[SSSD] NSS not communicating with SSSD?

Andrew Wygle awygle at berkeley.edu
Fri Dec 14 22:13:36 UTC 2012


I was able to resolve this issue by rebuilding the libraries and copying
them over from the .libs directory. Seems they didn't get rebuilt last time
(I must have forgotten to run make clean or something). 

Now logins work with SELinux disabled (hooray!), and when it's enabled I'm
seeing those AVC denials you mentioned. I can probably figure them out
given time, but if you happen to know the solution right off the top of
your head, the error log created in /var/log/audit/audit.log is below:

  1 type=AVC msg=audit(1355522996.845:355): avc:  denied  { write } for 
pid=22039 comm="sshd" name="nss" dev=dm-0 ino=157542
scontext=system_u:system_r:sshd_t:s0 s0:c0.c1023 tcontext=unconfin   
ed_u:object_r:usr_t:s0 tclass=sock_file
  2 type=SYSCALL msg=audit(1355522996.845:355): arch=c000003e syscall=42
success=no exit=-13 a0=6 a1=7fff8463f710 a2=6e a3=7fff8463f3d0 items=0
ppid=1089 pid=22039 auid=4294967295 uid=0 gid=0     euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd"
exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
key=(null)
  3 type=CRYPTO_KEY_USER msg=audit(1355522996.852:356): user pid=22040
uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server
fp=0c:6b:5a    :ef:71:df:1e:93:b3:71:b2:07:2c:8a:b4:77 direction=?
spid=22040 suid=0  exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1
terminal=? res=success'
  4 type=CRYPTO_KEY_USER msg=audit(1355522996.852:357): user pid=22040
uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server
fp=e5:97:d7    :29:ee:6c:08:9b:b3:b7:bf:9e:6c:6b:6f:58 direction=?
spid=22040 suid=0  exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1
terminal=? res=success'
  5 type=CRYPTO_SESSION msg=audit(1355522996.853:358): user pid=22039
uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start
direction=from-client ciph    er=aes128-ctr ksize=128 spid=22040 suid=74
rport=60885 laddr=127.0.0.1 lport=22  exe="/usr/sbin/sshd" hostname=?
addr=127.0.0.1 terminal=? res=success'
  6 type=CRYPTO_SESSION msg=audit(1355522996.854:359): user pid=22039
uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start
direction=from-server ciph    er=aes128-ctr ksize=128 spid=22040 suid=74
rport=60885 laddr=127.0.0.1 lport=22  exe="/usr/sbin/sshd" hostname=?
addr=127.0.0.1 terminal=? res=success'
  7 type=AVC msg=audit(1355522996.917:360): avc:  denied  { write } for 
pid=22039 comm="sshd" name="nss" dev=dm-0 ino=157542
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfin   
ed_u:object_r:usr_t:s0 tclass=sock_file
  8 type=SYSCALL msg=audit(1355522996.917:360): arch=c000003e syscall=42
success=no exit=-13 a0=4 a1=7fff8463f5c0 a2=6e a3=9 items=0 ppid=1089
pid=22039 auid=4294967295 uid=0 gid=0 euid=0 suid    =0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
  9 type=USER_LOGIN msg=audit(1355522996.918:361): user pid=22039 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
msg='op=login acct=28756E6B6E6F776E207573657    229 exe="/usr/sbin/sshd"
hostname=? addr=127.0.0.1 terminal=ssh res=failed'
 10 type=AVC msg=audit(1355523000.252:362): avc:  denied  { write } for 
pid=22039 comm="sshd" name="nss" dev=dm-0 ino=157542
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfin   
ed_u:object_r:usr_t:s0 tclass=sock_file
 11 type=SYSCALL msg=audit(1355523000.252:362): arch=c000003e syscall=42
success=no exit=-13 a0=4 a1=7fff8463f490 a2=6e a3=9 items=0 ppid=1089
pid=22039 auid=4294967295 uid=0 gid=0 euid=0 suid    =0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
 12 type=AVC msg=audit(1355523000.264:363): avc:  denied  { write } for 
pid=22039 comm="sshd" name="nss" dev=dm-0 ino=157542
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfin   
ed_u:object_r:usr_t:s0 tclass=sock_file
 13 type=SYSCALL msg=audit(1355523000.264:363): arch=c000003e syscall=42
success=no exit=-13 a0=4 a1=7fff8463f2f0 a2=6e a3=9 items=0 ppid=1089
pid=22039 auid=4294967295 uid=0 gid=0 euid=0 suid    =0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
 14 type=AVC msg=audit(1355523000.264:364): avc:  denied  { write } for 
pid=22039 comm="sshd" name="nss" dev=dm-0 ino=157542
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfin   
ed_u:object_r:usr_t:s0 tclass=sock_file
 15 type=SYSCALL msg=audit(1355523000.264:364): arch=c000003e syscall=42
success=no exit=-13 a0=4 a1=7fff8463f340 a2=6e a3=9 items=0 ppid=1089
pid=22039 auid=4294967295 uid=0 gid=0 euid=0 suid    =0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
 16 type=AVC msg=audit(1355523000.266:365): avc:  denied  { write } for 
pid=22039 comm="sshd" name="nss" dev=dm-0 ino=157542
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfin   
ed_u:object_r:usr_t:s0 tclass=sock_file
 17 type=SYSCALL msg=audit(1355523000.266:365): arch=c000003e syscall=42
success=no exit=-13 a0=8 a1=7fff8463f400 a2=6e a3=9 items=0 ppid=1089
pid=22039 auid=4294967295 uid=0 gid=0 euid=0 suid    =0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)

