Sssd-maintainers August 2024

sssd-maintainers@lists.fedoraproject.org

1 participants
5 discussions

[Bug 2308428] New: Failed to start sssd-kcm.socket service
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2308428 Bug ID: 2308428 Summary: Failed to start sssd-kcm.socket service Product: Fedora Version: 41 OS: Linux Status: NEW Component: sssd Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: pnemade(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora I upgraded my Fedora 40 Silverblue system to Fedora 41 Silverblue system. I am using toolbox on this upgraded system to use kinit command. However I found its failed with error "kinit: Connection refused while getting default ccache" I then checked for any failed services on this system and found below parag@f41sb:~$ sudo systemctl status sssd-kcm.service × sssd-kcm.service - SSSD Kerberos Cache Manager Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.service; indirect; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: failed (Result: exit-code) since Thu 2024-08-29 08:36:37 IST; 2min 14s ago Duration: 17ms Invocation: a0e98bf8241640c3b720f1beeeaa5293 TriggeredBy: × sssd-kcm.socket Docs: man:sssd-kcm(5) Process: 2766 ExecStartPre=/bin/chown -f sssd:sssd /etc/sssd/sssd.conf (code=exited, status=1/FAILURE) Process: 2771 ExecStartPre=/bin/chown -f -R sssd:sssd /etc/sssd/conf.d (code=exited, status=0/SUCCESS) Process: 2773 ExecStart=/usr/libexec/sssd/sssd_kcm ${DEBUG_LOGGER} (code=exited, status=3) Main PID: 2773 (code=exited, status=3) Aug 29 08:36:37 f41sb sssd_kcm[2773]: Failed to connect to '/var/lib/sss/secrets/secrets.ldb' with backend 'tdb': Unable to open tdb '/var/lib/sss/secrets/secrets.ldb': Permission denied Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [sss_sec_init] (0x0020): Failed to initialize secdb [5]: Input/output error Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [ccdb_secdb_init] (0x0020): Cannot initialize the security database Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [kcm_ccdb_init] (0x0020): Cannot initialize ccache database Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [kcm_process_init] (0x0010): fatal error initializing responder data Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Main process exited, code=exited, status=3/NOTIMPLEMENTED Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Failed with result 'exit-code'. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Start request repeated too quickly. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Failed with result 'exit-code'. Aug 29 08:36:37 f41sb systemd[1]: Failed to start sssd-kcm.service - SSSD Kerberos Cache Manager. and parag@f41sb:~$ sudo systemctl status sssd-kcm.socket × sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.socket; enabled; preset: enabled) Active: failed (Result: service-start-limit-hit) since Thu 2024-08-29 08:36:37 IST; 2min 39s ago Duration: 23.535s Invocation: de4f2f42700f47a3958789b82f7d5070 Triggers: ● sssd-kcm.service Docs: man:sssd-kcm(8) Listen: /run/.heim_org.h5l.kcm-socket (Stream) Aug 29 08:36:14 f41sb systemd[1]: Listening on sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.socket: Failed with result 'service-start-limit-hit'. Can someone help to know better how to fix this service failure issue so that I can start using kinit command? Reproducible: Always Steps to Reproduce: 1. Take Fedora 41 bare metal Silverblue system not VM 2. use fedora toolbox 3. in toolbox just run "kinit" or "klist" it fails Actual Results: kinit: Connection refused while getting default ccache Expected Results: Should run kinit and get a ticket -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2308428 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 36

[Bug 2299733] New: logrotate service will fail to start due to improper permissions on /var/log/sssd directory
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2299733 Bug ID: 2299733 Summary: logrotate service will fail to start due to improper permissions on /var/log/sssd directory Product: Fedora Version: rawhide Hardware: x86_64 OS: Linux Status: NEW Component: sssd Keywords: Regression Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: sponix2ipfw(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora I see that the logrotate service has failed to start from within cockpit. In there it explains that this is due to improper permissions on /var/log/sssd directory. After a sudo chmod 755 /var/log/sssd I can start the logrotate service without issues. Pretty sure what I've done to resolve this is take the permissions from drwxrwxr-x to drwxr-xr-x on this directory. Reproducible: Always Steps to Reproduce: 1.Apply system updates that include sssd, have a look at services in cockpit 2.after seeing the logrotate service failed to start using sudo chmod 755 /var/log/sssd 3.clear the error, and start logrotate and it works as it should Actual Results: Well, the steps above get logrotate running again. I am not sure how this may effect the sssd system itself though Expected Results: it is expected to see logrotate service running without the need to use sudo chmod 755 /var/log/sssd -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2299733 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 22

