf4\xf7m\xf4W\x11~]\xfecR@[\xef\xdc3W\x1f\xe8\xa7\x07\xae\xd5\x12\x15\xc4\xa2\xb6\xa0\x0b\xab\x09cv\x8741s\x18\xc9\xee\xa9\x13Qu\xd6+\xb7\xe9\xf8V\xf0\xf9@\x95\xbb\x8c\x9d\x92\xcb\xbd
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325377: PKINIT client has no configured identity; giving up
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325378: Preauth module pkinit (147) (info) returned: 0/Success
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325379: PKINIT client received freshness token from KDC
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325380: Preauth module pkinit (150) (info) returned: 0/Success
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325381: PKINIT client has no configured identity; giving up
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325382: Preauth module pkinit (16) (real) returned: 22/Invalid
argument
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325383: SPAKE challenge received with group 1, pubkey
1B0BEF657989B0A997331DC1C3FE27B3DDA988E0CCDE4AD1953E63654308BB8A
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557
Password for nonadmin(a)IPA.TEST:
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325384: SPAKE key generated with pubkey
E7799A68439AF32E18B1899FA0D7145F70FD5345C6F59F5EB4463754CE1C45C3
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325385: SPAKE algorithm result:
F305A9105E6AE9531D6F6041EE348B146FB937039B3FFA1BD3A614638269AA91
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325386: SPAKE final transcript hash:
273E7D21D701511A5FEB8D9EE1A817D34F4CFE0DA9849260A6D3654B59A7A965
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325387: Sending SPAKE response
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325388: Preauth module spake (151) (real) returned: 0/Success
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325389: Produced preauth for next request: PA-FX-COOKIE (133),
PA-SPAKE (151)
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325390: Sending request (431 bytes) to IPA.TEST (master)
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325391: Resolving hostname master.ipa.test
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325392: Initiating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325393: Sending TCP request to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325394: Received answer (1521 bytes) from stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325395: Terminating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325396: AS key determined by preauth: aes256-cts/108D
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325397: Decrypted AS reply; session key is: aes256-cts/755F
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325398: FAST negotiation: available
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325399: Attempting password change; 3 tries remaining
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557
Password expired. You must change it now.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 Enter
new password:
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 Enter
it again:
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325401: Creating authenticator for nonadmin(a)IPA.TEST ->
kadmin/changepw(a)IPA.TEST, seqnum 0, subkey aes256-cts/D865, session key
aes256-cts/755F
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325403: Sending DNS URI query for _kpasswd.IPA.TEST.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325404: No URI records found
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325405: Sending DNS SRV query for _kpasswd._udp.IPA.TEST.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325406: SRV answer: 0 100 464 "replica0.ipa.test."
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325407: SRV answer: 0 100 464 "master.ipa.test."
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325408: Sending DNS SRV query for _kpasswd._tcp.IPA.TEST.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325409: SRV answer: 0 100 464 "replica0.ipa.test."
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325410: SRV answer: 0 100 464 "master.ipa.test."
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325411: Resolving hostname replica0.ipa.test.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325412: Resolving hostname master.ipa.test.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325413: Resolving hostname replica0.ipa.test.
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325414: Initiating TCP connection to stream 192.168.122.43:464
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325415: Sending TCP request to stream 192.168.122.43:464
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325416: Received answer (236 bytes) from stream 192.168.122.43:464
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325417: Terminating TCP connection to stream 192.168.122.43:464
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325418: Read AP-REP, time 1592990743.325402, subkey aes256-cts/D865,
seqnum 469261493
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325419: Getting initial TGT with changed password
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325420: Getting initial credentials for nonadmin(a)IPA.TEST
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325422: Sending unauthenticated request
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325423: Sending request (172 bytes) to IPA.TEST (master)
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325424: Resolving hostname master.ipa.test
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325425: Initiating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325426: Sending TCP request to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 kinit:
Password has expired while getting initial credentials
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325427: Received answer (147 bytes) from stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325428: Terminating TCP connection to stream 192.168.122.35:88
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:557 [24275]
1592990743.325429: Received error from KDC: -1765328361/Password has expired
DEBUG
ipatests.pytest_ipa.integration.host.Host.master.cmd64:transport.py:217 Exit
code: 1
ERROR ipatests.pytest_ipa.integration.host.Host.master.cmd64:host.py:199
stderr: kinit: Password has expired while getting initial credentials
full logs:
http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/3966b...
--- Additional comment from Sumit Bose on 2020-06-24 15:43:03 UTC ---
Hi,
do you know if SSSD is running during the test? If yes, can you check if
/var/lib/sss/pubconf/kdcinfo.IPA.TEST exists and contains one or more IP
addresses of IPA servers? This file is read by SSSD's locator plugin which
should make sure libkrb5 uses the same KDC for a long time.
bye,
Sumit
--- Additional comment from François Cami on 2020-06-24 16:22:57 UTC ---
Hi Sumit,
The machine logs for the test are available at:
http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/3966b...
