Hi, I want to warn users when password expiration days are less than 14 days.
I have GPO Default domain policy with this number of days. I have sssd.conf as:
[sssd] domains = internal.domain.tld config_file_version = 2 services = nss, pam
[domain/internal.domain.tld] cache_credentials = True debug_level = 6 id_provider = ad auth_provider = ad access_provider = ad
default_shell = /bin/bash fallback_homedir = /home/%d/%u ldap_id_mapping = True ldap_schema = ad enumerate = True ad_site=internal1
ad_gpo_access_control = permissive
ad_gpo_ignore_unreadable = True
And pam.d as follow:
#%PAM-1.0
auth sufficient pam_sss.so forward_pass auth required pam_unix.so try_first_pass nullok auth optional pam_permit.so auth required pam_env.so #auth requisite pam_deny.so
account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_sss.so account optional pam_permit.so account required pam_time.so
password required pam_unix.so try_first_pass nullok sha512 shadow password sufficient pam_sss.so use_authok password optional pam_permit.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 session required pam_limits.so session required pam_unix.so session optional pam_sss.so session optional pam_permit.so
User has password valid till 20.02.2020 and yet I don't have any warning. I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control = permissive to my config because without it I end up with "System error" during login and unsuccessful login.
In gpo_cache I see Machine gpo with lines:
[Registry Values] MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
Any idea how to turn on this warning?
Thanks for your help! ----- Best regards, Pawel
On Thu, Feb 11, 2021 at 06:47:46PM +0100, Paweł Szafer wrote:
Hi, I want to warn users when password expiration days are less than 14 days.
I have GPO Default domain policy with this number of days. I have sssd.conf as:
Hi,
although you define the password policy in AD with GPOs SSSD is using the information received during Kerberos authentication but by default it is not displayed.
Please try to set
pam_pwd_expiration_warning = 14
in the [pam] section of sssd.conf and restart SSSD, see man sssd.conf for details.
HTH
bye, Sumit
[sssd] domains = internal.domain.tld config_file_version = 2 services = nss, pam
[domain/internal.domain.tld] cache_credentials = True debug_level = 6 id_provider = ad auth_provider = ad access_provider = ad
default_shell = /bin/bash fallback_homedir = /home/%d/%u ldap_id_mapping = True ldap_schema = ad enumerate = True ad_site=internal1
ad_gpo_access_control = permissive
ad_gpo_ignore_unreadable = True
And pam.d as follow:
#%PAM-1.0
auth sufficient pam_sss.so forward_pass auth required pam_unix.so try_first_pass nullok auth optional pam_permit.so auth required pam_env.so #auth requisite pam_deny.so
account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_sss.so account optional pam_permit.so account required pam_time.so
password required pam_unix.so try_first_pass nullok sha512 shadow password sufficient pam_sss.so use_authok password optional pam_permit.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 session required pam_limits.so session required pam_unix.so session optional pam_sss.so session optional pam_permit.so
User has password valid till 20.02.2020 and yet I don't have any warning. I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control = permissive to my config because without it I end up with "System error" during login and unsuccessful login.
In gpo_cache I see Machine gpo with lines:
[Registry Values] MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
Any idea how to turn on this warning?
Thanks for your help!
Best regards, Pawel
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Hi,
I added:
pwd_expiration_warning=14 to domain section
and to pam section:
pam_pwd_expiration_warning=14
but still no warning at all.
----- Best regards, Pawel
pt., 12 lut 2021 o 09:39 Sumit Bose sbose@redhat.com napisał(a):
On Thu, Feb 11, 2021 at 06:47:46PM +0100, Paweł Szafer wrote:
Hi, I want to warn users when password expiration days are less than 14 days.
I have GPO Default domain policy with this number of days. I have sssd.conf as:
Hi,
although you define the password policy in AD with GPOs SSSD is using the information received during Kerberos authentication but by default it is not displayed.