Thanks so much for all your help.


On Fri, 14 Dec 2012 20:06:39 +0100, Jakub Hrozek <jhrozek at redhat.com>
wrote:
> On Fri, Dec 14, 2012 at 10:21:27AM -0800, Andrew Wygle wrote:
>> > I would like to fix the NSS issue first, chances are it's causing the
>> > above error messages from PAM as well. Did you configure your PAM
stack
>> > manually or using authconfig? Do you see pam_sss being contacted in
>> > /var/log/secure at all?
>> > 
>> 
>> I am still seeing this problem, however, and now it's actually a
problem.
>> When I try to log in over ssh I successfully log in and then the
>> connection
>> is immediately closed, with a /var/log/secure footprint that looks ilke
>> this:
>> 
>> sshd[2070]: pam_sss(sshd:account): Request to sssd failed. Connection
>> refused
>> sshd[2071]: fatal: Access denied for user bob by PAM account
>> configuration
>> sshd[2070]: Failed password for bob from 127.0.0.1 port 57093 ssh2
>> 
> 
> "Connection refused" would indicate that there is nobody listening on
> the other end. pam_sss is mostly just a proxy, which marshalls the
incoming
> request in a format the sssd_pam process expects and sends it over a
> UNIX pipe to sssd_pam.
> 
> You said before that you may have misconfigured the SSSD while building
> it, is there any chance that the pam_sss module is talking to a pipe
that
> doesn't exist? The default pipe path is "\"VARDIR\"/lib/sss/pipes" while
> VARDIR is expanded from the value of --localstatedir during configure. I
> guess that "grep ^localstatedir Makefile" is a quick way to check what
> the localstatedir was configured as if you still have the sources
> around.
> 
> Is the sssd_pam process running? I expect there is no sign of an
> incoming request in the pam log? (/var/log/sssd/sssd_pam.log)
> 
>> 
>> 
>> I thought it might be the same problem as nss so I made doublesure to
>> copy
>> the correct versions of the pam_sss library, but that didn't improve
>> things
>> (though since there's really no way to restart pam, I'm not exactly
sure
>> when library changes would get incorporated). I have tried configuring
>> PAM
>> several dozen different ways over the course of this project, so I'm
not
>> sure what's going on right now, but I believe it was last configured
with
>> authconfig. My /etc/pam.d/password-auth-ac and system-auth-ac are
below:
>> 
>> password-auth-ac:
>> #%PAM-1.0
>> # This file is auto-generated.
>> # User changes will be destroyed the next time authconfig is run.
>> auth        required      pam_env.so
>> auth        sufficient    pam_unix.so nullok try_first_pass
>> auth        requisite     pam_succeed_if.so uid >= 500 quiet
>> auth        sufficient    pam_sss.so use_first_pass
>> auth        required      pam_deny.so
>> 
>> account     required      pam_unix.so broken_shadow
>> account     sufficient    pam_localuser.so
>> account     sufficient    pam_succeed_if.so uid < 500 quiet
>> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
>> account     required      pam_permit.so
>> 
>> password    requisite     pam_cracklib.so try_first_pass retry=3 type=
>> password    sufficient    pam_unix.so sha512 shadow nullok
try_first_pass
>> use_authtok
