March 2018 - sssd-users - Fedora mailing-lists

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

SSSD strangeness
by simonc99＠hotmail.com 05 Nov '19

05 Nov '19

Hi All We've got SSSD 1.13.0 installed as part of a Centos 7.2.1511 installation. We've used realmd to join the host concerned to our 2008R2 AD system. This went really well, and consequently we've been using SSSD to provide login services and kerberos integration for our fairly large hadoop system. The authconfig that's implicitly run as part of realmd produces the following sssd.conf: [sssd] domains = <joined domain> config_file_version = 2 services = nss, pam [pam] debug_level = 0x0080 [nss] timeout = 20 force_timeout = 600 debug_level = 0x0080 [domain/<joined domain>] ad_domain = <joined domain> krb5_realm = <JOINED DOMAIN> realmd_tags = manages-system joined-with-samba cache_credentials = true id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = simple simple_allow_groups = <AD group allowing logins> krb5_use_kdc_info = False entry_cache_timeout = 300 debug_level = 0x0080 ad_server = <active directory server> As I've said - this works really well. We did have some stability issues initially, but they've been fixed by defining the 'ad_server' rather than using autodiscovery. Logins work fine, kerberos TGTs are issued on login, and password changes are honoured correctly. However, in general day to day use, we have noticed a few anomalies, that we just can't track down. Firstly (this has happened a few times), a user will change their AD password (via a Windows PC). Subsequent logins - sometimes with specific client software - fail with pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<remote PC name> user=<username> pam_sss(sshd:auth): received for user <username>: 17 (failure setting user credentials) So in this example, the person concerned has changed their AD password. Further attempts to access this system via SSH work fine. However, using SFTP doesn't work (the above is output into /var/log/secure). There are no local controls on sftp logins, and the user concerned was working fine (using both sftp and ssh) until they updated their password. There is no separate sftp daemon running, and it only affects one individual currently (but we have seen some very similar instances before) The second issue we have is around phantom groups in AD. Hadoop uses an id -Gn command to see group membership for authorisation. With some users - we've seen 6 currently - we see certain groups failing to be looked up: id -Gn <username> id: cannot find name for group ID xxxxyyyyy <group name> <group name> <group name> <group name> <etc...> The xxxxyyyyy indicates: xxxx = hashed realm name yyyyy = RID from group in AD We can't find any group with that number on the AD side! We can work around this by adding a local group (into /etc/group) for the GIDs affected. This means the id -Gn runs correctly, and the hadoop namenode can function correctly - but this is a workaround and we'd like to get to the bottom of the issue. Rather than flooding this post now with logfiles, just thought I'd see if this looked familiar to anyone. Happy to upload any logs, amend logging levels, etc. Many thanks Simon

