What sets the dataExpireTimestamp to 1 in the cache files ?
Should I file a bug ? Affected users cannot use sudo on certain hosts
# record 14
dn: name=stage,cn=groups,cn=DOMAIN2,cn=sysdb
createTimestamp: 1476812816
gidNumber: 16208
[....]
lastUpdate: 1476816339
[....]
*
**dataExpireTimestamp: 1*
root@stage ~ # sudo -U hfa-joswel-tehnicom -l
User hfa-joswel-tehnicom is not allowed to run sudo on stage.
root@stage ~ # sss_cache -E
root@stage ~ # sudo -U hfa-joswel-tehnicom -l
User hfa-joswel-tehnicom is not allowed to run sudo on stage.
root@stage ~ # id hfa-joswel-tehnicom
uid=116000059(hfa-joswel-tehnicom) gid=1003(....)
groups=16102(....),16009(....),16205(....),16208(stage),1003(....)
root@stage ~ # sudo -U hfa-joswel-tehnicom -l
Matching Defaults entries for hfa-joswel-tehnicom on this host:
env_keep+=SSH_AUTH_SOCK, logfile=/var/log/ldap-sudo.log,
loglinelen=0, log_year, log_host, syslog=auth, ignore_dot,
!mail_no_user, ignore_local_sudoers,
umask=0077, umask_override, always_set_home, env_keep="COLORS
DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1
PS2 QTDIR USERNAME LANG
LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
LC_PAPER LC_TELEPHONE",
env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin:/bin:/usr/sbin:/usr/bin,
badpass_message=Wrong password. I have noted your
incompetence in the log. Don't think you're fooling anyone.,
!requiretty, passprompt=LDAP OnePassword for %u:
User hfa-joswel-tehnicom may run the following commands on this host:
(ALL) PASSWD: ALL
On 10/20/2016 07:29 AM, Mario Rossi wrote:
Hi Jakub,
That is correct, I have 2 users, one is a member of DOMAIN1, the other
is a member of DOMAIN2. The options for both domains is similar as we
use automatic deployment system. One of the users is
hfa-joswel-tehnicom ( test account ), the other one is azapravdin.
I thought local domain is required, I use it to inject a local
emergency user on all servers. But I can remove local domain if it is
recommended.
Thank you
Mario
On 10/20/2016 03:36 AM, Jakub Hrozek wrote:
> On Wed, Oct 19, 2016 at 11:54:39AM -0400, Mario Rossi wrote:
>> Hi sssd-users list,
>>
>> I am facing a strange issue on several CentOS servers. It seems that after a
>> while ( days ) sudo does not work any more for some of my users. We keep
>> rudo rules in OpenLDAP. If a user uses 'sudo su - ' , he gets a an error
>> message ( "User abc is not allowed to run sudo on ....") however if he
user
>> runs 'id' followed by 'sudo su -' then in some of the cases, it
works
>> fine, user can get root access. I even upgraded to the unofficial repo
>> hoping that the issue we see is similar/same to
>>
https://fedorahosted.org/sssd/ticket/2970. But I think it's a different
>> issue.
>>
>> Any ideas? Next I will be looking at dumping the local sssd cache files. I
>> can provide debug =9 log files offline if needed.
> I think this is the best course of action..
>
> btw does the user come from DOMAIN1 or DOMAIN2?
>
> and do you need the local domain? It's really code that mostly has
> meaning for testing or experiments, I've never seen anyone using it in
> production..