Please try to set
pam_pwd_expiration_warning = 14in the [pam] section of sssd.conf and restart SSSD, see man sssd.conf for details.
HTH
bye, Sumit
[sssd] domains = internal.domain.tld config_file_version = 2 services = nss, pam
[domain/internal.domain.tld] cache_credentials = True debug_level = 6 id_provider = ad auth_provider = ad access_provider = ad
default_shell = /bin/bash fallback_homedir = /home/%d/%u ldap_id_mapping = True ldap_schema = ad enumerate = True ad_site=internal1
ad_gpo_access_control = permissive
ad_gpo_ignore_unreadable = True
And pam.d as follow:
#%PAM-1.0
auth sufficient pam_sss.so forward_pass auth required pam_unix.so try_first_pass nullok auth optional pam_permit.so auth required pam_env.so #auth requisite pam_deny.so
account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_sss.so account optional pam_permit.so account required pam_time.so
password required pam_unix.so try_first_pass nullok sha512 shadow password sufficient pam_sss.so use_authok password optional pam_permit.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 session required pam_limits.so session required pam_unix.so session optional pam_sss.so session optional pam_permit.so
User has password valid till 20.02.2020 and yet I don't have any warning. I had to add ad_gpo_ignore_unreadable = True and ad_gpo_access_control = permissive to my config because without it I end up with "System error" during login and unsuccessful login.
In gpo_cache I see Machine gpo with lines:
[Registry Values] MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
Any idea how to turn on this warning?
Thanks for your help!
Best regards, Pawel
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com wrote:
User has password valid till 20.02.2020 and yet I don't have any warning.
Is that just a typo? 20.02.2020 is a year ago...
Tomas
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the sssd logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com wrote:
User has password valid till 20.02.2020 and yet I don't have any warning.
Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
only thing I see about password expiration in logs are
confdb_get_domain_internal] (0x0100): Setting domain password expiration warning to 14 days ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [dp_get_options] (0x0400): Option account_cache_expiration has value 0 ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [dp_get_options] (0x0400): Option ldap_account_expire_policy has value ad ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [dp_get_options] (0x0400): Option ldap_connection_expire_timeout has value 900 ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [dp_get_options] (0x0400): Option ldap_connection_expire_offset has value 0 ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [sdap_get_map] (0x0400): Option ldap_user_shadow_expire has no value ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [sdap_get_map] (0x0400): Option ldap_user_krb_password_expiration has no value
./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [sdap_get_map] (0x0400): Option ldap_user_ad_account_expires has value accountExpires ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [sdap_get_map] (0x0400): Option ldap_user_nds_login_expiration_time has no value ./sssd_internal.domain.tld.log:(2021-02-11 18:43:58): [be[internal.domain.tld]] [sdap_get_tgt_recv] (0x0400): Child responded: 0 [FILE:/var/lib/sss/db/ccache_internal.domain.tld], expired on [16 13101438]
This is what I see in domain controller [image: image.png] ---- Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the sssd logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com wrote:
User has password valid till 20.02.2020 and yet I don't have any warning.
Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Hi again, I installed Centos 8 to test if warning is working and on Centos it is working properly.
In Arch I never get line with check "sss_krb5_expire_callback_func"
Here are logs and config compared: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't attach it to email, too big). Maybe you can find out if it's something with config or maybe Arch compilation of krb5 or sssd.
----- Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the sssd logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com wrote:
User has password valid till 20.02.2020 and yet I don't have any warning.
Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
Hi again, I installed Centos 8 to test if warning is working and on Centos it is working properly.
In Arch I never get line with check "sss_krb5_expire_callback_func"
Here are logs and config compared: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't attach it to email, too big). Maybe you can find out if it's something with config or maybe Arch compilation of krb5 or sssd.
Hi,
this might be possible. If seen in https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/PKG... the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would explain the missing krb5 trace messages in the logs.