4 7

Re: Experiencing a bug on users' name and ID
by Asif Iqbal 25 May '18

25 May '18

I still like some help with any workaround in dealing with string. IT LDAP team do not have any attribute value with real number. Is it possible to create a local DB to map the mnetid to a real number and then use that table as a reference for ID mapping? I am not sure if this discussion should be in developer mailing list. Appreciate any help On Mar 8, 2018 11:29 PM, "Asif Iqbal" <vadud3(a)gmail.com> wrote: On Wed, Feb 28, 2018 at 4:27 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote: > I think the next good step would be to show the LDIF and logs of a > resolution of a single faulty entry, e.g. 80974 which you used earlier as > an example of an entry that doesn’t work. > Here are some logs for this account dn: uid=mwvande,ou=People,dc=mnet,dc=qintra,dc=com mnetid: 004311 (Thu Mar 8 22:10:22 2018) [sssd[be[LDAP]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=4311] (Thu Mar 8 22:10:22 2018) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(mnetid=4311)(objectclass= mnetPerson)(uid=*)(&(mnetid=*)(!(mnetid=0))))][ou=People,dc= mnet,dc=qintra,dc=com]. (Thu Mar 8 22:10:22 2018) [sssd[be[LDAP]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::LDAP:idnumber=4311] from reply table (Thu Mar 8 22:10:29 2018) [sssd[be[LDAP]]] [dp_get_account_info_handler] (0x0200): Got request for [0x2][BE_REQ_GROUP][idnumber=4311] (Thu Mar 8 22:10:29 2018) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(mnetid=4311)(objectClass= inetOrgPerson)(uid=*)(&(mnetid=*)(!(mnetid=0))))][ou= People,dc=mnet,dc=qintra,dc=com]. (Thu Mar 8 22:10:29 2018) [sssd[be[LDAP]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:2::LDAP:idnumber=4311] from reply table (Thu Mar 8 22:11:14 2018) [sssd[be[LDAP]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=4311@ldap] (Thu Mar 8 22:11:14 2018) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=4311)(objectclass= mnetPerson)(uid=*)(&(mnetid=*)(!(mnetid=0))))][ou=People,dc= mnet,dc=qintra,dc=com]. (Thu Mar 8 22:11:14 2018) [sssd[be[LDAP]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::LDAP:name=4311@ldap] from reply table (Thu Mar 8 22:11:14 2018) [sssd[be[LDAP]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=4311] (Thu Mar 8 22:11:14 2018) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(mnetid=4311)(objectclass= mnetPerson)(uid=*)(&(mnetid=*)(!(mnetid=0))))][ou=People,dc= mnet,dc=qintra,dc=com]. (Thu Mar 8 22:11:14 2018) [sssd[be[LDAP]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::LDAP:idnumber=4311] from reply table (Thu Mar 8 22:11:38 2018) [sssd[be[LDAP]]] [dp_get_account_info_handler] (0x0200): Got request for [0x2][BE_REQ_GROUP][idnumber=4311] (Thu Mar 8 22:11:38 2018) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(mnetid=4311)(objectClass= inetOrgPerson)(uid=*)(&(mnetid=*)(!(mnetid=0))))][ou= People,dc=mnet,dc=qintra,dc=com]. (Thu Mar 8 22:11:38 2018) [sssd[be[LDAP]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:2::LDAP:idnumber=4311] from reply table (Thu Mar 8 22:12:00 2018) [sssd[be[LDAP]]] [dp_get_account_info_handler] (0x0200): Got request for [0x2][BE_REQ_GROUP][idnumber=4311] (Thu Mar 8 22:12:00 2018) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(mnetid=4311)(objectClass= inetOrgPerson)(uid=*)(&(mnetid=*)(!(mnetid=0))))][ou= People,dc=mnet,dc=qintra,dc=com]. (Thu Mar 8 22:12:00 2018) [sssd[be[LDAP]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:2::LDAP:idnumber=4311] from reply table (Thu Mar 8 22:10:22 2018) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 4311 (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913574: Looking up UID:4311@LDAP (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913574: Checking negative cache for [UID:4311@LDAP] (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913574: [UID:4311@LDAP] is not present in negative cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913574: Looking up [UID:4311@LDAP] in cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913574: Object [UID:4311@LDAP] was not found in cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #913574: Looking up [UID:4311@LDAP] in data provider (Thu Mar 8 22:10:22 2018) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5641be284b10:1:4311@LDAP] (Thu Mar 8 22:10:22 2018) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][0x1][BE_REQ_USER][idnumber=4311:-] (Thu Mar 8 22:10:22 2018) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5641be284b10:1:4311@LDAP] (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913574: Looking up [UID:4311@LDAP] in cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913574: Object [UID:4311@LDAP] was not found in cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [cache_req_global_ncache_add] (0x0400): CR #913574: Adding [UID:4311@LDAP] to global negative cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/4311] to negative cache (Thu Mar 8 22:10:22 2018) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5641be284b10:1:4311@LDAP] (Thu Mar 8 22:10:29 2018) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 4311 (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913598: Looking up GID:4311@LDAP (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913598: Checking negative cache for [GID:4311@LDAP] (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913598: [GID:4311@LDAP] is not present in negative cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913598: Looking up [GID:4311@LDAP] in cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913598: Object [GID:4311@LDAP] was not found in cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #913598: Looking up [GID:4311@LDAP] in data provider (Thu Mar 8 22:10:29 2018) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:10:29 2018) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][0x2][BE_REQ_GROUP][idnumber=4311:-] (Thu Mar 8 22:10:29 2018) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913598: Looking up [GID:4311@LDAP] in cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913598: Object [GID:4311@LDAP] was not found in cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [cache_req_global_ncache_add] (0x0400): CR #913598: Adding [GID:4311@LDAP] to global negative cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/4311] to negative cache (Thu Mar 8 22:10:29 2018) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [nss_getby_name] (0x0400): Input name: 4311 (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_process_input] (0x0400): CR #913740: Parsing input name [4311] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '4311' matched without domain, user is 4311 (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_set_name] (0x0400): CR #913740: Setting name [4311] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913740: Looking up 4311@ldap (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913740: Checking negative cache for [4311@ldap] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913740: [4311@ldap] is not present in negative cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913740: Looking up [4311@ldap] in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913740: Object [4311@ldap] was not found in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #913740: Looking up [4311@ldap] in data provider (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5641be284b10:1:4311@ldap@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][0x1][BE_REQ_USER][name=4311@ldap:-] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5641be284b10:1:4311@ldap@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913740: Looking up [4311@ldap] in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913740: Object [4311@ldap] was not found in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_ncache_add] (0x0400): CR #913740: Adding [4311@ldap] to negative cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/LDAP/4311@ldap] to negative cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5641be284b10:1:4311@ldap@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 4311 (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913741: Looking up UID:4311@LDAP (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913741: Checking negative cache for [UID:4311@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913741: [UID:4311@LDAP] is not present in negative cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913741: Looking up [UID:4311@LDAP] in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913741: Object [UID:4311@LDAP] was not found in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #913741: Looking up [UID:4311@LDAP] in data provider (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5641be284b10:1:4311@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][0x1][BE_REQ_USER][idnumber=4311:-] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5641be284b10:1:4311@LDAP] (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913741: Looking up [UID:4311@LDAP] in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913741: Object [UID:4311@LDAP] was not found in cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [cache_req_global_ncache_add] (0x0400): CR #913741: Adding [UID:4311@LDAP] to global negative cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/UID/4311] to negative cache (Thu Mar 8 22:11:14 2018) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5641be284b10:1:4311@LDAP] (Thu Mar 8 22:11:15 2018) [sssd[nss]] [nss_getby_name] (0x0400): Input name: 4311 (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_process_input] (0x0400): CR #913742: Parsing input name [4311] (Thu Mar 8 22:11:15 2018) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name '4311' matched without domain, user is 4311 (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_set_name] (0x0400): CR #913742: Setting name [4311] (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913742: Looking up 4311@ldap (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913742: Checking negative cache for [4311@ldap] (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913742: [4311@ldap] does not exist (negative cache) (Thu Mar 8 22:11:15 2018) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 4311 (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913743: Looking up UID:4311@LDAP (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913743: Checking negative cache for [UID:4311@LDAP] (Thu Mar 8 22:11:15 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913743: [UID:4311@LDAP] does not exist (negative cache) (Thu Mar 8 22:11:38 2018) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 4311 (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913764: Looking up GID:4311@LDAP (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913764: Checking negative cache for [GID:4311@LDAP] (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913764: [GID:4311@LDAP] is not present in negative cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913764: Looking up [GID:4311@LDAP] in cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913764: Object [GID:4311@LDAP] was not found in cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #913764: Looking up [GID:4311@LDAP] in data provider (Thu Mar 8 22:11:38 2018) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:11:38 2018) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][0x2][BE_REQ_GROUP][idnumber=4311:-] (Thu Mar 8 22:11:38 2018) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913764: Looking up [GID:4311@LDAP] in cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913764: Object [GID:4311@LDAP] was not found in cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [cache_req_global_ncache_add] (0x0400): CR #913764: Adding [GID:4311@LDAP] to global negative cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/4311] to negative cache (Thu Mar 8 22:11:38 2018) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:12:00 2018) [sssd[nss]] [nss_getby_id] (0x0400): Input ID: 4311 (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR #913765: Looking up GID:4311@LDAP (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913765: Checking negative cache for [GID:4311@LDAP] (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400): CR #913765: [GID:4311@LDAP] is not present in negative cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913765: Looking up [GID:4311@LDAP] in cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913765: Object [GID:4311@LDAP] was not found in cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_dp] (0x0400): CR #913765: Looking up [GID:4311@LDAP] in data provider (Thu Mar 8 22:12:00 2018) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:12:00 2018) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][0x2][BE_REQ_GROUP][idnumber=4311:-] (Thu Mar 8 22:12:00 2018) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5641be284b10:2:4311@LDAP] (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913765: Looking up [GID:4311@LDAP] in cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_search_cache] (0x0400): CR #913765: Object [GID:4311@LDAP] was not found in cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [cache_req_global_ncache_add] (0x0400): CR #913765: Adding [GID:4311@LDAP] to global negative cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [sss_ncache_set_str] (0x0400): Adding [NCE/GID/4311] to negative cache (Thu Mar 8 22:12:00 2018) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5641be284b10:2:4311@LDAP] > > > On 28 Feb 2018, at 01:30, Asif Iqbal <vadud3(a)gmail.com> wrote: > > > > > > > > On Tue, Feb 27, 2018 at 1:12 PM, Asif Iqbal <vadud3(a)gmail.com> wrote: > > > > > > On Tue, Feb 27, 2018 at 3:37 AM, Sumit Bose <sbose(a)redhat.com> wrote: > > On Mon, Feb 26, 2018 at 10:21:14PM -0500, Asif Iqbal wrote: > > > I have 300 out of 3000 users whose /home/<username> dir shows uid and > gid > > > instead of username and groupname. > > > > > > It seems to be behaving like a bug > > > > > > As soon I become a user with `sudo su - username' the uid of the home > dir > > > changes to username but gid still does not change to groupname. > > > > > > I also get an error message, but still successfully become that user > > > > > > $ ls -ld /home/mbniels > > > drwx------. 3 80974 80974 4096 Feb 27 02:15 /home/mbniels > > > > > > $ su - mbniels > > > Last login: Tue Feb 27 02:34:04 UTC 2018 on pts/39 > > > /usr/bin/id: cannot find name for group ID 80974 > > > groups: cannot find name for group ID 80974 > > > > > > $ ls -ld /home/mbniels > > > drwx------. 3 mbniels 80974 4096 Feb 27 02:15 /home/mbniels > > > > > > Then to check the groups of username I get another error which then > gets > > > cleared by next command. > > > > > > $ groups mbniels > > > mbniels : groups: cannot find name for group ID 80974 > > > 80974 users > > > > > > $ getent group mbniels > > > mbniels:*:80974 > > > > > > $ groups mbniels > > > mbniels : mbniels users > > > > > > It also fixes the gid to groupname > > > > > > $ ls -ld /home/mbniels/ > > > drwx------. 3 mbniels mbniels 4096 Feb 27 02:15 /home/mbniels/ > > > > > > I noticed it reverts after may be within half an hour, not exact sure > when. > > > Almost behaves like `quantum entanglement'. > > > As soon as I try to check by trying to become that user the issue > > > disappears. > > > > > > This is not just cosmetic issue, when the home dir shows ownership with > > > uid, instead of username, the user fails some commands. > > > > > > We just started noticing today, since we just built this box and only > few > > > months ago and users are being invited to start using this server > > > > > > Some annoying error it is showing like below and user then fails to ssh > > > > > > $ ssh remote > > > No user exists for uid 80974 > > > > > > I am using centos 7 and sssd 1.15.2 > > > > > > $ cat /etc/redhat-release > > > CentOS Linux release 7.4.1708 (Core) > > > > > > $ sssd --version > > > 1.15.2 > > > > > > Here are some relevant logs > > > https://paste.fedoraproject.org/paste/gBaZ-Vr8Urh-M5ABpaRNuA > > > > It looks like you are not using a plain RFC2307bis LDAP schema. Can you > > send you sssd.conf and a typical LDAP user and group object? > > > > bye, > > Sumit > > > > > > Here is an ldap user and I using same info as group (sanitized) > > > > dn: uid=mbniels,ou=People,dc=example,dc=com > > roomNumber: 123456 > > departmentNumber: 3.11.3 > > tier1: Technology > > joblevel: 6 > > legacycompany: G > > mobile: +11234567890 > > manager: uid=managerid,ou=People,dc=example,dc=com > > departmentname: TESTING & INTEG > > costcenter: S0019751 > > companynumber: S001 > > companyname: EXAMPLE COMPANY > > displayName: FOO, BAR > > preferredname: Mark > > docshareaccess: TRUE > > sAMAccountName: mbniels > > l: XX > > street: 123 example ave > > saploginid: foobar > > title: LEAD ARCHITECT > > postalCode: 123456 > > employeeNumber: 00112233 > > mail: foo.bar(a)example.com > > objectClass: top > > objectClass: person > > objectClass: organizationalPerson > > objectClass: inetOrgPerson > > objectClass: mnetPerson > > mnetid: 080974 > > uid: mbniels > > givenName: Mark > > st: XX > > cn: Foo Bar > > sn: Bar > > employeeType: Management > > initials: X > > nationnumber: USA > > nationname: United States > > > > > > > > I am still looking for some help on this. > > > > > > > > -- > > Asif Iqbal > > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu > > A: Because it messes up the order in which people normally read text. > > Q: Why is top-posting such a bad thing? > > > > _______________________________________________ > > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 21

SSSD for one-way trusted AD domain
by Ondrej Valousek 15 May '18

15 May '18

Hi List, Question, we have joined machine into AD domain B. This domain has one way trust to domain A. No direct connection from domain B network to DCs in domain A is possible. Can we use SSSD to authenticate members in domain A. In windows, this works - but can't get it working in Linux via SSSD (Fedora 25, used realmd for AD join). Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

