sssd-users November 2022

sssd-users@lists.fedorahosted.org

9 participants
10 discussions

Starting SSSD without root
by Tero Saarni 09 Apr '24

09 Apr '24

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 20

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell 22 Jul '23

22 Jul '23

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

2 3

Re: AD refresh GPO to Ubuntu22.04
by Gregory Carter 25 Dec '22

25 Dec '22

There is no such thing as a GPO for a LINUX box. That being said I use Puppet to do basically the same thing. (i.e. Bring LINUX, MAC, Windows to bear on a common LDAP policy schema I created to enforce machine configurations, authentication and security policies.) On Fri, Sep 9, 2022 at 12:56 AM 任昭翰 <zhaohan.ren(a)hotmail.com> wrote: > Hi guys > > I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server > by sssd + realm, in the AD I have a customized GPO, is it possible that the > AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client > that also joined this AD, the win10 client could receive the GPO update > successfully from the AD. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

4 5

tuning sssd-ldap to perform close to nss_ldap
by Christian, Mark 02 Dec '22

02 Dec '22

I've been running some benchmarks, timing how long it takes nss_ldap and sssd-ldap configurations to map uid to user names, trying to get an sssd.conf configuration that performs more or less to the existing nss_ldap configuration in terms of system responsive and network utilization. For better or worse I work in an environment where it's not uncommon for folks to do ls -l on directories where hundreds or thousands of subdirectories have unique ids. These tests are run on SLES12sp5, and have the following relevant pkgs: # rpm -q kernel-default sssd sssd-ldap nss_ldap kernel-default-4.12.14-122.136.1.x86_64 sssd-1.16.1-7.44.1.x86_64 sssd-ldap-1.16.1-7.44.1.x86_64 nss_ldap-265-35.12.x86_64 With the system configured for nss_ldap a "stat -c%U" on a parent directory containing 34735 uniquely owned subdirectories, takes 15 to 30 seconds to complete, and generates approximately 30MB of ldap traffic. This is consistent barring any account caching, e.g. nscd. I know the number of subdirectories is extreme, but I find it useful for "worst case" benchmark purposes. With the system configured for sssd-ldap a "stat -C%U" on the same directory initially takes 8+ minutes, and generates ~53MB of ldap traffic. Subsequent runs of the stat command complete in as little as 5 seconds or as long as 45 seconds with the benefit of the sssd cache. To achieve similar system and network performance to nss_ldap, I'm considering increasing entry_cache_timeout from 90 minutes to 4 hours, with refresh_expired_interval set at 3 hours in the hopes of not exceeding the amount of network traffic I see with nss_ldap. I'm also comtemplating pre-populating the sssd cache, when provisioning new systems in order to prevent the initial time it takes to map uid to user name? If so, does it make sense to copy recent copies of the files under /var/lib/sss/db to newly deployed systems? Can I attribute the variance in time it takes to run the stat command, anywhere from 5 to 45 seconds, to the background refresh process being in the "middle" of it's refresh? Should I accept that this will always be the case depending on when the "stat -c%U" is run? If the sssd cache is near expiring and refresh_expired_interval is in the middle of the refresh process I'm going to see stat take longer to complete than if the cache is mostly current? Is there anything I can do to avoid this on systems, e.g. run a cron job that does something similar to the stat command? Are there other options I should consider in order to get sssd-ldap to perform similarily to nss_ldap? NSS_LDAP /etc/ldap.conf base dc=example,dc=com SIZELIMIT 0 scope sub uri ldaps://ldap1 ldaps://ldap2 ldap_version 3 bind_policy soft binddn cn=bind_dn,ou=profile,dc=example,dc=com bindpw PASSWORD DEREF never timelimit 30 bind_timelimit 15 idle_timelimit 3600 nss_base_passwd ou=People,dc=example,dc=com?one nss_base_group ou=group,dc=example,dc=com?one nss_base_netgroup ou=netgroup,dc=example,dc=com?one nss_schema rfc2307 tls_ciphers ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA nss_initgroups_ignoreusers root,bin,daemon,nobody SSSD /etc/sssd/sssd.conf [sssd] config_file_version = 2 services = nss, pam domains = LDAP [nss] [pam] [domain/LDAP] id_provider = ldap auth_provider = krb5 krb5_realm = EXAMPLE.COM ldap_schema = rfc2307 ldap_uri = ldaps://ldap1, ldaps://ldap2 ldap_search_base = dc=example,dc=com ldap_user_search_base = ou=People,dc=example,dc=com?onelevel? ldap_group_search_base = ou=group,dc=example,dc=com?onelevel? ldap_netgroup_search_base = ou=netgroup,dc=example,dc=com?onelevel? ldap_default_bind_dn = cn=bind_dn,ou=profile,dc=example,dc=com ldap_default_authtok = PASSWORD lookup_family_order = ipv4_only # following set for testing, otherwise 14400 and 10800 respectively entry_cache_timeout = 600 refresh_expired_interval = 450 Thanks, Mark

