On Mon, Aug 15, 2016 at 11:33:31AM -0400, Douglas Duckworth wrote:
Thank you Jakub
I understand what we're doing isn't supported and horrible practice. We
are replacing the insecure LDAP server very soon.
I set ldap_uri = ldap://BLAH in sssd.conf and seems to be working despite
expired cert. Though there are some error messages I would like to resolve.
We are using host-based access control:
auth_provider = ldap
access_provider = ldap
ldap_access_order = host
ldap_user_authorized_host = host
As you can see sdap_access_host does grant access to accounts with the host
attribute:
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'LDAP'
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100):
expire timeout is 900
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100):
Marking port 389 of server 'BLAH' as 'working'
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [set_server_common_status]
(0x0100): Marking server 'BLAH as 'working'
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100):
Request processed. Returned 0,0,Success
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100):
Request processed. Returned 0,0,Success
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got
request with the following data
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
command: SSS_PAM_ACCT_MGMT
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
domain: LDAP
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
user: sysadmin
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
service: sshd
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty:
ssh
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
ruser:
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
rhost: proxy
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
authtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
newauthtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
priv: 1
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
cli_pid: 11864
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
logon name: not set
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_access_host] (0x0100):
Access granted for [CLIENT]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback]
(0x0100): Backend returned: (0, 0, <NULL>) [Success]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback]
(0x0100): Sending result [0][LDAP]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback]
(0x0100): Sent result [0][LDAP]
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got
request with the following data
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
command: SSS_PAM_ACCT_MGMT
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
domain: LDAP
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
user: sysadmin
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
service: sshd
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty:
ssh
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
ruser:
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
rhost: proxy
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
authtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
newauthtok type: 0
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
priv: 1
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
cli_pid: 11864
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100):
logon name: not set
(Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_access_host] (0x0100):
Access granted for [CLIENT]
Though right before the above successful login we see:
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100):
Marking port 389 of server 'BLAH as 'working'
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [set_server_common_status]
(0x0100): Marking server 'BLAH' as 'working'
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_get_generic_op_finished]
(0x0040): Unexpected result from ldap: Protocol error(2), paged results
cookie is invalid
This is a different issue now. It looks like the server does not support
paged searches correctly or has issues with the paging support, because
it sends an invalid cookie (the invalid cookie message is reported by
openldap-libs..)
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]]
[generic_ext_search_handler]
(0x0040): sdap_get_generic_ext_recv failed [5]: Input/output error
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040):
Failed to retrieve users
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_dom_enum_ex_users_done]
(0x0040): User enumeration failed: 5: Input/output error
(Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [be_ptask_done] (0x0040): Task
[enumeration]: failed with [5]: Input/output error
Does this mean that enumeration occurs not with SSSD but NSS?
Enumeration has two parts. One is in SSSD where SSSD periodically
downloads all users and groups from the LDAP server and stores them in
the cache. The other part is support in the nss_sss NSS module that
tells the sss_nss process to fetch all entries in the cache and returns
them to the NSS module which returns them to the system.
But the problem seems to be on the LDAP server side..
I wonder if it would be possible to increase the page size with the
ldap_page_size option to make the enumeration results fit into one page?