Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell
On my dual-stack network where some machines actually don't have IPv4
connectivity I am finding that whatever is writing IP addresses into
/var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses
and not the KDC's IPv6 addresses.
The result is that such an IPv6 machine cannot reach a KDC until I
remove that file. It ends up being recreated at some subsequent point
again with only the KDC's IPv4 addresses.
Is this a bug or a problem with my configuration?
Cheers,
b.
4 months, 2 weeks
How to correctly omit the AD domain prefix from hostnames etc
by Kodiak Firesmith
Hi Folks,
I currently have SSSD-AD working exactly as I want it, less one drawback - I have to include the AD domain prefix everywhere to get things working.
For example, we are whoi.edu, and in non-AD DNS, all of our hosts are $hostname.whoi.edu.
We'll call our AD domain 'adwhoi' for this discussion.
To get things working cleanly, Ansible reconfigures each host right before the AD join to use the hostname $hostname.adwhoi.whoi.edu instead of $hostname.whoi.edu.
Hosts join AD via adcli and set the usual UPN and SPNs. AD-based identity and authentication works just fine. GSSAPI auth works fine. Users are granted a valid TGT upon login. Root can kinit the host keytab fine.
Deploying a new major release of Linux is always an opportunity to make a clean break and fix annoyances like this, so I'd love to know how we can get all of the above working, but without having to include the domain prefix in our hostnames and in our ssh references.
I've done a fair bit of digging on this while setting up our AD join scheme and authoring our Ansible code, but I've never been able to crack this issue, so I'd love it if someone could clue me in.
Here's some of the relevant files in case they are helpful:
===========================================================================================
/etc/sssd/sssd.conf:
[sssd]
domains = adwhoi.whoi.edu
services = nss, pam
debug_level = 3
[domain/adwhoi.whoi.edu]
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = ADWHOI.WHOI.EDU
id_provider = ad
fallback_homedir = /home/%u
override_homedir = /home/%u
default_shell = /bin/bash
ad_domain = adwhoi.whoi.edu
use_fully_qualified_names = False
ldap_id_mapping = False
access_provider = ad
ad_gpo_access_control = disabled
ad_server = jimbob.adwhoi.whoi.edu,cleetus.adwhoi.whoi.edu
ad_backup_server = jedidiah.adwhoi.whoi.edu
ad_maximum_machine_account_password_age = 0
ldap_referrals = False
===========================================================================
/etc/krb5.conf
[libdefaults]
default_realm = ADWHOI.WHOI.EDU
rdns = False
dns_canonicalize_hostname = False
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
# The following libdefaults parameters are only for Heimdal Kerberos.
fcc-mit-ticketflags = true
[realms]
ADWHOI.WHOI.EDU = {
kdc = jimbob.adwhoi.whoi.edu
kdc = cleetus.adwhoi.whoi.edu
kdc = jedidiah.adwhoi.whoi.edu
admin_server = jimbob.adwhoi.whoi.edu
default_domain = adwhoi.whoi.edu
}
[domain_realm]
.adwhoi.whoi.edu = ADWHOI.WHOI.EDU
adwhoi.whoi.edu = ADWHOI.WHOI.EDU
===========================================================================
Example keytab:
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
2 SOMEHOST$(a)ADWHOI.WHOI.EDU (arcfour-hmac)
2 SOMEHOST$(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96)
2 SOMEHOST$(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96)
2 host/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (arcfour-hmac)
2 host/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96)
2 host/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96)
2 host/SOMEHOST(a)ADWHOI.WHOI.EDU (arcfour-hmac)
2 host/SOMEHOST(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96)
2 host/SOMEHOST(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96)
2 RestrictedKrbHost/SOMEHOST(a)ADWHOI.WHOI.EDU (arcfour-hmac)
2 RestrictedKrbHost/SOMEHOST(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96)
2 RestrictedKrbHost/SOMEHOST(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96)
2 RestrictedKrbHost/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (arcfour-hmac)
2 RestrictedKrbHost/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes128-cts-hmac-sha1-96) 2 RestrictedKrbHost/somehost.adwhoi.whoi.edu(a)ADWHOI.WHOI.EDU (aes256-cts-hmac-sha1-96)
==========================================================================
Thanks!
- Kodiak Firesmith
Sent with [Proton Mail](https://proton.me/) secure email.
1 year, 1 month
SSH with KbdInteractiveAuthentication - pam_sssd activates wrong credentials cache on login
by Sam Morris
Posting this here before I file a bug because there are a few similar
bugs which have been closed, and so I don't know if I'm seeing one of
them or whether this is a new one.
On the server, before I SSH in, my credentials cache collection looks
like this:
$ printenv KRB5CCNAME
KCM:
$ klist -l
Principal name Cache name
-------------- ----------
user(a)EXAMPLE.COM KCM:1011:48623 (Expired)
user(a)EXAMPLE.COM KCM:1011:1518 (Expired)
user(a)EXAMPLE.COM KCM:1011:12525 (Expired)
user(a)EXAMPLE.COM KCM:1011:95695 (Expired)
user(a)EXAMPLE.COM KCM:1011:19607 (Expired)
user(a)EXAMPLE.COM KCM:1011:25261 (Expired)
$ klist
Ticket cache: KCM:1011:95695
Default principal: user(a)EXAMPLE.COM
Valid starting Expires Service principal
06/22/22 00:03:52 06/23/22 00:01:49 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM
The TGT in the primary credentials cache is an old one that expired a
few days ago.