The expiration callback is used conditionally, but the related call is available since MIT Kerberos version 1.9. Can you check the configure output
...... checking for krb5_get_error_message... yes checking for krb5_free_unparsed_name... yes checking for krb5_get_init_creds_opt_set_expire_callback... yes <<<---- checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes checking for krb5_get_init_creds_opt_set_fast_flags... yes checking for krb5_get_init_creds_opt_set_canonicalize... yes ......
But even if krb5_get_init_creds_opt_set_expire_callback is not available I would expect a message in the debug logs.
In krb5.conf on Arch there is
[libdefaults] udp_preference_limit = 0
which is not present on Centos. I wonder if you can comment out those two lines for testing. I would be surprised if this would change anything but it is the only difference which might be related.
bye, Sumit
Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the sssd logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com wrote:
User has password valid till 20.02.2020 and yet I don't have any warning.
Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Thanks for the response!
Commenting out "udp_preference_limit" doesn't change anything unfortunately... I will rebuild sssd from source, so I can get more meaningful logs.
----- Pawel
wt., 16 lut 2021 o 17:20 Sumit Bose sbose@redhat.com napisał(a):
On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
Hi again, I installed Centos 8 to test if warning is working and on Centos it is working properly.
In Arch I never get line with check "sss_krb5_expire_callback_func"
Here are logs and config compared: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't attach it to email, too big). Maybe you can find out if it's something with config or maybe Arch compilation of krb5 or sssd.
Hi,
this might be possible. If seen in
https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/PKG... the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would explain the missing krb5 trace messages in the logs.
The expiration callback is used conditionally, but the related call is available since MIT Kerberos version 1.9. Can you check the configure output
...... checking for krb5_get_error_message... yes checking for krb5_free_unparsed_name... yes checking for krb5_get_init_creds_opt_set_expire_callback... yes <<<---- checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes checking for krb5_get_init_creds_opt_set_fast_flags... yes checking for krb5_get_init_creds_opt_set_canonicalize... yes ......
But even if krb5_get_init_creds_opt_set_expire_callback is not available I would expect a message in the debug logs.
In krb5.conf on Arch there is
[libdefaults] udp_preference_limit = 0
which is not present on Centos. I wonder if you can comment out those two lines for testing. I would be surprised if this would change anything but it is the only difference which might be related.
bye, Sumit
Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the
sssd
logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com
wrote:
User has password valid till 20.02.2020 and yet I don't have any warning.
Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Hi, I built and installed sssd from sources. I got more logs: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa#file-krb5_c...
Is this important? -> "PKINIT client has no configured identity; giving up" In Centos there are lines in krb5 conf, I think this is the reason above is giving up.
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake_preauth_groups = edwards25519
Are those important?
This function is never called in Arch (line is from centos):
[krb5_child[50670]] [sss_krb5_expire_callback_func] (0x2000): exp_time: [375772]
How to find why this function is never called?
----- Pawel
wt., 16 lut 2021 o 17:38 Paweł Szafer pszafer@gmail.com napisał(a):
Thanks for the response!
Commenting out "udp_preference_limit" doesn't change anything unfortunately... I will rebuild sssd from source, so I can get more meaningful logs.
Pawel
wt., 16 lut 2021 o 17:20 Sumit Bose sbose@redhat.com napisał(a):
On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
Hi again, I installed Centos 8 to test if warning is working and on Centos it is working properly.
In Arch I never get line with check "sss_krb5_expire_callback_func"
Here are logs and config compared: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't attach it to email, too big). Maybe you can find out if it's something with config or maybe Arch compilation of krb5 or sssd.
Hi,
this might be possible. If seen in
https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/PKG... the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would explain the missing krb5 trace messages in the logs.
The expiration callback is used conditionally, but the related call is available since MIT Kerberos version 1.9. Can you check the configure output
...... checking for krb5_get_error_message... yes checking for krb5_free_unparsed_name... yes checking for krb5_get_init_creds_opt_set_expire_callback... yes <<<---- checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes checking for krb5_get_init_creds_opt_set_fast_flags... yes checking for krb5_get_init_creds_opt_set_canonicalize... yes ......