3 2

sssd 1.16.1 wont start, Centos 7.4
by Lachlan Musicman 04 Apr '18

04 Apr '18

Using the newly minted SSSD 1.16.1 from COPR, the sssd service doesn't restart. ( https://copr.fedorainfracloud.org/coprs/g/sssd/sssd-1-16/) The journalctl -xe shows: -- Unit sssd.service has begun starting up. Mar 29 09:05:55 linuxclient1.unixdev.company.com sssd[1477]: Starting up Mar 29 09:05:55 linuxclient1.unixdev.company.com systemd[1]: sssd.service: main process exited, code=exited, status=3/NOTIMPLEMENTED Mar 29 09:05:55 linuxclient1.unixdev.company.com systemd[1]: Failed to start System Security Services Daemon. -- Subject: Unit sssd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel The /var/log/sssd/sssd.log shows (Thu Mar 29 09:03:44 2018) [sssd] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb (Thu Mar 29 09:03:44 2018) [sssd] [_snotify_create] (0x0400): Added a watch for /etc/resolv.conf with inotify flags 0x8D88 internal flags 0x1 using function resolv_conf_inotify_cb after delay 1.0 (Thu Mar 29 09:03:44 2018) [sssd] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))]. (Thu Mar 29 09:03:44 2018) [sssd] [sss_fqnames_init] (0x0100): Using fq format [%1$s]. (Thu Mar 29 09:03:44 2018) [sssd] [sysdb_domain_init_internal] (0x0200): DB File for unixdev.company.com: /var/lib/sss/db/cache_unixdev.company.com.ldb (Thu Mar 29 09:03:44 2018) [sssd] [sysdb_domain_init_internal] (0x0200): Timestamp file for unixdev.company.com: /var/lib/sss/db/timestamps_unixdev.company.com.ldb (Thu Mar 29 09:03:44 2018) [sssd] [ldb] (0x0400): asq: Unable to register control with rootdse! (Thu Mar 29 09:03:44 2018) [sssd] [sbus_new_server] (0x0020): dbus_server_listen failed! (name=org.freedesktop.DBus.Error.AccessDenied, message=Failed to bind socket "/var/lib/sss/pipes/private/sbus-monitor": Permission denied) (Thu Mar 29 09:05:55 2018) [sssd] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb (Thu Mar 29 09:05:55 2018) [sssd] [_snotify_create] (0x0400): Added a watch for /etc/resolv.conf with inotify flags 0x8D88 internal flags 0x1 using function resolv_conf_inotify_cb after delay 1.0 (Thu Mar 29 09:05:55 2018) [sssd] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<domain>.+$))|(^(?P<name>[^@\\]+)$))]. (Thu Mar 29 09:05:55 2018) [sssd] [sss_fqnames_init] (0x0100): Using fq format [%1$s]. (Thu Mar 29 09:05:55 2018) [sssd] [sysdb_domain_init_internal] (0x0200): DB File for unixdev.company.com: /var/lib/sss/db/cache_unixdev.company.com.ldb (Thu Mar 29 09:05:55 2018) [sssd] [sysdb_domain_init_internal] (0x0200): Timestamp file for unixdev.company.com: /var/lib/sss/db/timestamps_unixdev.company.com.ldb (Thu Mar 29 09:05:55 2018) [sssd] [ldb] (0x0400): asq: Unable to register control with rootdse! (Thu Mar 29 09:05:55 2018) [sssd] [sbus_new_server] (0x0020): dbus_server_listen failed! (name=org.freedesktop.DBus.Error.AccessDenied, message=Failed to bind socket "/var/lib/sss/pipes/private/sbus-monitor": Permission denied) /var/lib/sss/pipes/private shows drwxr-x---. 2 sssd root 4096 Mar 29 08:50 . drwxr-xr-x. 3 sssd sssd 71 Mar 29 03:01 .. srw------- 1 root root 0 Mar 19 09:21 pam lrwxrwxrwx 1 root root 62 Mar 19 09:20 sbus-dp_unixdev.company.com -> /var/lib/sss/pipes/private/sbus-dp_unixdev.company.com.758 srw------- 1 root root 0 Sep 18 2017 sbus-dp_unixdev.company.com.732 srw------- 1 root root 0 Dec 28 09:47 sbus-dp_unixdev.company.com.746 It looks like there's some clean up that's not happening? I don't actually know what sbus_dp files do, but the top result (pointing to .758) doesn't exist... How do I fix this? Cheers L. ------ "The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics is the insistence that we cannot ignore the truth, nor should we panic about it. It is a shared consciousness that our institutions have failed and our ecosystem is collapsing, yet we are still here — and we are creative agents who can shape our destinies. Apocalyptic civics is the conviction that the only way out is through, and the only way through is together. " *Greg Bloom* @greggish https://twitter.com/greggish/status/873177525903609857

3 7

Ubuntu 16.04.4 LTS 4.4.0-108+ and sssd freezes virtual server
by David Hunter 19 Mar '18

19 Mar '18

*Guest OS*: Ubuntu 16.04.4 LTS (kernel versions 4.4.0-108 to current 116) *Virtualization env*: VMWare ESXi 6.0 *Host hardware*: Dell R720 Using SSSD to bind linux servers to the AD domain for authentication. This was working fine right up to 4.4.0-104. After the update to -108,-109,-112, or -116, if sssd is enabled OR if it is disabled but then started after a successful boot and you perform a lookup (i.e. id some_domain_user), the entire system will freeze, and you have to force a reboot. There's even a blip in the syslog when it happens. I increased loglevel to 9 in the sssd.conf file in all the sections, and then started SSSD and tried to lookup a user. The most meaningful things I've been able to pull out are: sssd.log: (Fri Mar 16 13:06:03 2018) [sssd] [service_send_ping] (0x2000): Pinging ad.domain.com (Fri Mar 16 13:06:03 2018) [sssd] [sbus_add_timeout] (0x2000): 0x88a9d0 (Fri Mar 16 13:06:03 2018) [sssd] [service_send_ping] (0x2000): Pinging nss (Fri Mar 16 13:06:03 2018) [sssd] [sbus_add_timeout] (0x2000): 0x8904c0 (Fri Mar 16 13:06:03 2018) [sssd] [service_send_ping] (0x2000): Pinging pam (Fri Mar 16 13:06:03 2018) [sssd] [sbus_add_timeout] (0x2000): 0x88ede0 (Fri Mar 16 13:06:03 2018) [sssd] [service_send_ping] (0x2000): Pinging ssh (Fri Mar 16 13:06:03 2018) [sssd] [sbus_add_timeout] (0x2000): 0x889710 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_remove_timeout] (0x2000): 0x88a9d0 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x888c10 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Fri Mar 16 13:06:03 2018) [sssd] [ping_check] (0x2000): Service ad.domain.com replied to ping (Fri Mar 16 13:06:03 2018) [sssd] [sbus_remove_timeout] (0x2000): 0x88ede0 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x890e00 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Fri Mar 16 13:06:03 2018) [sssd] [ping_check] (0x2000): Service pam replied to ping (Fri Mar 16 13:06:03 2018) [sssd] [sbus_remove_timeout] (0x2000): 0x889710 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x88d5f0 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Fri Mar 16 13:06:03 2018) [sssd] [ping_check] (0x2000): Service ssh replied to ping (Fri Mar 16 13:06:03 2018) [sssd] [sbus_remove_timeout] (0x2000): 0x8904c0 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x88eae0 (Fri Mar 16 13:06:03 2018) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Fri Mar 16 13:06:03 2018) [sssd] [ping_check] (0x2000): Service nss replied to ping sssd_nss.log: (Fri Mar 16 13:05:06 2018) [sssd[nss]] [id_callback] (0x0010): The Monitor returned an error [org.freedesktop.DBus.Error.NoReply] sssd_ad.domain.com.log: (Fri Mar 16 13:05:13 2018) [sssd[be[ad.domain.com]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Fri Mar 16 13:05:13 2018) [sssd[be[ad.domain.com]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Fri Mar 16 13:05:23 2018) [sssd[be[ad.domain.com]]] [sbus_dispatch] (0x4000): dbus conn: 0xf1e840 (Fri Mar 16 13:05:23 2018) [sssd[be[ad.domain.com]]] [sbus_dispatch] (0x4000): Dispatching. sssd_ssh.log: (Fri Mar 16 13:06:53 2018) [sssd[ssh]] [sbus_dispatch] (0x4000): dbus conn: 0x1817880 (Fri Mar 16 13:06:53 2018) [sssd[ssh]] [sbus_dispatch] (0x4000): Dispatching. (Fri Mar 16 13:06:53 2018) [sssd[ssh]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.service.ping on path /org/freedesktop/sssd/service (Fri Mar 16 13:06:53 2018) [sssd[ssh]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit sssd.conf: [sssd] domains = ad.domain.com config_file_version = 2 services = nss, pam, ssh # default_domain_suffix = ad.domain.com [ssh] [domain/ad.domain.com] ad_domain = ad.domain.com krb5_realm = AD.DOMAIN.COM realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True fallback_homedir = /home/%d/%u access_provider = ad # use_fully_qualified_names = True ad_gpo_access_control = permissive ad_access_filter = ad.domain.com:(memberOf=CN=Information Technology,CN=Users,DC=ad,DC=domain,DC=com) ldap_sasl_authid = ServicePrincipalName | userPrincipalName ldap_user_ssh_public_key = sshPublicKeys ldap_user_certificate = noSuchAttribute Trying to capture boot time logs wasn't successful (with sssd enabled with systemd). Just a big gap in kernel.log and syslog. Watching the boot process shows that it hangs at: Started D-Bus System Messaging Bus Which appears to be corroborate the problems being indicated in the sssd logs. Some kinda problem with sssd sending dbus messages, right? If I revert to -104, all good. Anything above that version, sadness. What is weird is that I do not have these problems on a test system using VirtualBox on my MacBook Pro running the same version of Ubuntu 16.04.4 LTS. I'm wondering if this might be a Meltdown related issue, as it happened with the kernel version that was initially released to address it (-108). We applied updates to our physical hosts, ESXi and the fixes for the guest OS. I'm afraid it is a weird confluence of host+vmware+guest OS problems. Already tried making sssd.service the last service to start. No change in behavior other than it hangs later in the boot process. Any insight or help appreciated! Thanks! Dave

