Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell
On my dual-stack network where some machines actually don't have IPv4
connectivity I am finding that whatever is writing IP addresses into
/var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses
and not the KDC's IPv6 addresses.
The result is that such an IPv6 machine cannot reach a KDC until I
remove that file. It ends up being recreated at some subsequent point
again with only the KDC's IPv4 addresses.
Is this a bug or a problem with my configuration?
Cheers,
b.
2 months
filter_users using user id
by Francois Rigault
Greetings,
we run some podman containers that come with their own local users, such as this one:
ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin
when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent:
(2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461]
I would hope to get rid of these requests against the domain.
unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users.
I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion.
I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better.
Thank you!
8 months, 2 weeks
missing secondary groups that have Global scope
by Jeffrey Chung
Hello all. We’re noticing an issue where at times the id command does not return a complete list of the user’s secondary groups. In our Linux environment we use both Universal and Global groups and it’s always only the Global groups that are missing. From troubleshooting we’re certain this issue comes up when a Global Catalog that is not in the same domain of the missing Global groups is used to query for group membership. From my understanding, in Active Directory only Universal group memberships are replicated to every Global Catalog.
We have a single forest with multiple domains. The forest root domain is empty and only use for administration. We have a child domain for resource like users, groups and computers.
contoso.com – empty forest root
corp.contoso.com – child domain of root, users, groups and computer objects live here. SSSD Linux are joined to this domain.
Every Domain Controller in the forest are Global Catalogs, so we have GCs in both contoso.com and corp.contoso.com.
Here’s an example of when secondary groups are missing.
We have a user john(a)corp.contoso.com and is a direct member of the following corp.contoso.com groups.
group1 (Universal scope)
group2 (Global scope)
On the SSSD host we run the following command.
% id john
Only john’s primary group and group1 are returned. From the SSSD debug logs, we only see this happen when the query is hitting a Global Catalog (port 3268) in the root domain contoso.com. If the query hits a GC in corp.contoso.com the correct groups are returned.
The LDAP filter we see from the logs is this.
(&(member=CN=john,CN=Users,DC=corp,DC=contoso,DC=com)(objectClass=posixgroup)(cn=*))
Which will not return Global groups because the Global Catalog Domain Controllers in contoso.com only have membership data for Universal groups.
We noticed this issue on sssd-1.16.1, we have hosts running an older version sssd-1.11.5.1 that don’t have this issue because the group membership query is using the LDAP port 389 not GC port 3268. On both versions we have “ad_enable_gc” set to true.
Is this a bug we’re hitting, or we have SSSD configured incorrectly? Should SSSD be group scope aware and handle this situation correctly?
We can think of a couple work-arounds, but rather not implement it if possible.
1. Set “ad_enable_gc” to false – this will probably cause some inefficiencies for SSSD
2. Convert the Global groups to Universal – we have a lot of groups and this will take some time to vette out to avoid any negative impact to our environment
Here is an example of our sssd.conf.
[sssd]
config_file_version = 2
debug_level = 9
services = nss,pam
domains = corp.contoso.com
[nss]
debug_level = 9
filter_users = root
filter_groups = root
filter_users_in_groups = false
timeout = 60
[pam]
debug_level = 9
reconnection_retries = 3
timeout = 60
[domain/corp.contoso.com]
ad_gpo_access_control = disabled
debug_level = 9
ldap_user_object_class = posixaccount
ldap_user_home_directory = unixhomedirectory
ldap_group_object_class = posixgroup
ldap_group_name = cn
ldap_group_member = member
ldap_group_nesting_level = 0
ldap_use_tokengroups = false
cache_credentials = true
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
dns_discovery_domain = corp.contoso.com
dyndns_update = false
ldap_id_mapping = false
ad_enable_gc = true
ldap_search_base = dc=corp,dc=contoso,dc=com?subtree?
ad_maximum_machine_account_password_age = 0
use_fully_qualified_names = false
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U
krb5_renew_interval = 60m
timeout = 60
Thanks in advance
-Jeff
9 months, 1 week
Issues using NSS_TACPLUS in Fedora 36's replacement of NSCD with SSSD
by Sundar Vadivelu
Hi all,
I am working on a system which does TACACS+ authentication of users with
pam_tacplus and nss_tacplus libraries
nss_tacplus: https://github.com/benschumacher/nss_tacplus
pam_tacplus: https://github.com/kravietz/pam_tacplus
This solution relied on NSCD to be running, since the nss_tacplus only
implemented getpwnam_r . For getpwuid_r etc it relied on the cached entries
in nscd. It was working fine until fedora removed NSCD from glibc in FC36 (
https://fedoraproject.org/wiki/Changes/RemoveNSCD)
The above write up indicates that SSSD could be used to cover all cacheing
requirements that was previously provided by NSCD. However I am unable to
configure SSSD for my use case.
