sssd backend not workin on ubuntu 18.04
by Charles Hedrick
On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it can’t find any DNS servers. Restarting sssd fixes it.
/etc/resolv.conf is a symlink to ../run/systemd/resolve/stub-resolv.conf
If I replace that with a hardcoded resolv.conf with the right name server, sssd comes up. Network Manager replaces the file with a different one pointing to nameserver 127.0.0.53, but after another reboot with that file it still works.
This happens on 4 identical servers, but not on a VM with the same OS. I assume there’s a timing issue of some sort.
4 years, 7 months
another ubuntu 18 sssd issue: cron
by Charles Hedrick
After converting a system to sssd with an IPA backend, we found that cron was not recognizing our users. It appears (based on using lsof to see what .so files are open) that cron is reading nsswitch.conf at startup, and doesn’t notice the change when sssd setup adds sss to the user map in nsswitch.conf. Restarting cron fixes it, but we’ve now got another Ubuntu-specific hack in our Ansible setup script.
4 years, 7 months
Patch for sssd to fix recursion problems with Winbind (Samba Bug #13815)
by Heiko Wundram
Hello list,
for a deployment I'm administering, I'm using winbind and sssd in
parallel, both for different authentication sources (so it's not about
their interoperability, but rather about using them in parallel). It
seems that sssd has/had a bug which meant that winbind 4.8+ and sssd, if
used together as NSS sources, would, for unavailable accounts in both
authentication sources, lead to a DoS against winbind due to recursive
calls of the NSS infrastructure. I'm deploying winbind (for a Windows
Domain) and sssd (for an LDAP authentication source with client
certificate authentication) on Debian 10.
Samba tracked this as bug #13815
(https://bugzilla.samba.org/show_bug.cgi?id=13815), which contains a
link to a corresponding issue in the RedHat bugtracker
(https://bugzilla.redhat.com/show_bug.cgi?id=1666819), which supposedly
contains a patch for the behaviour; as the bug isn't open, I can neither
see what the patch actually is, nor can I prepare the patch for the
Debian packaging of sssd.
Can anybody shed some light on what the patch is (and/or link to the
commit in Pagure), specifically also which published version the patch
is contained in, so that I might either decide to deploy updated sssd
packages for Debian, or even try to backport the patch to the Debian
built-in version? I can't find a means to search commits in Pagure,
that's why I'm asking here, but even just that would be helpful.
Thanks in advance!
--
--- Heiko Wundram.
4 years, 8 months
issue with ldap_access_filter
by Kamil Kosowski
Hello
I am doing some reverse engineering in my current company :
I have a server which is acting as a gateway for other services, it's like entry point exposed to the world. People are connecting to this server on port 443 via for example DBeaver.
The same server can be accessed by a group of admin via ssh - ssh should be only for admins, admins are placed in the different domain while all other users are in domain.net
for clarification group, "NoOne" doesn't exist in AD
what is happening :
- if someone is trying to access this node via ssh, I see in the SSSD logs that, after validating user, SSSD is performing access check filter and that is ok
- if someone is trying to access this node via DBeaver on port 443, SSSD never triggers access check filter after user validation and the user gets access
if there is any way to exclude performing access_filter for every connection except ssh? I cannot find this configuration and apparently, this is how it works right now, while I am deploying new Gateway server with the same configuration and on the new server no matter what I do, access_filter check is always triggered
config:
[domain/admins.net]
allow ssh config
[domain/domain.net]
debug_level = 9
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_uri = ldaps://node.net:636
ldap_user_search_base = DC=domain,DC=NET?subtree?(|(memberOf=CN=DSP,OU=Security,OU=Groups,OU=Town,OU=PL,OU=COMP,OU=Users & Workstations,DC=domain,DC=NET)(memberOf=CN=IMD,OU=Security,OU=IMD,OU=Global,OU=Users & Workstations,DC=domain,DC=NET))
ldap_schema = ad
ldap_id_mapping = True
ldap_default_bind_dn = CN=USERMASTER,OU=Service Accounts,OU=Global,OU=Servers,DC=domain,DC=NET
ldap_default_authtok = ################
ldap_user_name = sAMAccountName
ldap_user_member_of = memberOf
ldap_user_gid_number = primaryGroupID
ldap_user_shell = /bin/bash
override_homedir = /home/%u
ldap_group_name = sAMAccountName
ldap_group_search_base = DC=domain,DC=NET?subtree?(|(cn=Data*)(cn=Users))
ldap_use_tokengroups = false
ldap_group_member = member
ldap_group_object_class = group
ldap_sudorule_object_class = person
ldap_sudorule_name = sAMAccountName
cache_credentials = True
use_fully_qualified_names = False
ldap_tls_cacert = /etc/sssd/ROOT_AD_RO.pem
ldap_access_order = filter
ldap_access_filter = (|(memberOf=NoOne,DC=domain,DC=NET)
4 years, 8 months
Issues with upgrade from 1.16.3 to 2.2.0 release
by cedric hottier
Dear SSSD users,
I would like to share with you few issues I faced during the move from
1.16.3 to 2.2.0 sssd release.