3 3

nss_getpwnam: name 'tom@my.dom@localdomain' does not map into domain 'nix.my.dom'
by TomK 18 Mar '18

18 Mar '18

Hey Guy's, Getting below message which in turn fails to list proper UID / GID on NFSv4 mounts from within an unprivileged account. All files show up with owner and group as nobody / nobody when viewed from the client. Is there a way to structure /etc/idmapd.conf to allow for proper UID / GID resolution? Or perhaps another solution? [root@client01 etc]# cat /etc/idmapd.conf|grep -v "#"| sed -e "/^$/d" [General] Verbosity = 7 Domain = nix.my.dom [Mapping] [Translation] [Static] [UMICH_SCHEMA] LDAP_server = ldap-server.local.domain.edu LDAP_base = dc=local,dc=domain,dc=edu [root@client01 etc]# Mount looks like this: nfs-c01.nix.my.dom:/n/my.dom on /n/my.dom type nfs4 (rw,relatime,vers=4.0,rsize=8192,wsize=8192,namlen=255,hard,proto=tcp,port=0,timeo=10,retrans=2,sec=sys,clientaddr=192.168.0.236,local_lock=none,addr=192.168.0.80) /var/log/messages Mar 6 00:17:27 client01 nfsidmap[14396]: key: 0x3f2c257b type: uid value: tom@my.dom@localdomain timeout 600 Mar 6 00:17:27 client01 nfsidmap[14396]: nfs4_name_to_uid: calling nsswitch->name_to_uid Mar 6 00:17:27 client01 nfsidmap[14396]: nss_getpwnam: name 'tom@my.dom@localdomain' domain 'nix.my.dom': resulting localname '(null)' Mar 6 00:17:27 client01 nfsidmap[14396]: nss_getpwnam: name 'tom@my.dom@localdomain' does not map into domain 'nix.my.dom' Mar 6 00:17:27 client01 nfsidmap[14396]: nfs4_name_to_uid: nsswitch->name_to_uid returned -22 Mar 6 00:17:27 client01 nfsidmap[14396]: nfs4_name_to_uid: final return value is -22 Mar 6 00:17:27 client01 nfsidmap[14396]: nfs4_name_to_uid: calling nsswitch->name_to_uid Mar 6 00:17:27 client01 nfsidmap[14396]: nss_getpwnam: name 'nobody(a)nix.my.dom' domain 'nix.my.dom': resulting localname 'nobody' Mar 6 00:17:27 client01 nfsidmap[14396]: nfs4_name_to_uid: nsswitch->name_to_uid returned 0 Mar 6 00:17:27 client01 nfsidmap[14396]: nfs4_name_to_uid: final return value is 0 Mar 6 00:17:27 client01 nfsidmap[14398]: key: 0x324b0048 type: gid value: tom@my.dom@localdomain timeout 600 Mar 6 00:17:27 client01 nfsidmap[14398]: nfs4_name_to_gid: calling nsswitch->name_to_gid Mar 6 00:17:27 client01 nfsidmap[14398]: nfs4_name_to_gid: nsswitch->name_to_gid returned -22 Mar 6 00:17:27 client01 nfsidmap[14398]: nfs4_name_to_gid: final return value is -22 Mar 6 00:17:27 client01 nfsidmap[14398]: nfs4_name_to_gid: calling nsswitch->name_to_gid Mar 6 00:17:27 client01 nfsidmap[14398]: nfs4_name_to_gid: nsswitch->name_to_gid returned 0 Mar 6 00:17:27 client01 nfsidmap[14398]: nfs4_name_to_gid: final return value is 0 Mar 6 00:17:31 client01 systemd-logind: Removed session 23. Result of: systemctl restart rpcidmapd /var/log/messages ------------------- Mar 5 23:46:12 client01 systemd: Stopping Automounts filesystems on demand... Mar 5 23:46:13 client01 systemd: Stopped Automounts filesystems on demand. Mar 5 23:48:51 client01 systemd: Stopping NFSv4 ID-name mapping service... Mar 5 23:48:51 client01 systemd: Starting Preprocess NFS configuration... Mar 5 23:48:51 client01 systemd: Started Preprocess NFS configuration. Mar 5 23:48:51 client01 systemd: Starting NFSv4 ID-name mapping service... Mar 5 23:48:51 client01 rpc.idmapd[14117]: libnfsidmap: using domain: nix.my.dom Mar 5 23:48:51 client01 rpc.idmapd[14117]: libnfsidmap: Realms list: 'NIX.MY.DOM' Mar 5 23:48:51 client01 rpc.idmapd: rpc.idmapd: libnfsidmap: using domain: nix.my.dom Mar 5 23:48:51 client01 rpc.idmapd: rpc.idmapd: libnfsidmap: Realms list: 'NIX.MY.DOM' Mar 5 23:48:51 client01 rpc.idmapd: rpc.idmapd: libnfsidmap: loaded plugin /lib64/libnfsidmap/nsswitch.so for method nsswitch Mar 5 23:48:51 client01 rpc.idmapd[14117]: libnfsidmap: loaded plugin /lib64/libnfsidmap/nsswitch.so for method nsswitch Mar 5 23:48:51 client01 rpc.idmapd[14118]: Expiration time is 600 seconds. Mar 5 23:48:51 client01 systemd: Started NFSv4 ID-name mapping service. Mar 5 23:48:51 client01 rpc.idmapd[14118]: Opened /proc/net/rpc/nfs4.nametoid/channel Mar 5 23:48:51 client01 rpc.idmapd[14118]: Opened /proc/net/rpc/nfs4.idtoname/channel -- Cheers, Tom K. ------------------------------------------------------------------------------------- Living on earth is expensive, but it includes a free trip around the sun.

2 10

Multiple logins by the same user at the same host at nearly the exact time
by Jim Richard 15 Mar '18

15 Mar '18

result in: pam_sss(sshd:account): Access denied for user rundeck: 4 (System error) I know this has been an issue in the past per some info I see in places like: https://access.redhat.com/solutions/1477473 <https://access.redhat.com/solutions/1477473> any chance there's been a regression bringing this issue back? <http://www.placeiq.com/> <http://www.placeiq.com/> <http://www.placeiq.com/> Jim Richard <https://twitter.com/placeiq> <https://twitter.com/placeiq> <https://twitter.com/placeiq> <https://www.facebook.com/PlaceIQ> <https://www.facebook.com/PlaceIQ> <https://www.linkedin.com/company/placeiq> <https://www.linkedin.com/company/placeiq> SYSTEM ADMINISTRATOR III (646) 338-8905 <http://www.placeiq.com/2015/05/26/placeiq-named-winner-of-prestigious-2015-…> <http://placeiq.com/2015/12/18/accuracy-vs-precision-in-location-data-mma-we…> <http://placeiq.com/2015/12/18/accuracy-vs-precision-in-location-data-mma-we…> <http://placeiq.com/2015/12/18/accuracy-vs-precision-in-location-data-mma-we…> <http://placeiq.com/2015/12/18/accuracy-vs-precision-in-location-data-mma-we…> <http://placeiq.com/2016/03/08/measuring-addressable-tv-campaigns-is-now-pos…> <http://placeiq.com/2016/04/13/placeiq-joins-the-network-advertising-initiat…> <http://placeiq.com/2016/04/13/placeiq-joins-the-network-advertising-initiat…> <http://placeiq.com/2016/04/13/placeiq-joins-the-network-advertising-initiat…> <http://placeiq.com/2016/04/13/placeiq-joins-the-network-advertising-initiat…> <http://placeiq.com/2016/04/13/placeiq-joins-the-network-advertising-initiat…> <http://pages.placeiq.com/Location-Data-Accuracy-Whitepaper-Download.html?ut…> <http://placeiq.com/2016/08/03/placeiq-bolsters-location-intelligence-platfo…> <http://placeiq.com/2016/10/26/the-making-of-a-location-data-industry-milest…> <http://placeiq.com/2016/12/07/placeiq-introduces-landmark-a-groundbreaking-…> <http://placeiq.com/2016/12/07/placeiq-introduces-landmark-a-groundbreaking-…> <https://www.placeiq.com/2017/05/placeiqs-landmark-powers-location-based-ins…>

2 5

SSSD and Firewalls
by Roger Mårtensson 14 Mar '18

14 Mar '18

Hello! Got tasked to look at firewall rules and am now wondering if there is a document anywhere that describes the ports and protocols used by SSSD? My list currently consist of: 53 (udp/tcp), 88 (udp), 389 (tcp), 636 (tcp) and 3268 (tcp) and 3269 (tcp) If I search on "Windows Client" and ports I get tons of ports and port-ranges I may need to open. But what do SSSD use?