>
>> Thank you
>>
>> root@server yum.repos.d # rpm -qa | egrep sssd
>> sssd-common-pac-1.13.4-4.el6.x86_64
>> sssd-ldap-1.13.4-4.el6.x86_64
>> sssd-tools-1.13.4-4.el6.x86_64
>> sssd-client-1.13.4-4.el6.x86_64
>> sssd-ad-1.13.4-4.el6.x86_64
>> python-sssdconfig-1.13.4-4.el6.noarch
>> sssd-common-1.13.4-4.el6.x86_64
>> sssd-ipa-1.13.4-4.el6.x86_64
>> sssd-proxy-1.13.4-4.el6.x86_64
>> sssd-krb5-common-1.13.4-4.el6.x86_64
>> sssd-krb5-1.13.4-4.el6.x86_64
>> sssd-1.13.4-4.el6.x86_64
>>
>> root@server sssd # vim /etc/sssd/sssd.conf # set debug = 9
>>
>> root@server sssd # sudo -U abc -l*
>> **User abc is not allowed to run sudo on **server**.*
>>
>> root@server sssd # egrep sudo /etc/nsswitch.conf
>> sudoers: sss
>>
>> root@server sssd # ip a s dev eth0 | egrep global
>> inet 216.X.Y.Z/26 brd 216.X.Y.Z scope global eth0
>>
>>
>> root@server sssd # id abc
>> uid=100001044(abc) gid=1009(...)
groups=1202(...),1168(...),1191(...),1102(...),1009(...),1101(...),1127(...),1167(...),1111(...),1178(...),1109(...),1199(...),1208(stage),1117(...),1198(...),1192(...),1206(...),1176(...),1404(...),1183(...),1103(...),1110(...),1205
>>
>> root@abc sssd # sudo -U abc -l
>> Matching Defaults entries for abc on this host:
>> [...]
>>
>> *User **abc**may run the following commands on this host:**
>> ** (ALL) PASSWD: ALL*
>>
>>
>> # LDAP Sudo def
>> dn: cn=stage,ou=sudoers,o=Domain,dc=domain,dc=com
>> sudoOrder: 42
>> [...]
>> sudoUser: %stage
>> sudoRunAs: ALL
>> cn: stage
>> description: Allow Trusted Senior stuff become root
>> sudoCommand: ALL
>> sudoHost: 216.X.Y.Z
>> [...]
>> objectClass: top
>> objectClass: sudoRole
>> sudoOption: authenticate
>>
>>
>>
>> # Group def
>> dn: cn=stage,ou=groups,o=Domain,dc=domain,dc=com
>> gidNumber: 1208
>> cn: stage
>> description: stage Group
>> objectClass: posixGroup
>> objectClass: top
>> memberUid: abc
>> hMemberDN: uid=abc,ou=users,o=Domain,dc=domain,dc=com
>>
>>
>> Sanitized sssd.conf:
>>
>> [sssd]
>> config_file_version = 2
>> sbus_timeout = 30
>> services = nss, pam, sudo, ssh
>> domains = LOCAL, DOMAIN1, DOMAIN2
>>
>> [nss]
>> filter_users =
adm,apache,avahi,bin,daemon,dbus,ecryptfs,ftp,git,games,gopher,haldaemon,halt,hfallback,ldap,lp,mail,mailnull,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,oprofile,ossec,postfix,puppet,puppet-dashboard,pulse,pulse-access,radiusd,root,rpc,rpcuser,rtkit,saslauth,sfallback,shutdown,slocate,smmsp,sshd,sync,tcpdump,tss,uucp,vcsa
>> filter_groups =
adm,apache,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,ecryptfs,floppy,fuse,git,hfallback,kmem,ldap,lock,lp,mail,mailnull,man,mem,nfsnobody,nobody,nscd,ntp,ossec,oprofile,postdrop,postfix,puppet,puppet-dashboard,pulse,pulse-access,root,rpc,rpcuser,rtkit,saslauth,sfallback,slocate,smmsp,sshd,sys,tape,tcpdump,tss,tty,users,utempter,utmp,vcsa,video
>> override_shell = /bin/bash
>>
>> [pam]
>> debug_level = 3
>> reconnection_retries = 3
>> offline_credentials_expiration = 2
>> offline_failed_login_attempts = 3
>> offline_failed_login_delay = 5
>> pam_verbosity = 1
>> pam_pwd_expiration_warning = 21
>> pam_account_expired_message = Account expired, please use selfservice portal
>> to change your password and extend account.