When I tried to link the id_provider as proxy and the proxy_lib_name as
tacplus, sssd fails to come up. If fails with this error:
(2022-12-19 23:32:35): [be[shadowutils]] [sss_load_nss_symbols] (0x0010):
Library 'libnss_tacplus.so.2' did not provide mandatory symbol
'getpwuid_r', error: /lib64/libnss_tacplus.so.2: undefined symbol:
_nss_tacplus_getpwuid_r.
Is there any way to use sssd with the above mentioned nss_tacplus library?
By this I mean can sssd be configured to do getpwnam only using the
nss_tacplus, at which time it could cache the passwd details of the user,
and use the cache for the other APIs like getpwuid etc?
_________________________________________________
9 months, 1 week
New sssd-related message this week in /var/log/messages
by Spike White
Sssd experts,
We have been running sssd to AD integrate to a cross-domain AD forest for
~2 years now. With RHEL 7, 8 and (now) 9 servers. Has worked great.
Just this week, we have a new message appearing in /var/log/messages
related to sssd that we’ve never seen before:
*Dec 10 06:11:19 pshnldur01.amer.company.com
<http://pshnldur01.amer.company.com> sssd_be[343144]: PAC check is
requested but krb5_validate is set to false. PAC checks will be skipped.*
This is a RHEL8 server, running sssd 2.7.3-4.0.1.el8_7.1 -- installed Fri
02 Dec 2022. We notice a new sssd_pac process running, even though in
/etc/sssd/sssd.conf, we did not explicitly define any “pac” service.
In RHEL7 servers, we do not see any such sssd_pac process. We do see this
process in RHEL9 servers.
In the change log for this new RHEL8 sssd version, I notice this recent
entry:
[2.7.3-4.1]
- Resolves: rhbz#2128902 - Cannot SSH with AD user to ipa-client
(krb5_validate and pac_check settings conflict) [rhel-9.1.0.z]
Yes, in our /etc/sssd/sssd.conf file we set:
krb5_validate = False
All seems to be behaving. The server appears to be able to communicate
fine with this local domain. All expected logins appear to work.
1. Can we ignore these messages?
2. Are they due to this new sssd version?
3. Why does a pac service start up if we do not explicitly define it in
our list of services?
Spike White
9 months, 1 week
Issues using NSS_TACPLUS in Fedora 36's replacement of NSCD with SSSD
by Sundar Vadivelu
Hi all,
I am working on a system which does TACACS+ authentication of users with pam_tacplus and nss_tacplus libraries
nss_tacplus: https://github.com/benschumacher/nss_tacplus
pam_tacplus: https://github.com/kravietz/pam_tacplus
This solution relied on NSCD to be running, since the nss_tacplus only implemented getpwnam_r . For getpwuid_r etc it relied on the cached entries in nscd. It was working fine until fedora removed NSCD from glibc in FC36 (https://fedoraproject.org/wiki/Changes/RemoveNSCD)
The above write up indicates that SSSD could be used to cover all cacheing requirements that was previously provided by NSCD. However I am unable to configure SSSD for my use case.
When I tried to link the id_provider as proxy and the proxy_lib_name as tacplus, sssd fails to come up. If fails with this error:
(2022-12-19 23:32:35): [be[shadowutils]] [sss_load_nss_symbols] (0x0010): Library 'libnss_tacplus.so.2' did not provide mandatory symbol 'getpwuid_r', error: /lib64/libnss_tacplus.so.2: undefined symbol: _nss_tacplus_getpwuid_r.
Is there any way to use sssd with the above mentioned nss_tacplus library? By this I mean can sssd be configured to do getpwnam only using the nss_tacplus, at which time it could cache the passwd details of the user, and use the cache for the other APIs like getpwuid etc?