[Bug 2264610] New: FTBFS: sssd intermediate CA tests fail with OpenSSL 3.2
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2264610 Bug ID: 2264610 Summary: FTBFS: sssd intermediate CA tests fail with OpenSSL 3.2 Product: Fedora Version: rawhide OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: sgallagh(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora $ /usr/bin/make -C src/tests/test_CA/intermediate_CA ca_all make: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' test -z "index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf " || rm -f index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf rm -rf .libs _libs rm -rf newcerts rm -rf softhsm* rm -rf serial* rm -f *.lo /usr/bin/make -C ./.. SSSD_test_CA.pem make[1]: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' /usr/bin/openssl req -batch -config ./SSSD_test_CA.config -x509 -new -nodes -key SSSD_test_CA_key.pem -sha256 -days 1024 -set_serial 0 -extensions v3_ca -out SSSD_test_CA.pem make[1]: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' ln -s ./../SSSD_test_CA.pem /usr/bin/openssl req -batch -config ./SSSD_test_intermediate_CA.config -new -nodes -key /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_key.pem -sha256 -out SSSD_test_intermediate_CA_req.pem cd .. && /usr/bin/openssl ca -config /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config -batch -notext -keyfile /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA_key.pem -in /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_req.pem -days 200 -extensions v3_intermediate_ca -out /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA.pem Using configuration from /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config Check that the request matches the signature Signature ok ERROR:There is already a certificate for /O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA The matching entry has the following details Type :Valid Expires on :240903175906Z Serial Number :08 File name :unknown Subject Name :/O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA make: *** [Makefile:756: SSSD_test_intermediate_CA.pem] Error 1 make: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' Reproducible: Always Steps to Reproduce: 1.Build SSSD and run the intermediate CA tests 2. 3. Actual Results: $ /usr/bin/make -C src/tests/test_CA/intermediate_CA ca_all make: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' test -z "index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf " || rm -f index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf rm -rf .libs _libs rm -rf newcerts rm -rf softhsm* rm -rf serial* rm -f *.lo /usr/bin/make -C ./.. SSSD_test_CA.pem make[1]: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' /usr/bin/openssl req -batch -config ./SSSD_test_CA.config -x509 -new -nodes -key SSSD_test_CA_key.pem -sha256 -days 1024 -set_serial 0 -extensions v3_ca -out SSSD_test_CA.pem make[1]: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' ln -s ./../SSSD_test_CA.pem /usr/bin/openssl req -batch -config ./SSSD_test_intermediate_CA.config -new -nodes -key /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_key.pem -sha256 -out SSSD_test_intermediate_CA_req.pem cd .. && /usr/bin/openssl ca -config /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config -batch -notext -keyfile /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA_key.pem -in /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_req.pem -days 200 -extensions v3_intermediate_ca -out /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA.pem Using configuration from /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config Check that the request matches the signature Signature ok ERROR:There is already a certificate for /O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA The matching entry has the following details Type :Valid Expires on :240903175906Z Serial Number :08 File name :unknown Subject Name :/O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA make: *** [Makefile:756: SSSD_test_intermediate_CA.pem] Error 1 make: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' Expected Results: Successful test run. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2264610 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2299722] New: SELinux preventing password authentication
by bugzilla＠redhat.com 20 Aug '24

20 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2299722 Bug ID: 2299722 Summary: SELinux preventing password authentication Product: Fedora Version: rawhide Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: orion(a)nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: We're seeing SELinux preventing password authentication: In permissive mode it works and we see: type=AVC msg=audit(1721842903.063:1198): avc: denied { read } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842903.064:1199): avc: denied { view } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842903.064:1200): avc: denied { write } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842989.327:1210): avc: denied { read } for pid=31647 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721843092.725:1229): avc: denied { read } for pid=31751 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 krb5_child.log shows: (2024-07-24 9:54:32): [krb5_child[30625]] [set_lifetime_options] (0x0100): [RID#771] No specific renewable lifetime requested. (2024-07-24 9:54:32): [krb5_child[30625]] [set_lifetime_options] (0x0100): [RID#771] No specific lifetime requested. (2024-07-24 9:54:32): [krb5_child[30625]] [set_canonicalize_option] (0x0100): [RID#771] Canonicalization is set to [true] (2024-07-24 9:54:34): [krb5_child[30625]] [create_ccache] (0x0020): [RID#771] 1548: [13][Permission denied] Version-Release number of selected component (if applicable): sssd-2.9.5-1.fc39.x86_64 selinux-policy-39.7-1.fc39.noarch How reproducible: Unsure -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2299722 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2305856] New: sss_ssh_knownhosts man page does not contain information about replacements
by bugzilla＠redhat.com 20 Aug '24

20 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2305856 Bug ID: 2305856 Summary: sss_ssh_knownhosts man page does not contain information about replacements Product: Fedora Version: rawhide OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: orion(a)nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora ssh fails with: ****************************************************************************** Your system is configured to use the obsolete tool sss_ssh_knownhostsproxy. Please read the sss_ssh_knownhosts(1) man page to learn about its replacement. ****************************************************************************** But man sss_ssh_knownhosts contains just: SSS_SSH_KNOWNHOSTS(1) SSSD Manual pages SSS_SSH_KNOWNHOSTS(1) NAME sss_ssh_knownhosts - get OpenSSH known hosts public keys SYNOPSIS sss_ssh_knownhosts [options] HOST DESCRIPTION sss_ssh_knownhosts acquires SSH public keys for host HOST and outputs them in OpenSSH known_hosts key format (see the “SSH_KNOWN_HOSTS FILE FORMAT” section of sshd(8) for more information). ssh(1) can be configured to use sss_ssh_knownhosts for public key host authentication using the “KnownHostsCommand” option: KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H Please refer to the ssh_config(5) man page for more details about this option. OPTIONS -d,--domain DOMAIN Search for host public keys in SSSD domain DOMAIN. -?,--help Display help message and exit. EXIT STATUS In case of successful execution, even if no key was found, 0 is returned. 1 is returned in case of error. SEE ALSO sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5) AUTHORS The SSSD upstream - https://github.com/SSSD/sssd/ SSSD 07/22/2024 SSS_SSH_KNOWNHOSTS(1) and no information about a replacement or it being obsolete. sssd-2.10.0~beta2-3.fc41.x86_64 Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2305856 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

2024

2023

2022

2021

2020

Sssd-maintainers August 2024