4 4

Re: [Freeipa-users] Re: Auto create NFS home folders on IPA Server.
by TomK 14 Mar '18

14 Mar '18

On 2/26/2018 1:27 AM, Alexander Bokovoy via FreeIPA-users wrote: Thanks Alex. + SSSD mailing list. Two remaining questions. 1) Creating the NFS user folders on the server itself is not a problem however I would like to trap events that indicate USER logged into a client host. On this event, a home directory could then be created on the FreeIPA side. Without such an event I can't precreate it. So when a user logs into a client machine, is there any SSSD call initiated to the FreeIPA server that would show up in a log for example that I could in turn use to run a small shell script to precreate the user's home folder, if it doesn't exist? 2) Is there a way to get SSSD to retrieve the unixHomeDirectory that's defined in the UNIX Attribute on the AD side? Would be handy if I want to control all home directory locations on the AD side. The override_homedir works to force a folder but when I try the %o option to override_homedir, it appears to take the FreeIPA default home directory, not the AD one. Cheers, Tom > On su, 25 helmi 2018, TomK via FreeIPA-users wrote: >> Hey Guy's, >> >> For newly added AD or IPA users, is there a way to automatically >> create the user folders on the FreeIPA server under say >> /nfs/home/bill, for example so that when the remote client logs in, it >> sees the NFS mounted folder? >> >> Instructions that I can find right now require precreating the >> folders. Need them precreated via the FreeIPA master servers anytime >> someone attempts to login on a client using their AD credentials. Is >> this possible? Assume the NFS server will be local to the FreeIPA >> masters. > One needs to create home directories on the NFS server itself. If home > directories are mounted via NFS, then you need to have enough permission > to create the folder at the NFS root which is not what you'd want to > allow a regular user. Thus, it needs to be solved outside of a log-in > flow. > > We don't provide any means to solve this in FreeIPA because file > sharing/hosting is not a FreeIPA problem. If your NFS server is running > on an IPA master, though, you might want to consider not using NFS > mounts on that server itself. In this case a normal oddjob-based > pam_mkhomedir would create the directories just fine. > >> >> Found steps like the one below but step 5) still requires pre creation >> of the folders. >> >> https://www.redhat.com/archives/freeipa-users/2016-May/msg00380.html >> >> https://serverfault.com/questions/705039/how-to-automate-directory-creation… >> >> >> -- >> Cheers, >> Tom K. >> ------------------------------------------------------------------------------------- >> >> >> Living on earth is expensive, but it includes a free trip around the sun. >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to >> freeipa-users-leave(a)lists.fedorahosted.org > -- Cheers, Tom K. ------------------------------------------------------------------------------------- Living on earth is expensive, but it includes a free trip around the sun.

5 9

nsupdate
by Roger Martensson 13 Mar '18

13 Mar '18

Hi! Setup: Ubuntu 18.04 (future), SSSD 1.16.0, nsupdate/bind: 9.11.2.P1, 2008R2 DC/DNS I need some help and guidance with troubleshooting nsupdate-problems. I get the famous "TSIG error with server: tsig verify failure" when trying to update my A-record against our Microsoft DNS. I get the error in sssd-logs and the same error when running nsupdate manually with the same input as found in the logs (when cranking up debug level). I have tried with client keytab and with a user that I know have permission to update. (nsupdate with -g) SSSD is fully configured and I can do user lookups and logins. ldapsearch agains different domains in the forest with -Y GSSAPI works without problem. Our setup is a domain forest where the clients are in the subdomain and the DNS is in the parent domain. Parent DNS domain and subdomains is in the same Zone and has Secure Only updates enabled. Anyone have any ideas what I can do next to troubleshoot this issue?

4 5

Is it possible to disable or override hbac rules?
by Orion Poplawski 13 Mar '18

13 Mar '18

I'm dealing with a buggy sssd 1.13.4 on ubuntu 16.04 breaking HBAC rule processing for AD users. Is there someway I can disable this or override it for a specific user on the machine itself? Thanks. -- Orion Poplawski Manager of NWRA Technical Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Announcing SSSD 1.16.1
by Jakub Hrozek 13 Mar '18

