Do any commercial NAS vendors use the SSD ID mapping algorithm?
by mythmail@runbox.com
Hello,
I work in an enterprise environment which has both Linux and Windows systems and an Active Directory for identity.
For good reasons we need to move from Linux based file servers to a NAS. The problem is that all our Linux systems use the SSD ID mapping algorithm to calculate UID and GIDs (and it works great!). We've not found a commercial NAS vendor who supports this algorithm so we can't just drop their products in place.
Do you know of any who do please?
Surely there must be some as many NASs run on Linux and BSD and use open source software heavily.
My colleague asked this in a GitHub issue [1] but I thought that it might be best to ask here.
Thanks in advance!
Ed.
[1]: https://github.com/SSSD/sssd/issues/6126
1 year
Using SSSD in a road warrior setup; update cached credentials problem
by David Wittwer
Hi everyone
In a small business solution, I'd like to setup a road warrior solution like so:
Step #1: User logs in to their ubuntu laptop. SSSD is configured to authenticate the user against LDAP but is not yet connected to the VPN. Works with cached credentials. Password cache is set to 10 days.
Step #2: User starts VPN client and they then have access to company resources such as LDAP. Works.
Step #3: SSSD updates the cached password as soon as LDAP is available. Cache timeout shall reset to the full 10 days once the user (and their laptop) is on the VPN.
With this setup, it should be enforced that the user needs to login to the VPN at least every 10 days.
I've got a problem with step #3: How can I force SSSD to renew the cached password of the user as soon as the LDAP server becomes available? (As mentioned, the VPN connection is activated *after* the user logs in.)
Thanks for every hint or stories war stories on how to treat workstations with temporary connection to the auth backend.
Client OS: Ubuntu 20.04 (soon 22.04)
sssd: 2.4.1
1 year, 1 month
Debian user for sssd with AD
by Matt Zagrabelny
Greetings,
I haven't started using sssd yet, but am excited to do so.
I have a bunch of Debian clients that I'd like to use/test against an AD
controller.
I'm assuming other folks have done such configurations. I'm afraid I don't
know exactly which packages I'll need to install to have sss(d) perform the
nsswitch'ing. I've read that sssd has a local cache in case the connection
to the LDAP directory fails.
Can anyone point me in the right direction regarding what packages I'll
need or perhaps a HOWTO document on the internet? I've seen a few
Redhat/Fedora docs - which I can translate/interpret for Debian as needed,
but was wondering if there was a somewhat condensed version for simply
setting up a (Debian) client.
Thanks for any pointers and for helping out a newcomer.
-m
1 year, 1 month
[SSSD] Announcing SSSD 2.7.0
by Pavel Březina
# SSSD 2.7.0
The SSSD team is proud to announce the release of version 2.7.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.7.0
See the full release notes at:
https://sssd.io/release-notes/sssd-2.7.0.html
RPM packages will be made available for Fedora shortly.
## New pgp key
So far we have been signing each release with our personal keys.
Starting from this release (including) we have switched to the new
project key that is used to sign our release tarball.
- Key ID: C13CD07FFB2DB1408E457A3CD3D21B2910CF6759
- URL: https://github.com/SSSD/sssd/blob/2.7.0/contrib/pubkey.asc
- Keyserver: keys.openpgp.org
## Changes release process
We have switched to a more aggressive release process since the release
of 2.0, where we were trying to publish new features even on every .z
release. From now on, we want to switch the process again to prioritize
stabilization of each released version. Therefore .z releases will
rather focus more on publishing bug fixes and will receive none or only
very few carefully selected new features.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### New features
* Added a new krb5 plugin `idp` and a new binary `oidc_child` which
performs **OAuth2** authentication against FreeIPA. This, however, can
not be tested yet because this feature is still under development on
the FreeIPA server side. Nevertheless, we have decided to include this
in the release in order to enable the functionality on the clients
immediately when the FreeIPA project delivers this feature without the
need to update the clients.
### General information
* Better default for IPA/AD re_expression. Tunning for group names
containing '@' is no longer needed.
* A warning is added in the logs if an LDAP operation needs more than
80% of the configured timeout.
* A new debug level is added to show statistical and performance data.
Currently the duration of a backend request and of single LDAP
operations are recorded if debug_level is set to 9 or the bit 0x20000 is
set.
* Added support for anonymous PKINIT to get FAST credentials
* We have many warnings and errors from static analyzers
### Important fixes
* SSSD now correctly falls back to UPN search if the user was not found
even with `cache_first = true`.
### Packaging changes
* Added new configure option `--with-oidc-child` and
`--without-oidc-child` to control build of `oidc_child` (enabled by
default).
* Added new package `sssd-idp` that contains the `oidc_child` and krb5
`idp` plugin, this package is required by `sssd-ipa`.
