Sssd-maintainers September 2024

sssd-maintainers@lists.fedoraproject.org

1 participants
4 discussions

[Bug 2308428] New: Failed to start sssd-kcm.socket service
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2308428 Bug ID: 2308428 Summary: Failed to start sssd-kcm.socket service Product: Fedora Version: 41 OS: Linux Status: NEW Component: sssd Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: pnemade(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora I upgraded my Fedora 40 Silverblue system to Fedora 41 Silverblue system. I am using toolbox on this upgraded system to use kinit command. However I found its failed with error "kinit: Connection refused while getting default ccache" I then checked for any failed services on this system and found below parag@f41sb:~$ sudo systemctl status sssd-kcm.service × sssd-kcm.service - SSSD Kerberos Cache Manager Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.service; indirect; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: failed (Result: exit-code) since Thu 2024-08-29 08:36:37 IST; 2min 14s ago Duration: 17ms Invocation: a0e98bf8241640c3b720f1beeeaa5293 TriggeredBy: × sssd-kcm.socket Docs: man:sssd-kcm(5) Process: 2766 ExecStartPre=/bin/chown -f sssd:sssd /etc/sssd/sssd.conf (code=exited, status=1/FAILURE) Process: 2771 ExecStartPre=/bin/chown -f -R sssd:sssd /etc/sssd/conf.d (code=exited, status=0/SUCCESS) Process: 2773 ExecStart=/usr/libexec/sssd/sssd_kcm ${DEBUG_LOGGER} (code=exited, status=3) Main PID: 2773 (code=exited, status=3) Aug 29 08:36:37 f41sb sssd_kcm[2773]: Failed to connect to '/var/lib/sss/secrets/secrets.ldb' with backend 'tdb': Unable to open tdb '/var/lib/sss/secrets/secrets.ldb': Permission denied Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [sss_sec_init] (0x0020): Failed to initialize secdb [5]: Input/output error Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [ccdb_secdb_init] (0x0020): Cannot initialize the security database Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [kcm_ccdb_init] (0x0020): Cannot initialize ccache database Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [kcm_process_init] (0x0010): fatal error initializing responder data Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Main process exited, code=exited, status=3/NOTIMPLEMENTED Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Failed with result 'exit-code'. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Start request repeated too quickly. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Failed with result 'exit-code'. Aug 29 08:36:37 f41sb systemd[1]: Failed to start sssd-kcm.service - SSSD Kerberos Cache Manager. and parag@f41sb:~$ sudo systemctl status sssd-kcm.socket × sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.socket; enabled; preset: enabled) Active: failed (Result: service-start-limit-hit) since Thu 2024-08-29 08:36:37 IST; 2min 39s ago Duration: 23.535s Invocation: de4f2f42700f47a3958789b82f7d5070 Triggers: ● sssd-kcm.service Docs: man:sssd-kcm(8) Listen: /run/.heim_org.h5l.kcm-socket (Stream) Aug 29 08:36:14 f41sb systemd[1]: Listening on sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.socket: Failed with result 'service-start-limit-hit'. Can someone help to know better how to fix this service failure issue so that I can start using kinit command? Reproducible: Always Steps to Reproduce: 1. Take Fedora 41 bare metal Silverblue system not VM 2. use fedora toolbox 3. in toolbox just run "kinit" or "klist" it fails Actual Results: kinit: Connection refused while getting default ccache Expected Results: Should run kinit and get a ticket -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2308428 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 36

[Bug 2299733] New: logrotate service will fail to start due to improper permissions on /var/log/sssd directory
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2299733 Bug ID: 2299733 Summary: logrotate service will fail to start due to improper permissions on /var/log/sssd directory Product: Fedora Version: rawhide Hardware: x86_64 OS: Linux Status: NEW Component: sssd Keywords: Regression Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: sponix2ipfw(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora I see that the logrotate service has failed to start from within cockpit. In there it explains that this is due to improper permissions on /var/log/sssd directory. After a sudo chmod 755 /var/log/sssd I can start the logrotate service without issues. Pretty sure what I've done to resolve this is take the permissions from drwxrwxr-x to drwxr-xr-x on this directory. Reproducible: Always Steps to Reproduce: 1.Apply system updates that include sssd, have a look at services in cockpit 2.after seeing the logrotate service failed to start using sudo chmod 755 /var/log/sssd 3.clear the error, and start logrotate and it works as it should Actual Results: Well, the steps above get logrotate running again. I am not sure how this may effect the sssd system itself though Expected Results: it is expected to see logrotate service running without the need to use sudo chmod 755 /var/log/sssd -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2299733 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 22