13 Mar '18

SSSD 1.16.1 =========== The SSSD team is proud to announce the release of version 1.16.1 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ————— New Features ^^^^^^^^^^^^ * A new option ``auto_private_groups`` was added. If this option is enabled, SSSD will automatically create user private groups based on user's UID number. The GID number is ignored in this case. Please see https://docs.pagure.org/SSSD.sssd/design_pages/auto_private_groups.html for more details on the feature. * The SSSD smart card integration now supports a special type of PAM conversation implemented by GDM which allows the user to select the appropriate smrt card certificate in GDM. Please refer to https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_multiple_certifica… for more details about this feature. * A new API for accessing user and group information was added. This API is similar to the tradiional Name Service Switch API, but allows the consumer to talk to SSSD directly as well as to fine-tune the query with e.g. how cache should be evaluated. Please see https://docs.pagure.org/SSSD.sssd/design_pages/enhanced_nss_api.html for more information on the new API. * The ``sssctl`` command line tool gained a new command ``access-report``, which can generate who can access the client machine. Currently only generating the report on an IPA client based on HBAC rules is supported. Please see https://docs.pagure.org/SSSD.sssd/design_pages/attestation_report.html for more information about this new feature. * The ``hostid`` provider was moved from the IPA specific code to the generic LDAP code. This allows SSH host keys to be access by the generic LDAP provider as well. See the ``ldap_host_*`` options in the ``sssd-ldap`` manual page for more details. * Setting the ``memcache_timeout`` option to 0 disabled creating the memory cache files altogether. This can be useful in cases there is a bug in the memory cache that needs working around. Performance enhancements ^^^^^^^^^^^^^^^^^^^^^^^^ * Several internal changes to how objects are stored in the cache improve SSSD performance in environments with large number of objects of the same type (e.g. many users, many groups). In particular, several useless indexes were removed and the most common object types no longer use the indexed ``objectClass`` attribute, but use unindexed ``objectCategory`` instead (#3503) * In setups with ``id_provider=ad`` that use POSIX attributes which are replicated to the Global Catalog, SSSD uses the Global Catalog to determine which domain should be contacted for a by-ID lookup instead of iterating over all domains. More details about this feature can be found at https://docs.pagure.org/SSSD.sssd/design_pages/uid_negative_global_catalog.… Notable bug fixes ^^^^^^^^^^^^^^^^^ * A crash in ``sssd_nss`` that might have happened if a list of domains was refreshed while a NSS lookup using this request was fixed (#3551) * A potential crash in ``sssd_nss`` during netgroup lookup in case the netgroup object kept in memory was already freed (#3523) * Fixed a potential crash of ``sssd_be`` with two concurrent sudo refreshes in case one of them failed (#3562) * A memory growth issue in ``sssd_nss`` that occured when an entry was removed from the memory cache was fixed (#3588) * Two potential memory growth issues in the ``sssd_be`` process that could have hit configurations with ``id_provider=ad`` were fixed (#3639) * The ``selinux_child`` process no longer crashes on a system where SSSD is compiled with SELinux support, but at the same time, the SELinux policy is not even installed on the machine (#3618) * The memory cache consistency detection logic was fixed. This would prevent printing false positive memory cache corruption messages (#3571) * SSSD now remembers the last successfuly discovered AD site and use this for DNS search to lookup a site and forest during the next lookup. This prevents time outs in case SSSD was discovering the site using the global list of DCs where some of the global DCs might be unreachable. (#3265) * SSSD no longer starts the implicit file domain when configured with ``id_provider=proxy`` and ``proxy_lib_name=files``. This bug prevented SSSD from being used in setups that combine identities from UNIX files together with authentication against a remote source unless a files domain was explicitly configured (#3590) * The IPA provider can handle switching between different ID views better (#3579) * Previously, the IPA provider kept SSH public keys and certificates from an ID view in its cache and returned them even if the public key or certificate was then removed from the override (#3602, #3603) * FleetCommander profiles coming from IPA are applied even if they are assigned globally (to ``category: ALL``), previously, only profiles assigned to a host or a hostgroup were applied (#3449) * It is now possible to reset an expired password for users with 2FA authentication enabled (#3585) * A bug in the AD provider which could have resulted in built-in AD groups being incorrectly cached was fixed (#3610) * The SSSD watchdog can now cope better with time drifts (#3285) * The ``nss_sss`` NSS module's return codes for invalid cases were fixed * A bug in the LDAP provider that prevented setups with id_provider=proxy and auth_provider=ldap with LDAP servers that do not allow anonymous binds from working was fixed (#3451) Packaging Changes ----------------- * The FleetCommander desktop profile path now uses stricter permissions, 751 instead of 755 (#3621) * A new option ``--logger`` was added to the ``sssd(8)`` binary. This option obsoletes old options such as ``--debug-to-files``, although the old options are kept for backwards compatibility. * The file ``/etc/systemd/system/sssd.service.d/journal.conf`` is not installed anymore In order to change logging to journald, please use the ``--logger`` option. The logger is set using the ``Environment=DEBUG_LOGGER`` directive in the systemd unit files. The default value is ``Environment=DEBUG_LOGGER=--logger=files`` Documentation Changes --------------------- There are no notable documentation changes such as options changing default values etc in this release. Tickets Fixed ------------- * `3648 <https://pagure.io/SSSD/sssd/issue/3648>`_ - Mention in the manpages that Fleet Commander does *not* work when SSSD is running as the unprivileged user * `3639 <https://pagure.io/SSSD/sssd/issue/3639>`_ - sssd_be consumes more memory on RHEL 7.4 systems. * `3627 <https://pagure.io/SSSD/sssd/issue/3627>`_ - MAN: Explain how does auto_private_groups affect subdomains * `3621 <https://pagure.io/SSSD/sssd/issue/3621>`_ - FleetCommander integration must not require capability DAC_OVERRIDE * `3618 <https://pagure.io/SSSD/sssd/issue/3618>`_ - selinux_child segfaults in a docker container * `3615 <https://pagure.io/SSSD/sssd/issue/3615>`_ - Requesting an AD user's private group and then the user itself returns an emty homedir * `3613 <https://pagure.io/SSSD/sssd/issue/3613>`_ - auto_private_groups does not work with trusted domains with direct AD integration * `3610 <https://pagure.io/SSSD/sssd/issue/3610>`_ - AD provider - AD BUILTIN groups are cached with gidNumber = 0 * `3608 <https://pagure.io/SSSD/sssd/issue/3608>`_ - dbus-send unable to find user by CAC cert * `3603 <https://pagure.io/SSSD/sssd/issue/3603>`_ - Certificate is not removed from cache when it's removed from the override * `3602 <https://pagure.io/SSSD/sssd/issue/3602>`_ - SSH public key authentication keeps working after keys are removed from ID view * `3601 <https://pagure.io/SSSD/sssd/issue/3601>`_ - race condition: sssd_be in a one-way trust accepts request before ipa-getkeytab finishes, marking the sssd offline * `3599 <https://pagure.io/SSSD/sssd/issue/3599>`_ - getent output is not showing home directory for IPA AD trusted user * `3594 <https://pagure.io/SSSD/sssd/issue/3594>`_ - sssd used wrong search base with wrong AD server * `3592 <https://pagure.io/SSSD/sssd/issue/3592>`_ - Write a regression test for false possitive "corrupted" memory cache * `3590 <https://pagure.io/SSSD/sssd/issue/3590>`_ - proxy to files does not work with implicit_files_domain * `3588 <https://pagure.io/SSSD/sssd/issue/3588>`_ - sssd_nss consumes more memory until restarted or machine swaps * `3586 <https://pagure.io/SSSD/sssd/issue/3586>`_ - Give a more detailed debug and system-log message if krb5_init_context() failed * `3585 <https://pagure.io/SSSD/sssd/issue/3585>`_ - Reset password with two factor authentication fails * `3579 <https://pagure.io/SSSD/sssd/issue/3579>`_ - SSSD fails to fetch group information after switching IPA client to a non-default view * `3571 <https://pagure.io/SSSD/sssd/issue/3571>`_ - mmap cache: consistency check might fail if there are hash collisions * `3570 <https://pagure.io/SSSD/sssd/issue/3570>`_ - The cache-req debug string representation uses a wrong format specifier for by-ID requests * `3569 <https://pagure.io/SSSD/sssd/issue/3569>`_ - The cache_req code doesn't check the min_id/max_id boundaries for requests by ID * `3564 <https://pagure.io/SSSD/sssd/issue/3564>`_ - Smartcard authentication fails if SSSD is offline and 'krb5_store_password_if_offline = True' * `3563 <https://pagure.io/SSSD/sssd/issue/3563>`_ - Some sysdb tests fail because they expect a certain order of entries returned from ldb * `3562 <https://pagure.io/SSSD/sssd/issue/3562>`_ - Use-after free if more sudo requests run and one of them fails, causing a fail-over to a next server * `3560 <https://pagure.io/SSSD/sssd/issue/3560>`_ - Improve Smartcard integration if multiple certificates or multiple mapped identities are available * `3551 <https://pagure.io/SSSD/sssd/issue/3551>`_ - Race condition between refreshing the cr_domain list and a request that is using the list can cause a segfault is sssd_nss * `3547 <https://pagure.io/SSSD/sssd/issue/3547>`_ - data from ipa returned with id_provider=file * `3545 <https://pagure.io/SSSD/sssd/issue/3545>`_ - SSSD creates bad override search filter due to AD Trust object with parenthesis * `3539 <https://pagure.io/SSSD/sssd/issue/3539>`_ - Do not autostart the implicit files domain if sssd configures id_provider=proxy and proxy_target_files * `3529 <https://pagure.io/SSSD/sssd/issue/3529>`_ - SSSD-kcm/secrets failed to restart during/after upgrade * `3528 <https://pagure.io/SSSD/sssd/issue/3528>`_ - sssd refuses to start when pidfile is present, but the process is gone * `3523 <https://pagure.io/SSSD/sssd/issue/3523>`_ - ABRT crash - /usr/libexec/sssd/sssd_nss in setnetgrent_result_timeout * `3503 <https://pagure.io/SSSD/sssd/issue/3503>`_ - Do not index objectclass, add and index objectcategory instead * `3496 <https://pagure.io/SSSD/sssd/issue/3496>`_ - [RFE] Add a configuration option to SSSD to disable the memory cache * `3486 <https://pagure.io/SSSD/sssd/issue/3486>`_ - Improve `enumerate` documentation/troubleshooting guide * `3484 <https://pagure.io/SSSD/sssd/issue/3484>`_ - MAN: Describe the constrains of ipa_server_mode better in the man page * `3468 <https://pagure.io/SSSD/sssd/issue/3468>`_ - SSSD doesn't use AD global catalog for gidnumber lookup, resulting in unacceptable delay for large forests * `3454 <https://pagure.io/SSSD/sssd/issue/3454>`_ - sssd-kcm crashes with multiple parallel requests * `3451 <https://pagure.io/SSSD/sssd/issue/3451>`_ - When sssd is configured with id_provider proxy and auth_provider ldap, login fails if the LDAP server is not allowing anonymous binds. * `3444 <https://pagure.io/SSSD/sssd/issue/3444>`_ - document information on why SSSD does not use host-based security filtering when processing AD GPOs * `3433 <https://pagure.io/SSSD/sssd/issue/3433>`_ - SYSLOG_IDENTIFIER is different * `3293 <https://pagure.io/SSSD/sssd/issue/3293>`_ - Log when SSSD authentication fails because when two IPA accounts share an email