9 months, 1 week
[SSSD] Announcing SSSD 2.8.2
by Pavel Březina
# SSSD 2.8.2
The SSSD team is announcing the release of version 2.8.2 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.8.2
See the full release notes at:
https://sssd.io/release-notes/sssd-2.8.2.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### General information
* SSSD can be configured not to perform a DNS search during DNS name
resolution. This behavior is governed by the new
dns_resolver_use_search_list. This parameter can be used in the domain
section. Default value is true - that means that SSSD follows the system
settings.
* `--enable-files-domain` configure option is deprecated and will be
removed in one of the next versions of SSSD.
* `sssctl analyze` tool doesn't require anymore to be run under root.
### New features
* New mapping template for serial number, subject key id, SID,
certificate hashes and DN components are added to libsss_certmap.
9 months, 3 weeks
sssd.conf for single ldap id_provider across 2 or more krb5 auth_providers.
by Christian, Mark
I have a single ldap instance that provides ID for accounts across
multiple trusted kerberos realms. I don't see a way to list multiple
keberos REALMS under a single domain section. I'm guessing the only way
this scheme will work is if I locate the realm1 ldap accounts in one
container and the realm2 accounts in another container e.g.:
domains = realm1, realm2
[domain/realm1]
id_provider = ldap
ldap_uri = ldaps://ldap.example.com
auth_provider = krb5
krb5_realm = REALM1.COM
ldap_user_search_base = ou=realm1,ou=people,dc=example,dc=com
[domain/realm2]
id_provider = ldap
ldap_uri = ldaps://ldap.example.com
auth_provider = krb5
krb5_realm = REALM2.COM
ldap_user_search_base = ou=realm2,ou=people,dc=example,dc=com
Am I correct that I won't be able to place the realm1 and realm2
accounts in the same ldap_user_search_base? I was hoping I might be
able to leverage “[domain/realm1/realm2]” but it doesn't look like
krb5_realm is an option here, and that the trusted domain section
expects to find identity in separate user search bases.
Mark
9 months, 3 weeks
CentOS 7, SSSD against LDAP: finds user but will not log them in, "Authentication failure" when trying to su
by Jarett DeAngelis
Hi,
I am trying to get SSSD to authenticate against an OpenLDAP directory. I have "debug_level" turned up to 10 but have not been able to figure out what the problem is based on the log.
On an Ubuntu 22.04 system I have found that something with TLS is broken when it tries to connect to OpenLDAP, which is why it has failed on that system -- I think this is related to the OS moving to OpenSSL 3 but have not been able to figure out how to fix it.
On this CentOS 7 system, you can see that it can find the user, can get properties from the user, but still fails the user login without, as far as I can tell, explaining why.
I have pasted our sssd.conf below, and here is a link to my Nextcloud instance where I am hosting the relevant portion of the log (it was too big for me to be able to paste it into Pastebin): https://checkwithscience.com/index.php/s/e7mXKAzcq87q6HD <https://checkwithscience.com/index.php/s/e7mXKAzcq87q6HD>
Hoping someone can help us get to the bottom of this.
Thanks.
Here is our sssd.conf:
[sssd]
services = nss, pam
config_file_version = 2
domains = default
certificate_verification = no_verification
[nss]
[pam]
offline_credentials_expiration = 60
[domain/default]
debug_level = 10
ldap_id_use_start_tls = False
cache_credentials = True
ldap_search_base = ou=users,dc=clab,dc=lab
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = ldap
ldap_uri = ldaps://10.8.8.60:636
ldap_default_bind_dn = cn=admin,dc=clab,dc=lab
ldap_default_authtok = definitelyverysecurepassword
ldap_tls_reqcert = allow
ldap_tls_cacert = /usr/local/share/ca-certificates/mycacert.crt
ldap_tls_cacertdir = /usr/local/share/ca-certificates
ldap_tls_cert = /etc/ldap/ldapserver00_slapd_cert.pem
certificate_verification = no_verification
ldap_search_timeout = 50
ldap_network_timeout = 60
ldap_access_order = filter
ldap_access_filter = (objectClass=posixAccount)
override_homedir = /home/%U
override_shell = /bin/bash
ldap_user_name = uid
auto_private_groups = true
sudo_provider = none
ldap_account_expire_policy = nds
ldap_passwd_policy = shadow
9 months, 3 weeks