I am a Debian user and I did this move because Debian pushed the 2.2.0
release in the testing branch.
My configuration may seem exotic as I use 'files' as id_provider and 'krb5'
as auth_provider.
Initially with the 1.16 version I faced the following issue :
https://pagure.io/SSSD/sssd/issue/3591
Thanks to Jakub Hrozek
<https://lists.fedorahosted.org/archives/users/598050231053154702993168591...>,
I was able to make it working with the following workaround :
id_provider=proxy proxy_lib_name=files
For those interested, the discussion thread is here :
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahoste...
With the move to 2.2.0, I faced several issues...
First, I had to remove the line services = nss, pam, ifp from sssd.conf
because I use systemd.
I think i fell in the bug described here :
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=886483 . I do not know if
it is a debian specific integration issue, or a sssd issue. I did not find
any reference to sssd upstream bug, but in the meantime, it is written that
"We believe that the bug you reported is fixed in the latest version of sssd"
. Not clear for me if they are talking about sssd debian package version,
or upstream version.
Anyway, I faced this issue with new debian package 2.2.0, let me know if it
is a debian specific stuff to open a bug report on debian side.
Once the previous issue was fixed, I faced a segmentation fault in
libsss_proxy.so.
Sorry to not have the exact error message. But it should be easy to
reproduce.
id_provider = files
auth_provider = krb5
should show the issue.
Due to this seg fault, I removed the workaround of the bug 3591. sssd was
properly started by systemd, but, I realized, that the bug 3591, is still
not fixed.
I am afraid I am locked with 1,16,3 release. ( who does the job, but not
aligned with debian testing )
Thanks for your feedback
Kind Regards
Cedric
4 years, 8 months
sssd smartcard pam.d
by Eremeev Vladimir
Hello for all.
I have CentOS 7.6 with last updates. After using realmd authetification AD users with password works well.
I try to use smartcards to authetificate users from AD at the linux machines.
After a lot of googling I can use PKINIT to take kerberos tickets for a user by using a smartcard and a pincode. this is my krb5.conf:
# cat /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = "Domain"
pkinit_anchors = FILE:/etc/pki/nssdb/ca.cer
pkinit_identities = PKCS11:/usr/lib64/libeTPkcs11.so
pkinit_eku_checking = kpServerAuth
pkinit_kdc_hostname = "Domain controller1"
pkinit_kdc_hostname = "Domain controller2"
pkinit_kdc_hostname = "Domain controller3"
canonicalize = True
[realms]
"Domain" {
kdc = "Domain controller1"
kdc = "Domain controller2"
kdc = "Domain controller3"
admin_server = "Domain controller1"
default_domain = "Domain"
}
[domain_realm]
domain = DOMAIN
.domain = DOMAIN
I put this article inside sssd.conf:
[pam]
pam_cert_auth = true
i think that next step will be a configure pam.d files. but at this step a met some problems.
maybe somebody can send me working files from pam.d?
What the next step to make authetification for Gnome Destop on CentOS 7.6?
ps. "authconfig --enablesssd --enablesssdauth --enablesmartcard --smartcardmodule=sssd --smartcardaction=1 --updateall" don't work well for me
4 years, 8 months
Replacement for Centrify adcert command
by James Cassell
Good afternoon,
I'm working on a migration from Centrify to SSSD with Active Directory. Everything works quite well except for one item. Centrify has a feature to request a certificate from the AD CA that is automatically granted, given the AD credentials. This is used for wired 802.1x authentication, among other things.