1 year, 1 month
GPO Access Control Failing: ini_config_file_open failed [84][Invalid or incomplete multibyte or wide character]
by lingyuan zhu
1、SSSD version:
sssd-common-1.16.5-10.el7_9.12.x86_64
sssd-ldap-1.16.5-10.el7_9.12.x86_64
sssd-ad-1.16.5-10.el7_9.12.x86_64
sssd-client-1.16.5-10.el7_9.12.x86_64
python-sssdconfig-1.16.5-10.el7_9.12.noarch
sssd-krb5-common-1.16.5-10.el7_9.12.x86_64
sssd-ipa-1.16.5-10.el7_9.12.x86_64
sssd-krb5-1.16.5-10.el7_9.12.x86_64
sssd-1.16.5-10.el7_9.12.x86_64
sssd-common-pac-1.16.5-10.el7_9.12.x86_64
sssd-proxy-1.16.5-10.el7_9.12.x86_64
2、 SSSD Configuration
[sssd]
domains = adtest.zly.com
config_file_version = 2
services = nss, pam
[domain/adtest.zly.com]
ad_server = adtest.adtest.zly.com
ad_domain = adtest.zly.com
krb5_realm = ADTEST.ZLY.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = true
use_fully_qualified_names = false
fallback_homedir = /home/%u
access_provider = ad
debug_level=9
ad_gpo_access_control=enforcing
#ad_gpo_access_control=permissive
3、error log
Error in /var/log/secure :
Apr 12 15:28:15 wxvmlinux sshd[3784]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=njadmin
Apr 12 15:28:15 wxvmlinux sssd[be[adtest.zly.com]]: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode.
Apr 12 15:28:15 wxvmlinux sshd[3784]: Accepted password for njadmin from ::1 port 49040 ssh2
Apr 12 15:28:15 wxvmlinux sshd[3784]: pam_unix(sshd:session): session opened for user njadmin by (uid=0)
Apr 12 15:28:24 wxvmlinux sshd[3836]: Received disconnect from ::1 port 49040:11: disconnected by user
Apr 12 15:28:24 wxvmlinux sshd[3836]: Disconnected from ::1 port 49040
Apr 12 15:28:24 wxvmlinux sshd[3784]: pam_unix(sshd:session): session closed for user njadmin
Apr 12 15:28:40 wxvmlinux polkitd[547]: Registered Authentication Agent for unix-process:3889:296012 (system bus name :1.57 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Apr 12 15:28:41 wxvmlinux polkitd[547]: Unregistered Authentication Agent for unix-process:3889:296012 (system bus name :1.57, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Apr 12 15:28:46 wxvmlinux sshd[3925]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=njadmin
Apr 12 15:28:46 wxvmlinux sshd[3925]: pam_sss(sshd:account): Access denied for user njadmin: 4 (System error)
Apr 12 15:28:46 wxvmlinux sshd[3925]: Failed password for njadmin from ::1 port 49084 ssh2
Apr 12 15:28:46 wxvmlinux sshd[3925]: fatal: Access denied for user njadmin by PAM account configuration [preauth]
/var/log/sssd/gpo_child.log
(2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0400): gpo_child started.
(2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0400): context initialized
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x0400): cached_gpt_version: -1
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_server length: 27
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_server: smb://adtest.adtest.zly.com
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_share length: 7
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_share: /SysVol
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_path length: 63
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_path: /adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_cse_suffix length: 49
(2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_cse_suffix: /Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf
(2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0400): performing smb operations
(2022-04-12 15:28:54): [gpo_child[3955]] [copy_smb_file_to_gpo_cache] (0x0400): smb_uri: smb://adtest.adtest.zly.com/SysVol/adtest.zly.com/Policies/{63899852-E3D6...
(2022-04-12 15:28:54): [gpo_child[3955]] [copy_smb_file_to_gpo_cache] (0x4000): smb_buflen: 50
(2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x4000): smb_path_with_suffix: /adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}/GPT.INI
(2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x0400): Storing GPOs in /var/lib/sss/gpo_cache/adtest.zly.com
(2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x0400): Storing GPOs in /var/lib/sss/gpo_cache/adtest.zly.com/Policies
(2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x0400): Storing GPOs in /var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}
(2022-04-12 15:28:54): [gpo_child[3955]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}/GPT.INIPUsDAW]
(2022-04-12 15:28:54): [gpo_child[3955]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}/GPT.INIPUsDAW]
(2022-04-12 15:28:54): [gpo_child[3955]] [ad_gpo_parse_ini_file] (0x0400): ini_filename:/var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D...
(2022-04-12 15:28:54): [gpo_child[3955]] [ad_gpo_parse_ini_file] (0x0020): ini_config_file_open failed [84][Invalid or incomplete multibyte or wide character]
(2022-04-12 15:28:54): [gpo_child[3955]] [ad_gpo_parse_ini_file] (0x0020): Error encountered: 84.
(2022-04-12 15:28:54): [gpo_child[3955]] [perform_smb_operations] (0x0020): Cannot parse ini file: [84][Invalid or incomplete multibyte or wide character]
(2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0020): perform_smb_operations failed.[84][Invalid or incomplete multibyte or wide character].
(2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0020): gpo_child failed!
4、Reproduction method
1) preparation
AD: windows server 2012 datacenter,
Configure AD Domain server, DNS Service
Configure domain: adtest.zly.com
Gpo policy: “computer configuration ==> strategy==>windows setting==>security setting==>local stategy==> Allow local login”, configure some user or group who have local login permission
Linux client: centos 7.9 or redhat 7.9
realm join adtest.zly.com
2) reproduction
Linux client:
[root@wxvmlinux sssd]# ssh -l wxadmin localhost
wxadmin@localhost's password:
Authentication failed.
1 year, 1 month
Using pam_sss to force the retrieval of a new TGT
by Francis Augusto Medeiros-Logeay
Hi,
Having some RHEL 8 machines as vdi on a VMware Horizon desktop pool, we see that when reconnecting to a machine, system-auth and its pam-stack is executed (at least I think so).
Is there a way to make pam_sss actually fetch a new TGT when doing so, just like entering a password when the screensaver does?
Best,
Francis
1 year, 1 month