Starting SSSD without root
by Tero Saarni
Hi,
I'm trying to run SSSD inside docker container without root user. The
container is executed in OpenShift cluster which does not allow running as root
inside container.
SSSD requires root and checks for this specifically.
Is there any workaround for this?
I believe the limitation is implemented for security reasons, in order to have
most critical parts executed as root and have it drop privileges for other
parts but this now completely blocks using SSSD in the above environment.
--
Tero
1 week, 5 days
struggling with reuse of pam_sss kerberos ticket
by Calvin Chiang
Ex-windows admin wrapping my head around PAM/SSSD has been quite tough!
I have successfully managed to to get pam_sss working with
- login for specific appliction rstudio server (/etc/pam.d/rstudio)
- containerized ubuntu
- ldap/krb5 auth
- against Microsoft Active Directory
- without domain join realmd. (so all hand-configured. ouch)
the problem is with reuse of the ticket. i cant work out how it works..
I would like to configure pam_mount and ODBC to use the same kerberos
ticket that was generated by the pam_sss modules
so
pam_sss creates a ticket with the follwoing naming which *cannot be used by
the "mount" command*:
/tmp/krb5cc_uid_xxxx
however if i manually use kinit, it creates a ticket with the naming below,
which *can be easily reuse from the "mount" command*:
/tmp/krb5cc_uid
the naming that pam_sss uses seems to be standard but again i just cant
work out how that should be "discoverable" by any other services looking
for a ticket, when it has the wrong naming..
some links..:
this seems to be where the pam_sss naming is defined - by a build flag
--with-default-ccname-template
https://github.com/SSSD/sssd/blob/master/src/conf_macros.m4#L337
i want to integrate it into pam_mount to mount a cifs drive, which (i
think) is SMB so will be able to use the cifs.upcall library.
And the way cifs.upcall resolves tickets is somehwere here in
get_cachename_from_process_env
https://github.com/aaptel/cifs-utils/blob/master/cifs.upcall.c#L260
i also want to get MSSQL ODBC driver to use the ticket as well...
1 week, 6 days
SSSD - Dynamic Multiple NIC
by Personne
Hello,
I'm currently using an older version of SSSD 1.13 on Centos 6, we are
migrating to Centos 7, and I was thinking of enabling dynamic DNS update.
My problem is our servers do have multiple NIC from 1 to 6.
Is there an article somewhere explaining how SSSD works with multiple NIC ?
Since I was not able to find any complete doc about this yet.
- Is it possible to tell SSSD to dynamic DNS eth0 and eth5 ?
- Is it possible to tell SSSD to dynamic DNS all eth, and add a suffix with
the ID NIC such as : server1-eth0 .test.com / server1-eth2 .test.com,
etc....
Thank you
3 weeks
p11_child doesn't use 2nd slot if 1st slot is empy
by Assaf Morami
Hello everyone.
I'm trying to configure smart card login of active directory users on an ubuntu machine.
I'm following this guide: https://scriptech.io/linux-enable-smartcard-authentication-against-active...
But for me the opensc library cannot talk with my card and I'm using a library that my card provider gave my. My issue right now is that `p11_child --pre --nssdb=/etc/pki/nssdb` fails to pull the certificate from my smart card.
I'm able to log in with AD users and their smart cards using `kinit` and `ksu`, so I know the cards are okay.
What's weird to me is that `modutil -list` shows slot 0 as empty and slot 1 as not empty, and then `p11_child --pre` doesn't try to use slot 1. Maybe p11_child thinks that if slot 0 is empty then slot 1 must be empty too?
Please help!
Here are the relevant logs:
```
# modutil -dbdir nssdb -list
Listing of PKCS #11 Modules
----------------------------------------------------
1. NSS Internal #11 Module
uri: pkcs11: library-manufacturer=Mozilla%20Foundation; library-description=NSS%20Internal%20Crypto%20Services;library
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation; serial=0000000000000000;model=NSS%203
2. MyTest
library name: mylib.so
uri: pkcs11:library-manufacturer=Boring%20Ent.;library-description=Cryptokit%20Extended%20Version;libversion=5.3
slots: 2 slots attached
status: loaded
slot: [EMPTY]
token:
uri: pkcs11:
slot: Athena ASE IIIe (SBR069-00000) 00 00
token: 918
uri: pkcs11:token=918;manufacturer=Boring%20Ent.;serial=0349B7D30E11024G;model=PKISmartCard%20(A)
```
```
# p11_child --pre --nssdb=nssdb -d=9
[main] (0x0400): p11_child started.
[main] (0x2000): Running in [pre-auth] mode.
[main] (0x2000): Running with effective IDs: [0][0].
[do_card] (0x4000): Default Module List:
[do_card] (0x4000): common name: INSS Internal PKCS #11
[do_card] (0x4000): dll name: [(null)).
[do_card] (0x4000): common name: [MyTest]
[do_card] (0x4000): dll name: [Libsadaptor.so].
[do_card] (0x4000): Dead Module List:
[do_card] (0x4000): DB Module List:
[do_card] (ex4000): common name: [NSS Internal Module].
[do_card] (0x4000): dll name: [(null)].
[do_card] (0x4000): Description [NSS Internal Cryptographic Services Mozilla Foundation] Manufacturer [Mozilla Foundation] flags [9] removable [false] token present [true].