Is there a way to get an AD cert via SSSD or related tools such as adcli? (Centrify calls this command 'adcert'.)
Thanks in advance!
V/r,
James Cassell
4 years, 8 months
pam_sss nullok
by Winberg Adam
Hello all,
when using smart card auth with pam_pkcs11 there is an option to set 'nullok' to true/false. Setting it to false effectively makes pam_pkcs11 ignore empty pin entries (this option is also available for pam_unix and set to false as default). So if I get a pin prompt and just press Enter it is not regarded as an authentication attempt.
Is there anything similar with pam_sss? Default behaviour seems to be to regard empty inputs as an auth attempt, so if I run sudo and just press Enter a couple of times this counts as failed auth attempts and will consequently lock my smart card. Which is not what I want.
4 years, 8 months
Problem getting sssd to work with LDAP authentication
by Jane Eason
Hello,
We are attempting to get LDAP logins set up with sssd on RHEL 7.6.
sssd is able to look up the user against the backend LDAP using a secure connection on port 636. However, it does not attempt to authenticate.
We think pam authentication is not getting called for remote logins. Local logins are working.
On the ldap server, we can see the search but not an authentication attempt.
In case it matters: We don't store the POSIX uid in LDAP.
Where should we look for the missing setting(s)? Some log snips follow.
In /var/log/secure on the client vm, we see:
Aug 8 16:45:32 clientvm polkitd[5652]: Registered Authentication Agent for unix-process:8478:2629285 (system bus name :1.92 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Aug 8 16:45:32 clientvm polkitd[5652]: Unregistered Authentication Agent for unix-process:8478:2629285 (system bus name :1.92, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Aug 8 16:45:53 clientvm unix_chkpwd[8491]: password check failed for user (myuser)
Aug 8 16:45:53 clientvm sshd[8489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=REDACTED user=myuser
Aug 8 16:45:53 clientvm sshd[8489]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=REDACTED user=myuser
Aug 8 16:45:53 clientvm sshd[8489]: pam_sss(sshd:auth): received for user myuser: 10 (User not known to the underlying authentication module)
Aug 8 16:45:55 clientvm sshd[8489]: Failed password for myuser from REDACTED port 10320 ssh2
Aug 8 16:46:07 clientvm sshd[8489]: Connection closed by REDACTED port 10320 [preauth]
In /var/log/sssd/sssd_mydomain.log:
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=myuser@mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sss_domain_get_state] (0x1000): Domain mydomain is Active
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x561aa191ac20
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x561aa191ace0
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Running timer event 0x561aa191ac20 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Destroying timer event 0x561aa191ace0 "ltdb_timeout"
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): Ending timer event 0x561aa191ac20 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_attach_req] (0x0400): DP Request [Initgroups #2]: New request. Flags [0x0001].
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_attach_req] (0x0400): Number of active DP request: 1
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sss_domain_get_state] (0x1000): Domain mydomain is Active
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_send] (0x4000): Retrieving info for initgroups call
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [ou=people,ou=primary,ou=eid,dc=my,dc=edu]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_print_server] (0x2000): Searching REDACTED:636
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=myuser)(objectclass=inetorgperson)(&(uid=*)(!(uid=0))))][ou=people,ou=primary,ou=eid,dc=my,dc=edu].
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [rhost]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sshPublicKey]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userCertificate;binary]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [mail]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 5
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_op_add] (0x2000): New operation 5 timeout 6
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: sh[0x561aa17fdf50], connected[1], ops[0x561aa191d380], ldap[0x561aa17dbd00]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_entry] (0x1000): OriginalDN: [uid=myuser,ou=people,ou=primary,ou=eid,dc=my,dc=edu].
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [mail]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [uid]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimestamp]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: sh[0x561aa17fdf50], connected[1], ops[0x561aa191d380], ldap[0x561aa17dbd00]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_op_destructor] (0x2000): Operation 5 finished
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_user] (0x4000): Receiving info for the user
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): start ldb transaction (nesting: 0)
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_initgr_user] (0x4000): Storing the user
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0400): Save user
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_attrs_get_sid_str] (0x1000): No [objectSID] attribute. [0][Success]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x4000): objectSID: not available for user
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory].
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_get_primary_name] (0x0400): Processing object myuser
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0400): Processing user myuser@mydomain
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0020): Cannot retrieve UID for [myuser@mydomain] in domain [mydomain].