But even if krb5_get_init_creds_opt_set_expire_callback is not available I would expect a message in the debug logs.
In krb5.conf on Arch there is
[libdefaults] udp_preference_limit = 0
which is not present on Centos. I wonder if you can comment out those two lines for testing. I would be surprised if this would change anything but it is the only difference which might be related.
bye, Sumit
Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the
sssd
logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com
wrote:
> User has password valid till 20.02.2020 and yet I don't have any > warning. >
Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On Wed, Feb 17, 2021 at 12:43:09PM +0100, Paweł Szafer wrote:
Hi, I built and installed sssd from sources. I got more logs: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa#file-krb5_c...
Is this important? -> "PKINIT client has no configured identity; giving up" In Centos there are lines in krb5 conf, I think this is the reason above is giving up.
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake_preauth_groups = edwards25519
Are those important?
This function is never called in Arch (line is from centos):
[krb5_child[50670]] [sss_krb5_expire_callback_func] (0x2000): exp_time: [375772]
How to find why this function is never called?
Hi,
it looks like I'm getting old, I forgot about https://krbdev.mit.edu/rt/Ticket/Display.html?id=8893 which is an issue in MIT Kerberos which should be fixed in 1.19 but might not yet fixed in Arch Linux.
As a workaround you can try to use 'auth_provider = krb5' but please note the different defaults for krb5_validate and krb5_use_enterprise_principal as mentioned in man sssd-ad.
With 'auth_provider = ad' some different MIT Kerberos APIs are used to get more details from AD, unfortunately due to #8893 the expiration time is lost in this case.
HTH
bye, Sumit
Pawel
wt., 16 lut 2021 o 17:38 Paweł Szafer pszafer@gmail.com napisał(a):
Thanks for the response!
Commenting out "udp_preference_limit" doesn't change anything unfortunately... I will rebuild sssd from source, so I can get more meaningful logs.
Pawel
wt., 16 lut 2021 o 17:20 Sumit Bose sbose@redhat.com napisał(a):
On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
Hi again, I installed Centos 8 to test if warning is working and on Centos it is working properly.
In Arch I never get line with check "sss_krb5_expire_callback_func"
Here are logs and config compared: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa (can't attach it to email, too big). Maybe you can find out if it's something with config or maybe Arch compilation of krb5 or sssd.
Hi,
this might be possible. If seen in
https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/PKG... the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would explain the missing krb5 trace messages in the logs.
The expiration callback is used conditionally, but the related call is available since MIT Kerberos version 1.9. Can you check the configure output
...... checking for krb5_get_error_message... yes checking for krb5_free_unparsed_name... yes checking for krb5_get_init_creds_opt_set_expire_callback... yes <<<---- checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes checking for krb5_get_init_creds_opt_set_fast_flags... yes checking for krb5_get_init_creds_opt_set_canonicalize... yes ......
But even if krb5_get_init_creds_opt_set_expire_callback is not available I would expect a message in the debug logs.
In krb5.conf on Arch there is
[libdefaults] udp_preference_limit = 0
which is not present on Centos. I wonder if you can comment out those two lines for testing. I would be surprised if this would change anything but it is the only difference which might be related.
bye, Sumit
Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in the
sssd
logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman thalman@redhat.com napisał:
On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com
wrote:
> > > User has password valid till 20.02.2020 and yet I don't have any >> warning. >> > Is that just a typo? 20.02.2020 is a year ago...
Tomas _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Hi,
Thanks for the response! I thought that there was no hope... Arch krb5 is outdated https://archlinux.org/packages/core/x86_64/krb5/. I'll wait for 1.19 and post back with the result.
----- Pawel
wt., 2 mar 2021 o 18:27 Sumit Bose sbose@redhat.com napisał(a):
On Wed, Feb 17, 2021 at 12:43:09PM +0100, Paweł Szafer wrote:
Hi, I built and installed sssd from sources. I got more logs:
https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa#file-krb5_c...