Now I SSH into the server, using keyboard-interactive authentication, so
sshd calls into pam_sss to authenticate me with Kerberos.
$ ssh -v -l user server.example.com
debug1: Next authentication method: keyboard-interactive
(user(a)server.example.com) First Factor:
(user(a)server.example.com) Second Factor:
Authenticated to server.example.com (via proxy) using "keyboard-interactive".
$ klist
Ticket cache: KCM:1011:48623
Default principal: user(a)EXAMPLE.COM
Valid starting Expires Service principal
05/24/22 23:39:09 05/25/22 23:16:16 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM
05/25/22 19:31:42 05/25/22 23:16:16 HTTP/server.example.com(a)EXAMPLE.COM
The primary credential cache has been changed to a different cache, that
contains an old, expired ticket. So the I can't use my TGT to access
network services.
If I then list the contents of the original primary credential cache:
$ klist -c KCM:1011:95695
Ticket cache: KCM:1011:95695
Default principal: user(a)EXAMPLE.COM
Valid starting Expires Service principal
09/28/22 09:37:09 09/29/22 09:36:36 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM
SSSD put the new TGT into the former primary credential cache, and then
changed the primary credential cache to one of the other caches within
the collection.
I expected that, regardless of whether the new TGT goes into a new
credential cache or an existing one, the destination credential cache is
set as the primary so that it can be used by the user.
In particular this looks like
<https://github.com/SSSD/sssd/issues/4988>, but a comment says that that
has been fixed in RHEL 8 some time ago, nonetheless I'm seeing this
problem on both RHEL 9.0 (sssd-common-2.6.2-4.el9_0.1.x86_64) and RHEL
8.6 (sssd-common-2.6.2-4.el8_6.1.x86_64).
The workaround is to identify the credential cache that contains
non-expired credentials and then make it the primary:
$ klist -l
Principal name Cache name
-------------- ----------
user(a)EXAMPLE.COM KCM:1011:48623 (Expired)
user(a)EXAMPLE.COM KCM:1011:1518 (Expired)
user(a)EXAMPLE.COM KCM:1011:12525 (Expired)
user(a)EXAMPLE.COM KCM:1011:19607 (Expired)
user(a)EXAMPLE.COM KCM:1011:95695
$ kswitch -c KCM:1011:95695
If I perform the same test but using gssapi-with-mic authentication in
combination with GSSAPIDelegateCredentials, then I see that the TGT is
stored in a new credentials cache, which is then set as the primary,
e.g. everything works!
I also think that sssd should be cleaning up these old credential
caches. AFAIK, there's no perfect forward secrecy with Kerberos, so can
these old tickets can be used to decrypt captured network traffic?
Regards,
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
1 year, 1 month
[SSSD] Announcing SSSD 2.8.0
by Pavel Březina
# SSSD 2.8.0
The SSSD team is announcing the release of version 2.8.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.8.0
See the full release notes at:
https://sssd.io/release-notes/sssd-2.8.0.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### General information
* The new D-Bus function ListByAttr() allows the caller to look for
users that have an attribute with a certain value. For performance
reasons, it is recommended that the attribute is indexed both on the
remote server and on the local cache. The sssctl tool now provides the
cache-index command to help you manage indexes on the local cache.
### New features
* Introduced the dbus function
org.freedesktop.sssd.infopipe.Users.ListByAttr(attr, value, limit)
listing upto limit users matching the filter attr=value.
* sssctl is now able to create, list and delete indexes on the local
caches. Indexes are useful for the new D-Bus ListByAttr() function.
* sssctl is now able to read and set each component's debug level
independently.
### Important fixes
* `domains` option in `[sssd]` section can now be completely omitted if
domains are enabled via `domains/enabled` option
### Configuration changes
* New option 'core_dumpable' to manage 'PR_SET_DUMPABLE' flag of SSSD
processes. Enabled by default.
* New option 'ldap_enumeration_refresh_offset' to set the maximum period
deviation between enumeration updates. Defaults to 30 seconds.
* New option 'subdomain_refresh_interval_offset' to set the maximum
period deviation when refreshing the subdomain list.
* New option 'dyndns_refresh_interval_offset' to set the maximum period
deviation when updating the client's DNS entry. Defaults to 0.
* New option 'refresh_expired_interval_offset' to set the maximum period
deviation when refreshing expired entries in background.
* New option 'ldap_purge_cache_offset' to set the maximum time deviation
between cache cleanups. Defaults to 0.
* Option 'ad_machine_account_password_renewal_opts' now accepts an
optional third part as the maximum deviation in the provided period
(first part) and initial delay (second part). If the period and initial
delay are provided but not the offset, the offset is assumed to be 0. If
no part is provided, the default is 86400:750:300.
* override_homedir now recognizes the %h template which is replaced by
the original home directory retrieved from the identity provider, but in
lower case.
1 year, 1 month