The timestamp for the error is 1592990743.325347 (Wednesday, June 24, 2020
9:25:43.325 AM) and the journal seems to imply SSSD was started at this point.
Sadly the VMs used for the test are ephemeral and the above test fails only
sporadically.
I will add a step to display /var/lib/sss/pubconf/kdcinfo.IPA.TEST similarly to
the way I added KRB5_TRACE=/dev/stdout to get more information.
Thanks,
François
--- Additional comment from Robbie Harwood on 2020-06-25 19:09:32 UTC ---
Would also like to see the sssd information.
(I will note that krb5 expects there to be a single master_kdc that is
authoratative for password changes. If that address resolves to multiple KDCs,
they need to agree on the state of the world.)
--- Additional comment from François Cami on 2020-06-25 19:36:57 UTC ---
Robbie, do you need more information than what is seen in the PR:
https://github.com/freeipa/freeipa/pull/4853
Especially: https://github.com/freeipa/freeipa/pull/4853#issuecomment-649235842
The test blows up very sporadically. I've triggered it 16 times today without
any issue.
If within a month I haven't seen it red, I will trigger a 100+ run and we might
get a bad run with interesting logs.
--- Additional comment from Robbie Harwood on 2020-06-25 20:51:09 UTC ---
Ah sorry, race condition - I started my comment before yours appeared. I've
subscribed to the issue. Per #c3, I think that master_kdc isn't being
correctly used - it seems like Sumit is investigating where the multiple values
come from.
--- Additional comment from Sumit Bose on 2020-06-26 11:30:23 UTC ---
(In reply to Robbie Harwood from comment #5)
> Ah sorry, race condition - I started my comment before yours appeared. I've
> subscribed to the issue. Per #c3, I think that master_kdc isn't being
> correctly used - it seems like Sumit is investigating where the multiple
> values come from.
Hi,
in the current logs there was only one IP address and this will be used for the
master as well. As long there is a kdcinfo file SSSD's Kerberos locator plugin
should use the data and iirc libkrb5 will always ask the available locator
plugins first before trying other methods to find a KDC. Since the KRB5_TRACE
output in the description has e.g. 'Sending DNS URI query for
_kpasswd.IPA.TEST.' I would expect that the kdcinfo file did not exist in this
run. Maybe SSSD had some delays when trying to connect to the IPA server and as
a result the creation of the kdcinfo file was delayed as wel?
bye,
Sumit
--- Additional comment from Robbie Harwood on 2020-09-10 17:31:13 UTC ---
Moving to sssd based on #c6.
--- Additional comment from François Cami on 2020-09-22 18:58:49 UTC ---
ipatests PR to collect that kdcinfo file:
https://github.com/freeipa/freeipa/pull/5128
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1850445
[Bug 1850445] kinit switches servers after password change
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years
[Bug 1883228] New: [abrt] sssd-common: dp_client_register(): sssd_be killed by SIGSEGV
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1883228
Bug ID: 1883228
Summary: [abrt] sssd-common: dp_client_register(): sssd_be
killed by SIGSEGV
Product: Fedora
Version: 32
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:996c4e8c0d04ba4f440f3580f8dd2a32a55fa076;VAR
IANT_ID=workstation;
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: lodx2012(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
jhrozek(a)redhat.com, lslebodn(a)redhat.com,
mzidek(a)redhat.com, pbrezina(a)redhat.com,
rharwood(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com
Target Milestone: ---
Group: fedora_contrib_private
Classification: Fedora
Version-Release number of selected component:
sssd-common-2.3.1-2.fc32
Additional info:
reporter: libreport-2.13.1
backtrace_rating: 4
cgroup: 0::/system.slice/sssd.service
cmdline: /usr/libexec/sssd/sssd_be --domain implicit_files --uid 0 --gid
0 --logger=files
crash_function: dp_client_register
executable: /usr/libexec/sssd/sssd_be
journald_cursor:
s=4dab44c4257b4062a11fd4664e4f809e;i=9c18;b=27339efbadb94c3eab8a24f4341ffc8b;m=cf362695b;t=5affa325d32a4;x=b7c2ba789e912d64
kernel: 5.8.7-200.fc32.x86_64
rootdir: /
runlevel: N 5
type: CCpp
uid: 0
Truncated backtrace:
Thread no. 1 (10 frames)
#0 dp_client_register at src/providers/data_provider/dp_client.c:107
#1 _sbus_sss_invoke_in_s_out__step at src/sss_iface/sbus_sss_invokers.c:682
#2 tevent_common_invoke_timer_handler at ../../tevent_timed.c:370
#3 tevent_common_loop_timer_delay at ../../tevent_timed.c:442
#4 epoll_event_loop_once at ../../tevent_epoll.c:922
#5 std_event_loop_once at ../../tevent_standard.c:110
#6 _tevent_loop_once at ../../tevent.c:772
#7 tevent_common_loop_wait at ../../tevent.c:895
#8 std_event_loop_wait at ../../tevent_standard.c:141
#9 server_loop at src/util/server.c:727
Potential duplicate: bug 1684824
--
You are receiving this mail because:
You are the assignee for the bug.