address * `3285 <https://pagure.io/SSSD/sssd/issue/3285>`_ - SSSD needs restart after incorrect clock is corrected with AD * `3265 <https://pagure.io/SSSD/sssd/issue/3265>`_ - [RFE] sssd should remember DNS sites from first search * `3198 <https://pagure.io/SSSD/sssd/issue/3198>`_ - Incorrect error code returned from krb5_child for expired/locked user with id_provider AD * `2976 <https://pagure.io/SSSD/sssd/issue/2976>`_ - sdap code can mark the whole sssd_be offline * `2840 <https://pagure.io/SSSD/sssd/issue/2840>`_ - [RFE] Produce access control attestation report for IPA domains * `2823 <https://pagure.io/SSSD/sssd/issue/2823>`_ - Integration tests: Use dbus-daemon in cwrap enviroment for test * `2478 <https://pagure.io/SSSD/sssd/issue/2478>`_ - Provide sss_nss_* API to directly query SSSD instead of nsswitch.conf route * `1872 <https://pagure.io/SSSD/sssd/issue/1872>`_ - [RFE] Support User Private Groups for main domains, too * `1729 <https://pagure.io/SSSD/sssd/issue/1729>`_ - Enumerating large number of users makes sssd_be hog the cpu for a long time. Detailed Changelog ------------------ * Andreas Schneider (1): * Avoid double semicolon warnings on older compilers * Carlos O'Donell (1): * nss: Fix invalid enum nss_status return values. * Fabiano Fidêncio (21): * CACHE_REQ: Copy the cr_domain list for each request * LDAP: Bind to the LDAP server also in the auth * TOOLS: Double quote array expansions in sss_debuglevel * TOOLS: Call "exec" for sss_debuglevel * LDAP: Improve error treatment from sdap_cli_connect() in ldap_auth * SYSDB: Remove code causing a covscan warning * NSS: Fix covscan warning * CACHE_REQ: Fix typo: cache_reg -> cache_req * TOOLS: Fix typo: exist -> exists * SYSDB: Return EOK in case a non-fatal issue happened * SYSDB_VIEWS: Remove sshPublicKey attribute when it's not set * IPA: Remove sshPublicKey attribute when it's not set * DESKPROFILE: Add checks for user and host category * DESKPROFILE: Harden the permission of deskprofilepath * DESKPROFILE: Soften umask for the domain's dir * DESKPROFILE: Fix the permissions and soften the umask for user's dir * DESKPROFILE: Use seteuid()/setegid() to create the profile * DESKPROFILE: Use seteuid()/setegid() to delete the profile/user's dir * DESKPROFILE: Set the profile permissions to read-only * PYSSS_MURMUR: Fix [-Wsign-compare] found by gcc * DESKPROFILE: Document it doesn't work when run as unprivileged user * Hristo Venev (1): * providers: Move hostid from ipa to sdap, v2 * Jakub Hrozek (35): * Update the version number to track 1.16.1 development * CONFIG: Add a new option auto_private_groups * CONFDB: Remove the obsolete option magic_private_groups * SDAP: Allow the mpg flag for the main domain * LDAP: Turn group request into user request for MPG domains if needed * SYSDB: Prevent users and groups ID collision in MPG domains except for id_provider=local * TESTS: Add integration tests for the auto_private_groups option * RESP: Add some missing NULL checks * TOOLS: Add a new sssctl command access-report * SDAP: Split out utility function sdap_get_object_domain() from sdap_object_in_domain() * LDAP: Extract the check whether to run a POSIX check to a function * LDAP: Only run the POSIX check with a GC connection * SDAP: Search with a NULL search base when looking up an ID in the Global Catalog * SDAP: Rename sdap_posix_check to sdap_gc_posix_check * DP: Create a new handler function getAccountDomain() * AD: Implement a real getAccountDomain handler for the AD provider * RESP: Expose DP method getAccountDomain() to responders * NEGCACHE: Add API for setting and checking locate-account-domain requests * TESTS: Add tests for the object-by-id cache_req interface * CACHE_REQ: Export cache_req_search_ncache_add() as cache_req private interface * CACHE_REQ: Add plugin methods required for the domain-locator request * CACHE_REQ: Add a private request cache_req_locate_domain() * CACHE_REQ: Implement the plugin methods that utilize the domain locator API * CACHE_REQ: Use the domain-locator request to only search domains where the entry was found * MAN: Document how the Global Catalog is used currently * IPA: Include SYSDB_OBJECTCATEGORY, not OBJECTCLASS in cache search results * MAN: Document that auth and access IPA and AD providers rely on id_provider being set to the same type * MAN: Improve enumeration documentation * MAN: Describe the constrains of ipa_server_mode better in the man page * IPA: Delay the first periodic refresh of trusted domains * AD: Inherit the MPG setting from the main domain * SYSDB: Fix sysdb_search_by_name() for looking up groups in MPG domains * SYSDB: Use sysdb_domain_dn instead of raw ldb_dn_new_fmt * SYSDB: Read the ldb_message from loop's index counter when reading subdomain UPNs * AD: Use the right sdap_domain for the forest root * Lukas Slebodnik (51): * KCM: Fix typo in comments * CI: Ignore source file generated by systemtap * UTIL: Add wrapper function to configure logger * Add parameter --logger to daemons * SYSTEMD: Replace parameter --debug-to-files with ${DEBUG_LOGGER} * SYSTEMD: Add environment file to responder service files * UTIL: Hide and deprecate parameter --debug-to-files * KCM: Fix restart during/after upgrade * BUILD: Properly expand variables in sssd-ifp.service * SYSTEMD: Clean pid file in corner cases * CHILD: Pass information about logger to children * BUILD: Disable tests with know failures * SPEC: Reduce build time dependencies * sysdb-test: Fix warning may be used uninitialized * responder: Fix talloc hierarchy in sized_output_name * test_responder: Check memory leak in sized_output_name * confdb: Move detection files to separate function * confdb: Fix starting of implicit files domain * confdb: Do not start implicit_files with proxy domain * test_files_provider: Regression test for implicit_files + proxy * SDAP: Fix typo in debug message * Revert "intg: Disable add_remove tests" * libnfsidmap: Use public plugin header file if available * dyndns_tests: Fix unit test with missing features in nsupdate * Remove unnecessary script for upgrading debug_levels * Remove legacy script for upgrading sssd.conf * BUILD: Add missing libs found by -Wl,-z,defs * BUILD: Fix using of libdlopen_test_providers.so in tests * SYSDB: Decrese debuglevel in sysdb_get_certmap * KRB5: Pass special flag to krb5_child * krb5_child: Distinguish between expired & disabled AD user * AD: Suppress warning Wincompatible-pointer-types with sasl callbacks * pysss: Drop unused parameter * pysss: Suppress warning Wincompatible-pointer-types * CRYPTO: Suppress warning Wstringop-truncation * INOTIFY: Fix warning Wstringop-truncation * SIFP: Suppress warning Wstringop-truncation * CLIENT: Fix warning Wstringop-overflow * pysss_murmur: Allow to have NUL character in python bindings * TESTS: Extend code coverage for murmurhash3 * mmap_cache: Remove unnecessary memchr in client code * test_memory_cache: Regression test for #3571 * SPEC: Fix systemd executions/requirements * SPEC: Reduce changes between upstream and downstream * intg: Build with optimisations and debug symbols * intg: Do not prefer builddir in PATH * intg: Install configuration for dbus daemon * intg: Install wrapper for getsockopt * intg: Add sample infopipe test in cwrap env * IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR * IPA: Fix typo in debug message in sssm_ipa_selinux_init * Michal Židek (9): * NSS: Move memcache setup to separate function * NSS: Specify memcache_timeout=0 semantics * MAN: Document memcache_timeout=0 meaning * MAN: GPO Security Filtering limitation * SYSDB: Better debugging for email conflicts * TESTS: Order list of entries in some lists * Revert "BUILD: Disable tests with know failures" * SELINUX: Check if SELinux is managed in selinux_child * util: Add sss\_ prefix to some functions * Niranjan M.R (1): * Initial revision of sssd pytest framework * Pavel Březina (10): * sudo: document background activity * sudo: always use srv_opts from id context * AD: Remember last site discovered * sysdb: add functions to get/set client site * AD: Remember last site discovered in sysdb * dp: use void * to express empty output argument list * dp: add method to refresh access control rules * ipa: implement method to refresh HBAC rules * ifp: add method to refresh access control rules in domain * sssctl: call dbus instead of pam to refresh HBAC rules * René Genz (12): * Fix minor spelling mistakes * README: Add link to docs repo * Fix minor spelling mistakes * Fix minor spelling mistakes in providers/* * Fix minor spelling mistakes in responder/* * Fix minor spelling mistakes in sss_client/* * Fix minor spelling mistakes in tests/cmocka/* * Fix minor spelling mistakes * Fix minor spelling mistakes in tests/* * Fix minor spelling mistakes in tests/multihost/* * Fix minor spelling mistakes in PY files in tests/python/* * Fix minor spelling mistakes and formatting in tests/python/* * Sumit Bose (48): * sss_client: create nss_common.h * nss-idmap: add nss like calls with timeout and flags * NSS: add \*_EX version of some requests * NSS: add support for SSS_NSS_EX_FLAG_NO_CACHE * CACHE_REQ: Add cache_req_data_set_bypass_dp() * nss: make memcache_delete_entry() public * NSS: add support for SSS_NSS_EX_FLAG_INVALIDATE_CACHE * NSS/TESTS: add unit tests for \*_EX requests * nss-idmap: add timeout version of old sss_nss_* calls * nss-idmap: allow empty buffer with SSS_NSS_EX_FLAG_INVALIDATE_CACHE * p11_child: return multiple certs * PAM: handled multiple certs in the responder * pam_sss: refactoring, use struct cert_auth_info * p11_child: use options to select certificate for authentication * pam: add prompt string for certificate authentication * PAM: allow missing logon_name during certificate authentication * p11_child: add descriptions for error codes to debug messages * pam: filter certificates in the responder not in the child * PAM: add certificate's label to the selection prompt * NSS: Use enum_ctx as memory_context in _setnetgrent_set_timeout() * mmap_cache: make checks independent of input size * sysdb: be_refresh_get_values_ex() remove unused option * sysdb: do not use objectClass for users and groups * sysdb: do not use LDB_SCOPE_ONELEVEL * sysdb: remove IDXONE and objectClass from users and groups * krb5: show error message for krb5_init_context() failures * UTIL: add find_domain_by_object_name_ex() * ipa: handle users from different domains in ipa_resolve_user_list_send() * overrides: fixes for sysdb_invalidate_overrides() * ipa: check for SYSDB_OVERRIDE_DN in process_members and get_group_dn_list * IPA: use cache searches in get_groups_dns() * ipa: compare DNs instead of group names in ipa_s2n_save_objects() * p11_child: make sure OCSP checks are done * nss-idmap: allow NULL result in \*_timeout calls * Revert "p11_child: make sure OCSP checks are done" * p11_child: properly check results of CERT_VerifyCertificateNow * ifp: use realloc in ifp_list_ctx_remaining_capacity() * SDAP: skip builtin AD groups in sdap_save_grpmem() * sysdb: add userMappedCertificate to the index * krb5_child: check preauth types if password is expired * pam_sss: password change with two factor authentication * nss-idmap: check timed muted return code * krb5: call krb5_auth_cache_creds() if a password is available * DESKPROFILE: Fix 'Improper use of negative value' * AD: sdap_get_ad_tokengroups_done() allocate temporary data on state * AD: do not allocate temporary data on long living context * ipa: remove SYSDB_USER_CERT from sub-domain users * ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides * Thorsten Scherf (1): * IPA: Fixed subdomain typo * Victor Tapia (1): * WATCHDOG: Restart providers with SIGUSR2 after time drift * amitkuma (3): * cache_req: Correction of cache_req debug string ID format * cache: Check for max_id/min_id in cache_req * MAN: Explain how does auto_private_groups affect subdomains