Is this important? -> "PKINIT client has no configured identity; giving
up"
In Centos there are lines in krb5 conf, I think this is the reason above
is
giving up.
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake_preauth_groups = edwards25519
Are those important?
This function is never called in Arch (line is from centos):
[krb5_child[50670]] [sss_krb5_expire_callback_func] (0x2000): exp_time: [375772]
How to find why this function is never called?
Hi,
it looks like I'm getting old, I forgot about https://krbdev.mit.edu/rt/Ticket/Display.html?id=8893 which is an issue in MIT Kerberos which should be fixed in 1.19 but might not yet fixed in Arch Linux.
As a workaround you can try to use 'auth_provider = krb5' but please note the different defaults for krb5_validate and krb5_use_enterprise_principal as mentioned in man sssd-ad.
With 'auth_provider = ad' some different MIT Kerberos APIs are used to get more details from AD, unfortunately due to #8893 the expiration time is lost in this case.
HTH
bye, Sumit
Pawel
wt., 16 lut 2021 o 17:38 Paweł Szafer pszafer@gmail.com napisał(a):
Thanks for the response!
Commenting out "udp_preference_limit" doesn't change anything unfortunately... I will rebuild sssd from source, so I can get more meaningful logs.
Pawel
wt., 16 lut 2021 o 17:20 Sumit Bose sbose@redhat.com napisał(a):
On Tue, Feb 16, 2021 at 03:46:38PM +0100, Paweł Szafer wrote:
Hi again, I installed Centos 8 to test if warning is working and on Centos it
is
working properly.
In Arch I never get line with check "sss_krb5_expire_callback_func"
Here are logs and config compared: https://gist.github.com/pszafer/7ab47cd7d4de05f965f4c8e9985af8fa
(can't
attach it to email, too big). Maybe you can find out if it's something with config or maybe Arch compilation of krb5 or sssd.
Hi,
this might be possible. If seen in
https://github.com/archlinux/svntogit-community/blob/packages/sssd/trunk/PKG...
the HAVE_KRB5_SET_TRACE_CALLBACK is removed from config.h which would explain the missing krb5 trace messages in the logs.
The expiration callback is used conditionally, but the related call is available since MIT Kerberos version 1.9. Can you check the configure output
...... checking for krb5_get_error_message... yes checking for krb5_free_unparsed_name... yes checking for krb5_get_init_creds_opt_set_expire_callback... yes <<<---- checking for krb5_get_init_creds_opt_set_fast_ccache_name... yes checking for krb5_get_init_creds_opt_set_fast_flags... yes checking for krb5_get_init_creds_opt_set_canonicalize... yes ......
But even if krb5_get_init_creds_opt_set_expire_callback is not
available
I would expect a message in the debug logs.
In krb5.conf on Arch there is
[libdefaults] udp_preference_limit = 0
which is not present on Centos. I wonder if you can comment out those two lines for testing. I would be surprised if this would change anything but it is the only difference which might be related.
bye, Sumit
Pawel
pon., 15 lut 2021 o 11:13 Paweł Szafer pszafer@gmail.com
napisał(a):
yes, typo, sorry. It's valid till 20.02.2021. Unfortunately I cannot find anything about password expiration in
the
sssd
logs.
Pawel
pon., 15 lut 2021, 11:08 użytkownik Tomas Halman <
thalman@redhat.com>
napisał:
> > > On Sat, Feb 13, 2021 at 6:22 PM Paweł Szafer pszafer@gmail.com
wrote:
> >> >> > User has password valid till 20.02.2020 and yet I don't have
any
>>> warning. >>> >> > Is that just a typo? 20.02.2020 is a year ago... > > Tomas > _______________________________________________ > sssd-users mailing list -- sssd-users@lists.fedorahosted.org > To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: >
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
> Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure >
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to
sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
sssd-users@lists.fedorahosted.org
-
Paweł Szafer -
Sumit Bose -
Tomas Halman