2 1

sssd not using local sudoers file
by Kevin Vasko 01 Dec '22

01 Dec '22

We have a local user that has an entry in sudoers for a “NOPASSWD”. In /etc/nsswitch.conf we have: sudoers: files sss For some reason sssd is falling back to sssd even though we have the “files” entry first and is checking our FreeIPA instance and rejecting it and prompts for password. if I make it sudoers: files It works. This was working without issue on 18.04, we upgraded to 20.04 and now see the problem. Is there a way to make it prioritize the local sudoers and stop looking on sssd? -Kevin

3 11

sssd/AD not showing all groups for user
by Jim Burwell 30 Nov '22

30 Nov '22

Hi, On a CentOS 7 system bound to an AD domain, running sssd 1.16.5-10.el7. Some groups are not showing up in a users list of groups. The group in question which is not showing up is a large group with over 5000 members. The Windows Server versions are up to date, so I'm not sure if the Windows 2k 5000 member limit is the issue or not, or whether sssd has a similar max group size limit. Is there a limitation on either the AD or sssd side for the max number of group members? Thanks, Jim

2 3

AD joined machine with different suffix
by Erdem YANIK 24 Nov '22

24 Nov '22

Hello, I've been struggling for 4 days and according to the information I have stated below, I cannot access the linux operating system joined in AD to users with different suffixes. What kind of config should I make, can you help me? domain name = TEST.COM DNS domain name = test.com NETBIOS = FACTORY ADDC1 = msdc1.test.com ADDC2 = msdc2.test.com users : adminuser1(a)test.com users : adminuser2(a)factory1.com.tr users : adminuser3(a)peace.ru users : adminuser4(a)gone.edu.tr

2 1

Can't authenticate using RHEL 8.7 on AD
by Francis Augusto Medeiros-Logeay 23 Nov '22

23 Nov '22

Hi, After the latest updates coming from Red Hat on RHEL 8.7, we can't authenticate on AD. The logs show this: Nov 22 14:15:53 ic-rhel8-t001.c.domain.no sshd[6275]: pam_sss(sshd:auth): received for user ec-franciaa: 4 (System error) Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sshd[6275]: Failed password for ec-franciaa from ::1 port 51406 ssh2 Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sssd[6280]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sssd[6280]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sssd[6284]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sssd[6284]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sssd[6288]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Nov 22 14:15:55 ic-rhel8-t001.c.domain.no sssd[6288]: tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more information, Minor = Server not found in Kerberos database. Nov 22 14:15:56 ic-rhel8-t001.c.domain.no sshd[6275]: Connection closed by authenticating user francis ::1 port 51406 [preauth] I've deleted the computer account and rejoined the machine to the domain. I can check users existence using id, it seems the machine is well joined, but somehow authentication doesn't work. [domain/DOMAIN.NO] id_provider = ad auth_provider = ad autofs_provider = ad chpass_provider = ad access_provider = ad ldap_id_mapping = false ldap_user_principal = nosuchattribute ad_server = dc.domain.no ldap_id_mapping = false # getent on users with more -- results in a lot of noise enumerate = false cache_credentials = true # Setup schema, rfc2307 is for OpenLDAP, rfc2307bis is A/D-close, and ad is A/D dns_discovery_domain = dc.domain.no krb5_realm = AD.FP.EDUCLOUD.NO # how long including renewals may a ticket be valid for krb5_renewable_lifetime = 14d # time in seconds between checking if a ticket must be renewed krb5_renew_interval = 3600 # template used for placing kerberos tickets by default ad_gpo_map_interactive = +gdm-vmwcred use_fully_qualified_names = False [kcm] tgt_renewal = true tgt_renewal_inherit = DOMAIN.NO krb5_renew_interval = 60m debug_level = 10 socket_path = /var/run/.heim_org.h5l.kcm-socket We have a machine built two weeks ago with the same sssd.conf, and it just works. Any hints? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 9

Microsoft November 2022 updates breaks Active Directory integration]
by Sumit Bose 16 Nov '22

16 Nov '22

----- Weitergeleitete Nachricht von Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> ----- Date: Mon, 14 Nov 2022 10:19:15 -0500 From: Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Rob Crittenden <rcritten(a)redhat.com> Subject: [Freeipa-users] Microsoft November 2022 updates breaks Active Directory integration Microsoft addressed a number of CVEs last week which introduced some authentication issues. After installation of these patches, user authentication on Linux systems integrated in Active Directory no longer works and new systems are unable to join an AD domain that is managed by domain controllers where these patches have been applied. For more details see https://access.redhat.com/solutions/6985061 (open to the public). rob _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue ----- Ende weitergeleitete Nachricht -----

2 2

[SSSD] Announcing SSSD 2.8.1
by Pavel Březina 04 Nov '22

04 Nov '22

# SSSD 2.8.1 The SSSD team is announcing the release of version 2.8.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.8.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.8.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### Important fixes * A regression when running sss_cache when no SSSD domain is enabled would produce a syslog critical message was fixed.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users November 2022