[SSSD] SSSD Configuration issue

Nitesh Mehare nitesh26 at gmail.com
Mon Nov 21 13:43:11 UTC 2011


I tried putting debug level 9 pam section of sssd.conf
Below is the messages in sssd_pam.log


(Mon Nov 21 18:03:16 2011) [sssd[pam]] [server_setup] (3): CONFDB:
/var/lib/sss/db/config.ldb
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [confdb_get_domain_internal] (1): No
enumeration for [LDAP]!
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_init_connection] (5): Adding
connection 1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [monitor_common_send_id] (4):
Sending ID: (pam,1)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_timeout] (8): 0x1da9faf0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_init_connection] (5): Adding
connection 1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [dp_common_send_id] (4): Sending ID
to DP: (1,PAM)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_add_timeout] (8): 0x1daa1fb0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sysdb_domain_init_internal] (5): DB
File for LDAP: /var/lib/sss/db/cache_LDAP.ldb
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [ldb] (9): trying to load memberof
from /usr/lib64/ldb/memberof.so
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [ldb] (6): asq: Unable to register
control with rootdse!
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sss_process_init] (1): Responder
Initialization complete
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0490 (17), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1daa1b10/0x1daa0440 (17), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_remove_timeout] (8): 0x1daa1fb0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DAA1280
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [dp_id_callback] (4): Got id ack and
version (1) from DP
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9eab0 (16), R/- (enabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_toggle_watch] (8):
0x1da9f740/0x1da9ea60 (16), -/W (disabled)
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_remove_timeout] (8): 0x1da9faf0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:16 2011) [sssd[pam]] [id_callback] (4): Got id ack and
version (1) from Monitor
(Mon Nov 21 18:03:25 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:26 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:26 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:03:36 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:36 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:36 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:03:46 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:46 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:46 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:03:56 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:03:56 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:03:56 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]
(Mon Nov 21 18:04:05 2011) [sssd[pam]] [sbus_dispatch] (9): dbus conn:
1DA9EFF0
(Mon Nov 21 18:04:06 2011) [sssd[pam]] [sbus_dispatch] (9): Dispatching.
(Mon Nov 21 18:04:06 2011) [sssd[pam]] [sbus_message_handler] (9): Received
SBUS method [ping]

The initial messages are for when i restart the sssd service.I do not see
any specific messaages when i try to do authentication.
I'm not sure how to move fwd from here cause till now the settings i have
done seems to be correct.

Would like to thank for the help I'm getting in this forum hope it will
help resolving my issue.



Thanks


On Mon, Nov 21, 2011 at 6:43 PM, Jakub Hrozek <jhrozek at redhat.com> wrote:

> On Mon, Nov 21, 2011 at 05:50:40PM +0530, Nitesh Mehare wrote:
> >    Was anybody able to look at the trace...
> >
> >    Thanks ....
> >
>
> Sorry Nitesh, I forgot to reply.
>
> The trace clearly shows that pam_sss sends data to and receives data
> from the private sssd PAM socket:
>
> -----
> stat("/var/lib/sss/pipes/private/pam", {st_mode=S_IFSOCK|0600,
> st_size=0, ...}) = 0
> socket(PF_FILE, SOCK_STREAM, 0)         = 5
> fcntl(5, F_GETFL)                       = 0x2 (flags O_RDWR)
> fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
> fcntl(5, F_GETFD)                       = 0
> fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
> connect(5, {sa_family=AF_FILE,
> path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "\3\0\0\0", 4)                 = 4
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\3\0\0\0", 4)                  = 4
> getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
> 0
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
> revents=POLLOUT}])
> write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
> 77
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
> poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
> read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21
> ----
>
> I'm not sure why pam_sss wouldn't show in the secure logs...
>
> Does SSSD print anything /var/log/sssd/sssd_pam.log when you put
> 'debug_level = 9' into the [pam] section of the SSSD config?
>
>
> >        Tha above trace I have take with selinux is disabled.The setting
> of
> >        selinux is as follows
> >
> >        bash-3.2# cat /etc/selinux/config
> >        # This file controls the state of SELinux on the system.
> >        # SELINUX= can take one of these three values:
> >        #A A A A A A  enforcing - SELinux security policy is enforced.
> >        #A A A A A A  permissive - SELinux prints warnings instead of
> >        enforcing.
> >        #A A A A A A  disabled - SELinux is fully disabled.
> >        SELINUX=disabled
> >        # SELINUXTYPE= type of policy in use. Possible values are:
> >        #A A A A A A  targeted - Only targeted network daemons are
> protected.
> >        #A A A A A A  strict - Full SELinux protection.
> >        SELINUXTYPE=targeted
> >        bash-3.2#
> >
> >        I'm not sure how to check for AVC denials when selinux is set to
> >        enforcing.Could you tell me how to do that.
> >
> >        Thanks...
> >
>
> When SELinux is disabled, it can't generate any AVC denial messages nor
> it can block access to the pipes (which was my concern).
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111121/7849fdbc/attachment.html>


More information about the sssd-devel mailing list