2 years, 5 months
[Bug 1850445] kinit switches servers after password change
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1850445
Sumit Bose <sbose(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(sssd-maintainers@ |
|lists.fedoraproject.org) |
--- Comment #12 from Sumit Bose <sbose(a)redhat.com> ---
(copy of my comment form the github ticket)
Hi,
I think the reason why the kdcinfo file is missing in some cases is that SSSD
is offline or not online yet. If SSSD was started only shortly before the test
depending on DNS lookups and other network operations SSSD might not be
completely online and hence the kdcinfo file was not created yet.
You can check the online status with 'sssctl domain-status --online IPA.TEST'.
But you should do this before checking if the kdcinfo file is present because
if you check it afterwards SSSD might be already online when calling sssctl.
Otherwise there is a race as well but here if sssctl says offline you know at
least that it might happen that SSSD is offline when you try to check the
prescence of the kdcinfo file.
HTH
bye,
Sumit
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
2 years, 5 months
[Bug 1850445] kinit switches servers after password change
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1850445
François Cami <fcami(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(sssd-maintainers@
| |lists.fedoraproject.org)
--- Comment #11 from François Cami <fcami(a)redhat.com> ---
Hi,
Please see the two logs above. In some cases the kdcinfo file is not present
(but "luckily" sssd picked the right server these two times).
I need to know whether the absence of the kdcinfo file should be considered a
hard failure.
See https://github.com/freeipa/freeipa/pull/5128
Thanks
François
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
2 years, 5 months
[Bug 1850445] kinit switches servers after password change
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1850445
--- Comment #10 from François Cami <fcami(a)redhat.com> ---
Another failed run (test code slightly changed to continue execution):
http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/b4b29...
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] Password for
nonadmin(a)IPA.TEST:
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561281: SPAKE key generated with pubkey
D44D37FE29E02B8771396C7EEAFF3B68E7FBFB948C01942FDBF966F7114A095C
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561282: SPAKE algorithm result:
1C72AE453C7FB02F8420FEFB3BCC0DD41F8FEDD102EB014212C955CF4F484990
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561283: SPAKE final transcript hash:
A38471527EC416C471738CEFBEE0931CC4017FE64253B3FDB766428EE4FBC3CB
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561284: Sending SPAKE response
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561285: Preauth module spake (151) (real) returned: 0/Success
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561286: Produced preauth for next request: PA-FX-COOKIE (133),
PA-SPAKE (151)
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561287: Sending request (431 bytes) to IPA.TEST
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561288: Resolving hostname master.ipa.test
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561289: Initiating TCP connection to stream 192.168.122.190:88
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561290: Sending TCP request to stream 192.168.122.190:88
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561291: Received answer (1521 bytes) from stream 192.168.122.190:88
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561292: Terminating TCP connection to stream 192.168.122.190:88
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561293: Response was from master KDC
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561294: AS key determined by preauth: aes256-cts/3D70
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561295: Decrypted AS reply; session key is: aes256-cts/EBCD
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561296: FAST negotiation: available
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561297: Initializing KCM:0 with default princ nonadmin(a)IPA.TEST
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561298: Storing nonadmin(a)IPA.TEST -> krbtgt/IPA.TEST(a)IPA.TEST in
KCM:0
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561299: Storing config in KCM:0 for krbtgt/IPA.TEST(a)IPA.TEST:
fast_avail: yes
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561300: Storing nonadmin(a)IPA.TEST ->
krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.TEST\@IPA.TEST(a)X-CACHECONF: in
KCM:0
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561301: Storing config in KCM:0 for krbtgt/IPA.TEST(a)IPA.TEST:
pa_type: 151
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] [24096]
1600980648.561302: Storing nonadmin(a)IPA.TEST ->
krb5_ccache_conf_data/pa_type/krbtgt\/IPA.TEST\@IPA.TEST(a)X-CACHECONF: in KCM:0
[ipatests.pytest_ipa.integration.host.Host.master.cmd67] Exit code: 0
[ipatests.pytest_ipa.integration.tasks] Collecting kdcinfo log from:
master.ipa.test
[ipatests.pytest_ipa.integration.host.Host.master.IPAOpenSSHTransport] GET
/var/lib/sss/pubconf/kdcinfo.IPA.TEST
[ipatests.pytest_ipa.integration.host.Host.master.cmd68] RUN ['cat',
'/var/lib/sss/pubconf/kdcinfo.IPA.TEST']
[ipatests.pytest_ipa.integration.host.Host.master.cmd68] cat:
/var/lib/sss/pubconf/kdcinfo.IPA.TEST: No such file or directory
[ipatests.pytest_ipa.integration.host.Host.master.cmd68] Exit code: 1
ipa: WARNING: Exception collecting kdcinfo.IPA.TEST: File
'/var/lib/sss/pubconf/kdcinfo.IPA.TEST' could not be read
SSSD is able to function without this file but logon attempts immediately after
a password change might break.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
2 years, 6 months