[Bug 2264610] New: FTBFS: sssd intermediate CA tests fail with OpenSSL 3.2
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2264610 Bug ID: 2264610 Summary: FTBFS: sssd intermediate CA tests fail with OpenSSL 3.2 Product: Fedora Version: rawhide OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: sgallagh(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora $ /usr/bin/make -C src/tests/test_CA/intermediate_CA ca_all make: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' test -z "index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf " || rm -f index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf rm -rf .libs _libs rm -rf newcerts rm -rf softhsm* rm -rf serial* rm -f *.lo /usr/bin/make -C ./.. SSSD_test_CA.pem make[1]: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' /usr/bin/openssl req -batch -config ./SSSD_test_CA.config -x509 -new -nodes -key SSSD_test_CA_key.pem -sha256 -days 1024 -set_serial 0 -extensions v3_ca -out SSSD_test_CA.pem make[1]: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' ln -s ./../SSSD_test_CA.pem /usr/bin/openssl req -batch -config ./SSSD_test_intermediate_CA.config -new -nodes -key /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_key.pem -sha256 -out SSSD_test_intermediate_CA_req.pem cd .. && /usr/bin/openssl ca -config /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config -batch -notext -keyfile /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA_key.pem -in /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_req.pem -days 200 -extensions v3_intermediate_ca -out /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA.pem Using configuration from /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config Check that the request matches the signature Signature ok ERROR:There is already a certificate for /O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA The matching entry has the following details Type :Valid Expires on :240903175906Z Serial Number :08 File name :unknown Subject Name :/O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA make: *** [Makefile:756: SSSD_test_intermediate_CA.pem] Error 1 make: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' Reproducible: Always Steps to Reproduce: 1.Build SSSD and run the intermediate CA tests 2. 3. Actual Results: $ /usr/bin/make -C src/tests/test_CA/intermediate_CA ca_all make: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' test -z "index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf " || rm -f index.txt index.txt.attr index.txt.attr.old index.txt.old SSSD_test_intermediate_CA.pem SSSD_test_intermediate_CA_req.pem SSSD_test_intermediate_CA_full_db.pem SSSD_test_CA.pem pwdfile SSSD_test_intermediate_CA_cert_x509_0001.pem SSSD_test_intermediate_CA_cert_x509_0001.h SSSD_test_intermediate_CA_cert_pubsshkey_0001.pub SSSD_test_intermediate_CA_cert_pubsshkey_0001.h SSSD_test_intermediate_CA_cert_pkcs12_0001.pem softhsm2_*.conf rm -rf .libs _libs rm -rf newcerts rm -rf softhsm* rm -rf serial* rm -f *.lo /usr/bin/make -C ./.. SSSD_test_CA.pem make[1]: Entering directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' /usr/bin/openssl req -batch -config ./SSSD_test_CA.config -x509 -new -nodes -key SSSD_test_CA_key.pem -sha256 -days 1024 -set_serial 0 -extensions v3_ca -out SSSD_test_CA.pem make[1]: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA' ln -s ./../SSSD_test_CA.pem /usr/bin/openssl req -batch -config ./SSSD_test_intermediate_CA.config -new -nodes -key /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_key.pem -sha256 -out SSSD_test_intermediate_CA_req.pem cd .. && /usr/bin/openssl ca -config /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config -batch -notext -keyfile /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA_key.pem -in /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA_req.pem -days 200 -extensions v3_intermediate_ca -out /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/SSSD_test_intermediate_CA.pem Using configuration from /home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA/../SSSD_test_CA.config Check that the request matches the signature Signature ok ERROR:There is already a certificate for /O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA The matching entry has the following details Type :Valid Expires on :240903175906Z Serial Number :08 File name :unknown Subject Name :/O=SSSD/OU=SSSD test/CN=SSSD test intermediate CA make: *** [Makefile:756: SSSD_test_intermediate_CA.pem] Error 1 make: Leaving directory '/home/sgallagh/localworkspace/sssd/src/tests/test_CA/intermediate_CA' Expected Results: Successful test run. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2264610 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2311897] New: sssd_kcm service fails with `could not open file /var/lib/sss/secrets/secrets.ldb: Permission denied`
by bugzilla＠redhat.com 12 Sep '24

12 Sep '24

https://bugzilla.redhat.com/show_bug.cgi?id=2311897 Bug ID: 2311897 Summary: sssd_kcm service fails with `could not open file /var/lib/sss/secrets/secrets.ldb: Permission denied` Product: Fedora Version: 41 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: mkonecny(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora After rebasing to Fedora Silverblue 41 from Fedora Silverblue 40 I'm unable to generate a kerberos ticket with `kinit: Connection refused while getting default ccache`. After some searching I found out that this needs sssd_kcm service to be running. But sssd_kcm fails with: ``` zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: ltdb: tdb(/var/lib/sss/secrets/secrets.ldb): tdb_open_ex: could not open file /var/lib/sss/secrets/secrets.ldb: Permission denied zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: Unable to open tdb '/var/lib/sss/secrets/secrets.ldb': Permission denied zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: Failed to connect to '/var/lib/sss/secrets/secrets.ldb' with backend 'tdb': Unable to open tdb '/var/lib/sss/secrets/secrets.ldb: Permission denied zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: (2024-09-12 13:13:00): [kcm] [sss_sec_init] (0x0020): Failed to initialize secdb [5]: Input/output error zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: (2024-09-12 13:13:00): [kcm] [ccdb_secdb_init] (0x0020): Cannot initialize the security database zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: (2024-09-12 13:13:00): [kcm] [kcm_ccdb_init] (0x0020): Cannot initialize ccache database zář 12 13:13:00 zlopez-workstation sssd_kcm[16158]: (2024-09-12 13:13:00): [kcm] [kcm_process_init] (0x0010): fatal error initializing responder data ``` Reproducible: Always Steps to Reproduce: 1. systemctl start sssd_kcm Actual Results: Service fails to start Expected Results: Service starts -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2311897 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

2024

2023

2022

2021

2020

Sssd-maintainers September 2024