[do_card] (0x4000): Description [NSS User Private Key and Certificate Services Mozilla Foundation] Manufacturer [Mozilla Foundation] flags [1] removable [false] token present [true].
[do_card] (0x4000): Description [[EMPTY] Boring Ent.] Manufacturer [Boring Ent.] flags [2] removable [true] token present [false].
[do_card] (0x4000): Token not present.
[main] (0x0040): do-work failed.
[main] (Ox0020): p11_child failed!
```
4 weeks
Re: p11_child doesn't use 2nd slot if 1st slot is empy
by Assaf
I don't really know much about it. I think it's a library by Motorola that
was given to my employer.
Am I correct about the 1st empty slot makes it not continue to check the
2nd slot? Is it solvable with -rawadd maybe, or does it mandates a code
change to the p11_child binary?
4 weeks
sssd crashing on aarch64
by Matthew Bettinger
Hello,
We are deploying a new cluster centos 8.2.2004 architecture is aarch64.
We are trying to integrate it with our freeipa system but having an issue where the sssd daemon on the nodes are core dumping. Looking for some guidance in tracking down the issue.
CentOS Linux release 8.2.2004 (Core)
[root@cedar-cn01 ~]# uname -a
Linux cedar-cn01.cedar.cluster 4.18.0-193.28.1.el8_2.aarch64 #1 SMP Thu Oct 22 00:42:58 UTC 2020 aarch64 aarch64 aarch64 GNU/Linux
[root@cedar-cn01 ~]# uname -r
4.18.0-193.28.1.el8_2.aarch64
/var/log/sssd shows
(Mon Mar 8 17:45:15 2021) [sssd] [sysdb_domain_cache_connect] (0x0010): DB version too new [0.22], expected [0.21] for domain implicit_files!
(Mon Mar 8 17:45:15 2021) [sssd] [sysdb_domain_cache_connect] (0x0010): DB version too new [0.22], expected [0.21] for domain implicit_files!
Unit sssd.service has finished shutting down.
Mar 09 21:28:10 cedar-cn01.cedar.cluster systemd[1]: sssd.service: Start request repeated too quickly.
Mar 09 21:28:10 cedar-cn01.cedar.cluster systemd[1]: sssd.service: Failed with result 'core-dump'.
Mar 09 21:28:10 cedar-cn01.cedar.cluster systemd[1]: Failed to start System Security Services Daemon.
-- Subject: Unit sssd.service has failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit sssd.service has failed.
--
-- The result is failed.
1 month
Password expiration in AD with SSSD
by Paweł Szafer
Hi,
I want to warn users when password expiration days are less than 14 days.
I have GPO Default domain policy with this number of days.
I have sssd.conf as:
[sssd]
domains = internal.domain.tld
config_file_version = 2
services = nss, pam
[domain/internal.domain.tld]
cache_credentials = True
debug_level = 6
id_provider = ad
auth_provider = ad
access_provider = ad
default_shell = /bin/bash
fallback_homedir = /home/%d/%u
ldap_id_mapping = True
ldap_schema = ad
enumerate = True
ad_site=internal1
ad_gpo_access_control = permissive
ad_gpo_ignore_unreadable = True
And pam.d as follow:
#%PAM-1.0
auth sufficient pam_sss.so forward_pass
auth required pam_unix.so try_first_pass nullok
auth optional pam_permit.so
auth required pam_env.so
#auth requisite pam_deny.so
account required pam_unix.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account optional pam_permit.so
account required pam_time.so
password required pam_unix.so try_first_pass nullok sha512 shadow
password sufficient pam_sss.so
use_authok
password optional pam_permit.so
session required pam_mkhomedir.so
skel=/etc/skel/ umask=0022
session required pam_limits.so
session required pam_unix.so
session optional pam_sss.so
session optional pam_permit.so
User has password valid till 20.02.2020 and yet I don't have any warning.
I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control =
permissive to my config because without it I end up with "System error"
during login and unsuccessful login.
In gpo_cache I see Machine gpo with lines:
[Registry Values]
MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
Any idea how to turn on this warning?
Thanks for your help!
-----
Best regards,
Pawel
1 month, 1 week
[hs@schlittermann.de: sssd nss: issues with applications not using endpwent()]
by Heiko Schlittermann
Hi,
I sent this to sssd-devel already, but probably it was the wrong
channel, so I'm trying it here.
I'm using Dovecot with its "passwd" userdb, which effectivly uses NSS.
NSS services are provided by the files and by the sss "plugins".
The `doveadm user *` command enumerates the list of users. Repeating the
command doesn't enumerate the users provided by sssd again.
Analyzing this issue reveals:
Dovecot uses a long living process talking to NSS. For user
enumeration it uses
setpwent()
while (…) { getpwent(); }
and then misses the call to endpwent(). This bug is already confirmed by
the Dovecot developers.
I'm not sure about the semantics of setpwent()/endpwend(), especially
about calling sequences like
setpwent()
while (…) { getpwent(); }
setpwent()
while (…) { getpwent(); }
According to setpwent(3) it should rewind to the beginning. Calling
endpwent() seems to be for curtesy only (to have resources freed)
I suggest calling a preventive endpwent() before using setpwent() again
in nss_cmd.c.
Attached you'll find my patch. I'd be happy about review and integration into
upstream.
Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
SCHLITTERMANN.de ---------------------------- internet & unix support -
Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
gnupg encrypted messages are welcome --------------- key ID: F69376CE -
1 month, 2 weeks