>> password    sufficient    pam_sss.so use_authtok
>> password    required      pam_deny.so
>> 
>> session     optional      pam_keyinit.so revoke
>> session     required      pam_limits.so
>> session     optional      pam_mkhomedir.so
>> session     [success=1 default=ignore] pam_succeed_if.so service in
crond
>> quiet use_uid
>> session     required      pam_unix.so
>> session     optional      pam_sss.so
>> 
>> 
>> 
>> system-auth-ac:
>> #%PAM-1.0
>> # This file is auto-generated.
>> # User changes will be destroyed the next time authconfig is run.
>> auth        required      pam_env.so
>> auth        sufficient    pam_unix.so nullok try_first_pass
>> auth        requisite     pam_succeed_if.so uid >= 500 quiet
>> auth        sufficient    pam_sss.so use_first_pass
>> auth        required      pam_deny.so
>> 
>> account     required      pam_unix.so broken_shadow
>> account     sufficient    pam_localuser.so
>> account     sufficient    pam_succeed_if.so uid < 500 quiet
>> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
>> account     required      pam_permit.so
>> 
>> password    requisite     pam_cracklib.so try_first_pass retry=3 type=
>> password    sufficient    pam_unix.so sha512 shadow nullok
try_first_pass
>> use_authtok
>> password    sufficient    pam_sss.so use_authtok
>> password    required      pam_deny.so
>> 
>> session     optional      pam_keyinit.so revoke
>> session     required      pam_limits.so
>> session     optional      pam_mkhomedir.so
>> session     [success=1 default=ignore] pam_succeed_if.so service in
crond
>> quiet use_uid
>> session     required      pam_unix.so
>> session     optional      pam_sss.so
>> 
> 
> The PAM config files look good to me. I think they are, indeed,
> generated by authconfig.
> 
>> >> I also see a Kerberos AS-REQ for krbtgt/DOMAIN.NET
>> >> (which is odd because the cache contains
krbtgt/DOMAIN.NET at DOMAIN.NET
>> and
>> >> ldap/dc.domain.net at DOMAIN.NET already), which is rejected with a
>> KRB-ERR
>> >> claiming principal not found. 
>> >> 
>> >> Finally, I occasionally (not sure exactly
>> >> when, but it seems to be when I try to log in with users that DO
exist
>> >> locally) see the following in /var/log/secure: 
>> >> 
>> >> pam_sss(sshd:session):
>> >> Request to sssd failed. Connection refused 
>> > 
>> > Simo just posted a patch for this issue. The title of the patch is
>> > "[PATCH] Fix pam responder handling of coalesced requests". If you
>> > could
>> > give it a go, it would be awesome.
>> > 
>> 
>> I am unlikely to be able to sell my boss on running code that isn't
some
>> released version (I had enough trouble getting him to move to 1.9.3),
but
>> I'll see what I can do. Is this a real problem that will impede
>> functionality, or just an annoyance?
> 
> If the sssd_be process crashed while there was a login in progress,
> then the sssd_pam process wouldn't reconnect correctly and all further
> connection attempts would hang.
> 
> But given that you also see connection refused with accounts that you
> can resolve with getent or id now, I no longer think the patch would be
> a solution to that.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list