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_save_user] (0x0020): Failed to save user [myuser@mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [ldb] (0x4000): cancel ldb transaction (nesting: 0)
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_id_op_done] (0x4000): releasing operation connection
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_done] (0x0400): DP Request [Initgroups #2]: Request handler finished [0]: Success
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [_dp_req_recv] (0x0400): DP Request [Initgroups #2]: Receiving request data.
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_reply_list_success] (0x0400): DP Request [Initgroups #2]: Finished. Success.
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_reply_std] (0x1000): DP Request [Initgroups #2]: Returning [Internal Error]: 3,1432158246,Init group lookup failed
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:3::mydomain:name=myuser@mydomain] from reply table
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_destructor] (0x0400): DP Request [Initgroups #2]: Request removed.
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: sh[0x561aa17fdf50], connected[1], ops[(nil)], ldap[0x561aa17dbd00]
(Thu Aug 8 16:45:53 2019) [sssd[be[mydomain]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
in /var/log/sssd/sssd_pam.log:
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): domain: not set
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): user: myuser
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): service: sshd
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): tty: ssh
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): rhost: REDACTED
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): priv: 1
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 8489
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_print_data] (0x0100): logon name: myuser
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_initgr_check_timeout] (0x4000): User [myuser] not found in PAM cache.
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_set_plugin] (0x2000): CR #0: Setting "Initgroups by name" plugin
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_send] (0x0400): CR #0: New request 'Initgroups by name'
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_process_input] (0x0400): CR #0: Parsing input name [myuser]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_set_name] (0x0400): CR #0: Setting name [myuser]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_select_domains] (0x0400): CR #0: Performing a multi-domain search
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_domains] (0x0400): CR #0: Search will bypass the cache and check the data provider
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain mydomain type POSIX is valid
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_set_domain] (0x0400): CR #0: Using domain [mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [mydomain] rules
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_send] (0x0400): CR #0: Looking up myuser@mydomain
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myuser@mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/mydomain/myuser@mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_ncache] (0x0400): CR #0: [myuser@mydomain] is not present in negative cache
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_dp] (0x0400): CR #0: Looking up [myuser@mydomain] in data provider
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [0x5624540cd550:3:myuser@mydomain@mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [mydomain][0x3][BE_REQ_INITGROUPS][name=myuser@mydomain:-]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_add_timeout] (0x2000): 0x562454f181e0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): Entering request [0x5624540cd550:3:myuser@mydomain@mydomain]
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_remove_timeout] (0x2000): 0x562454f181e0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_dispatch] (0x4000): dbus conn: 0x562454f1bc40
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sbus_dispatch] (0x4000): Dispatching.
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 1432158246 error message: Init group lookup failed
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_common_dp_recv] (0x0040): CR #0: Data Provider Error: 3, 1432158246, Init group lookup failed
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_common_dp_recv] (0x0400): CR #0: Due to an error we will return cached data
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_cache] (0x0400): CR #0: Looking up [myuser@mydomain] in cache
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f289b0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f28a70
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f289b0 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f28a70 "ltdb_timeout"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f289b0 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_search_cache] (0x0400): CR #0: Object [myuser@mydomain] was not found in cache
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [cache_req_process_result] (0x0400): CR #0: Finished: Not found
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f1d530
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f20ff0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f1d530 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f20ff0 "ltdb_timeout"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f1d530 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [10]: User not known to the underlying authentication module.
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f29580
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f29640
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f29580 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f29640 "ltdb_timeout"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f29580 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x562454f248b0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x562454f23ec0
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Running timer event 0x562454f248b0 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Destroying timer event 0x562454f23ec0 "ltdb_timeout"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [ldb] (0x4000): Ending timer event 0x562454f248b0 "ltdb_callback"
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [filter_responses] (0x0100): [pam_response_filter] not available, not fatal.
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [pam_reply] (0x0200): blen: 8
(Thu Aug 8 16:45:53 2019) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x5624540cd550:3:myuser@mydomain@mydomain]
(Thu Aug 8 16:46:07 2019) [sssd[pam]] [client_recv] (0x0200): Client disconnected!
(Thu Aug 8 16:46:07 2019) [sssd[pam]] [client_close_fn] (0x2000): Terminated client [0x562454f245a0][19]
Thanks,
Jane
4 years, 8 months