>>
>> [sudo]
>> debug_level=9
>>
>> [ssh]
>> # debug_level=9
>>
>> [domain/LOCAL]
>> description = LOCAL Users domain
>> id_provider = local
>> enumerate = true
>> min_id = 500
>> max_id = 999
>> default_shell = /bin/bash
>> base_directory = /home
>> create_homedir = false
>> remove_homedir = true
>> homedir_umask = 077
>> skel_dir = /etc/skel
>> mail_dir = /var/spool/mail
>>
>>
>> ######### SECTION: DOMAIN1
>> [domain/DOMAIN1]
>> min_id = 499
>> debug_level = 9
>> cache_credentials = True
>> entry_cache_timeout = 864000
>>
>> auth_provider = ldap
>> id_provider = ldap
>> access_provider = ldap
>> #chpass_provider = ldap
>> sudo_provider = ldap
>> selinux_provider = none
>> autofs_provider = none
>>
>>
>> # LDAP Search
>> ldap_search_base = dc=domain,dc=com
>> ldap_group_search_base = ou=groups,o=Domain,dc=domain,dc=com
>> ldap_user_search_base =
ou=users,o=Domain,dc=domain,dc=com?subtree?(|(description=cn=stage,ou=groups,o=Domain,dc=domain,dc=com)(.....)(.....))
>>
>>
>> # LDAP Custom Schema
>> ldap_group_member = hMemberDN
>> ldap_user_member_of = description
>> # this should really be rfc2307
>> ldap_schema = rfc2307bis
>>
>> ldap_network_timeout = 3
>> ldap_id_use_start_tls = False
>> ldap_tls_reqcert = never
>> ldap_tls_cacertdir = /etc/openldap/cacerts
>>
>> ldap_uri =ldaps://s1.sec.domain.com,ldaps://s2.sec.domain.com,
>>
ldaps://s3.sec.domain.com
>> ldap_backup_uri =ldaps://66.X.Y.Z
>>
>> ldap_default_authtok_type = obfuscated_password
>> ldap_default_bind_dn = uid=MYDN
>> ldap_default_authtok = MYPASS
>>
>>
>> ldap_user_ssh_public_key = sshPublicKey
>>
>> ldap_pwd_policy = none
>> ldap_account_expire_policy = shadow
>> ldap_user_shadow_expire = shadowExpire
>> # shadowExpire: days since Jan 1, 1970 that account is disabled: $ echo
>> $(($(date --utc --date "$1" +%s)/86400))
>>
>> ldap_chpass_update_last_change = false
>>
>> ldap_access_order = filter, expire
>> ldap_access_filter =
(&(objectClass=posixAccount)(uidNumber=*)(hAccountInitialSetup=1)(|(description=cn=stage,ou=groups,o=Domain,dc=domain,dc=com)))
>>
>> # SUDO
>> ldap_sudo_search_base = ou=sudoers,o=Domain,dc=domain,dc=com
>> ldap_sudo_full_refresh_interval = 86400
>> ldap_sudo_smart_refresh_interval = 3600
>> #entry_cache_sudo_timeout = 5400
>>
>> The same options for DOMAIN2 except filters and user/group base.
>>
>> hMemberDN is defined in nis.schema, a relic of OpenLDAP 2.2, a workaround
>> applied before transitioning to 2.4.40.
>>
>> # Modification to posixGroup
>> attributetype ( 1.3.6.1.1.1.1.28 NAME 'hMemberDN'
>> DESC 'RFC2256: member of a group'
>> SUP distinguishedName )
>>
>> objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup'
>> DESC 'Abstraction of a group of accounts'
>> SUP top STRUCTURAL
>> MUST ( cn $ gidNumber )
>> MAY ( userPassword $ memberUid $ hMemberDN $ description ) )
>>
>> hMemberDN: uid=abc,ou=users,o=Domain,dc=domain,dc=com
>>
>>
>>
>>
>> _______________________________________________
>> sssd-users mailing list --sssd-users(a)lists.fedorahosted.org
>> To unsubscribe send an email tosssd-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> sssd-users mailing list --sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email tosssd-users-leave(a)lists.fedorahosted.org
>
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org