2 5

SSSD kerberos problem in multiple AD domains
by Roger Martensson 12 Mar '18

12 Mar '18

Hi! It's me again with multiple domain problems. :) I have once again problems with multiple domain. This time with login. Maybe some one of you could explain to me what I did wrong this time. OS: Ubuntu 17.10 SSSD: 1.15.3 Domain setup. two subdomain both connected to the same parent domain Both subdomains contains users. Most of them only contains one domain but some is found in both. Client is connected to subdomain1. I can login with a user on subdomain 1. When login in to subdomain2 (both using 'su-with-password-prompt' and 'ssh-to-localhost') I get a System Error 4. The log krb_child.log (which sssd_domain.log points to) I see these logs. (altered some names)

3 6

Apache/php integration
by Ondrej Valousek 12 Mar '18

12 Mar '18

Hi all, I see there is a new client API available for sssd 1.16. Is it possible to integrate it somehow with Apache/php? I.e. example: I authenticate user via mod_auth_gssapi obtaining username (and possibly TGT) so I need to lookup user's email address, say.... Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

3 3

Experiencing a bug on users' name and ID
by Asif Iqbal 09 Mar '18

09 Mar '18

I have 300 out of 3000 users whose /home/<username> dir shows uid and gid instead of username and groupname. It seems to be behaving like a bug As soon I become a user with `sudo su - username' the uid of the home dir changes to username but gid still does not change to groupname. I also get an error message, but still successfully become that user $ ls -ld /home/mbniels drwx------. 3 80974 80974 4096 Feb 27 02:15 /home/mbniels $ su - mbniels Last login: Tue Feb 27 02:34:04 UTC 2018 on pts/39 /usr/bin/id: cannot find name for group ID 80974 groups: cannot find name for group ID 80974 $ ls -ld /home/mbniels drwx------. 3 mbniels 80974 4096 Feb 27 02:15 /home/mbniels Then to check the groups of username I get another error which then gets cleared by next command. $ groups mbniels mbniels : groups: cannot find name for group ID 80974 80974 users $ getent group mbniels mbniels:*:80974 $ groups mbniels mbniels : mbniels users It also fixes the gid to groupname $ ls -ld /home/mbniels/ drwx------. 3 mbniels mbniels 4096 Feb 27 02:15 /home/mbniels/ I noticed it reverts after may be within half an hour, not exact sure when. Almost behaves like `quantum entanglement'. As soon as I try to check by trying to become that user the issue disappears. This is not just cosmetic issue, when the home dir shows ownership with uid, instead of username, the user fails some commands. We just started noticing today, since we just built this box and only few months ago and users are being invited to start using this server Some annoying error it is showing like below and user then fails to ssh $ ssh remote No user exists for uid 80974 I am using centos 7 and sssd 1.15.2 $ cat /etc/redhat-release CentOS Linux release 7.4.1708 (Core) $ sssd --version 1.15.2 Here are some relevant logs https://paste.fedoraproject.org/paste/gBaZ-Vr8Urh-M5ABpaRNuA Appreciate any help -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

3 9

cached users
by Roger Martensson 05 Mar '18

05 Mar '18

Hi! OS: Ubuntu 16.04, SSSD: 1.13.4 I'm seeing something that has me wondering if I have missunderstood anything. (quite possible) I have multi domain Active Directory forest. I have a client connected to subdomain1 using SSSD and can do ID-query in both subdomain1 and subdomain2. If I have a user with a username that only exists in one of these domains then there is no problem. But if I have a user that exist with the same userid in both domain then queries looks strange to me. It seems that the first query gets cached and reused when querying the same userid in the other domain. For example. Query user 'simpleuser(a)subdomain1.domain.tld'. When I query 'simpleuser(a)subdomain2.domain.tld' I get the same result as the first query where it should be different. I'm using 'default_domain_suffix' in [sssd] section of the sssd.conf which adds 'use_fully_qualified_names'. I thought these settings would help but I can't see any changes. What am I missing? This is for me not a big problem but we do have some usecases where the same userid can exist on both subdomains.

1 1

Account locked message w/ OpenLDAP and ppolicy
by Kopera, Jeffrey M 05 Mar '18

05 Mar '18

Hi, I am having some issues trying to configure sssd to print out a message informing a user if their account is locked out. I thought it would be as simple as setting pam_account_locked_message, but I guess not. I suspect this is an sssd issue, but I suppose it could be a PAM issue. Here is what my sssd.conf file looks like: [domain/default] debug_level = 8 cache_credentials = True ldap_search_base = ************* ldap_user_search_base = ************* ldap_user_name = cn ldap_group_search_base = ************** id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ***************** ldap_tls_cacert = ******************** ldap_referrals = False enumerate = False access_provider = ldap ldap_access_order = ppolicy [sssd] services = nss, pam, autofs, ssh config_file_version = 2 domains = default [nss] homedir_substring = /home [pam] pam_verbosity = 3 pam_account_locked_message = "Account locked" [sudo] [autofs] [ssh] [pac] [ifp] And the relevant sections of PAM #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 100 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 100 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so I see the following message in the sssd log with a locked out account logging in: (Thu Mar 1 22:05:23 2018) [sssd[be[default]]] [sdap_op_add] (0x2000): New operation 1 timeout 6 (Thu Mar 1 22:05:23 2018) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0x1231d90], connected[1], ops[0x1303b50], ldap[0x12d0010] (Thu Mar 1 22:05:23 2018) [sssd[be[default]]] [simple_bind_done] (0x2000): Server returned control [1.3.6.1.4.1.42.2.27.8.5.1]. (Thu Mar 1 22:05:23 2018) [sssd[be[default]]] [simple_bind_done] (0x1000): Password Policy Response: expire [-1] grace [-1] error [Account Locked]. (Thu Mar 1 22:05:23 2018) [sssd[be[default]]] [simple_bind_done] (0x0400): Bind result: Invalid credentials(49), no errmsg set And this is what showed up in /var/log/secure: Mar 1 22:05:23 adms08 sshd[23044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=******** user=********* Mar 1 22:05:23 adms08 sshd[23044]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=******* user=******** Mar 1 22:05:23 adms08 sshd[23044]: pam_sss(sshd:auth): received for user *********: 7 (Authentication failure) Mar 1 22:05:25 adms08 sshd[23044]: Failed password for ******* from ********** port 55284 ssh2 I feel like this should give something other than the normal failed password message. Any help would be appreciated. Thanks, Jeff ________________________________ This message is intended only for the use of the intended recipient. If you are not an intended recipient, you are hereby notified that any use, dissemination, disclosure or copying of this communication is strictly prohibited. If you have received this communication in error please destroy all copies of this message and its attachments and notify the sender immediately.

2 1

autofs in a AD-forest
by Roger Martensson 02 Mar '18

02 Mar '18

Hi! I'm experiencing something that I'm not sure is as expected or not. First some data: OS: Ubuntu 16.04 SSSD Version: 1.13.4 I have managed to set up a SSSD against a AD-subdomain. NSS-lookup works. Can use 'userid', 'userid(a)subdomain1.domain.tld' and UPN when looking up an ID. I have set up a auto_home hierarchy in AD on subdomain1.domain.tld and managed to get AutoFS to work using this and get a working homedirectory using autofs and NFS. When I do this with a user in an another subdomain in the forest (subdomain2.domain.tld) I get into trouble. ID-lookup works like a charm. I have also set up a auto_home-hierarchy in this other subdomain. When looking in the logs is looks like the implementation of autofs only uses the domain the SSSD is connected to. Not a single mention in the logs about the other subdomain regarding to autofs. Is it correct to assume that autofs in multiple domains in a forest doesn't work or am I doing something wrong? My sssd.conf looks like this. (some names have been changed to protect the innocent) [domain/subdomain1.domain.tld] access_provider = ad ad_domain = subdomain1.domain.tld ad_hostname = client1.subdomain1.domain.tld autofs_provider = ad cache_credentials = True debug_level = 8 default_shell = /bin/bash fallback_homedir = /userhome/%u id_provider = ad krb5_realm = SUBDOMAIN1.DOMAIN.TLD krb5_store_password_if_offline = True ldap_id_mapping = False mkhomedir = false realmd_tags = manages-system joined-with-adcli [sssd] config_file_version = 2 domains = subdomain1.domain.tld services = nss,pam,autofs

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2018