sssd-devel August 2010

sssd-devel@lists.fedorahosted.org

17 participants
48 discussions

[PATCHES] Enhancements for building on Gentoo
by Stephen Gallagher 02 Sep '10

02 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Further patches submitted by Maxim through the upstream Trac at https://fedorahosted.org/sssd/ticket/606 I rebased these patches atop the current master and tested them. I squashed two of them together since they were mutually dependent and very very small. Ack. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxz3c4ACgkQeiVVYja6o6N14ACfffjeD+OYsU9Z8+L1HKgxqKTV 7lUAn2P9zDO1wRSMl8AiQjf8pPzko/6g =jUC3 -----END PGP SIGNATURE-----

2 4

remapping ldap_default_authtok_type
by Andy Kannberg 01 Sep '10

01 Sep '10

Hi all, In our setup, we run into the following problem: When sssd is configured, the authentication against ldap fails, but succeeds against kerberos/AD. Our ldap/edirectory guru has, as far as he is concerned, pinned the problem down due to the fact that ldap authentication fails with the logging saying "password failed": Here's the part in /var/log/secure: Aug 30 11:45:36 hpdw0001 sshd[27645]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost= hpdw0001.ddns.nl-htc01.nxp.com user=nxp21358 Aug 30 11:45:36 hpdw0001 sshd[27645]: pam_sss(sshd:auth): received for user nxp21358: 6 (Permission denied) Aug 30 11:45:38 hpdw0001 sshd[27645]: Failed password for nxp21358 from 134.27.211.178 port 51963 ssh2 And the part in /var/log/sssd/ (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(uid=nxp21358)(objectclass=NxpUserAuxClass))][ou=TS T_EMEA_NL-TST01,ou=Locations,ou=NXDI,o=NXP]. (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uid] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uidNumber] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gecos] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [homeDirectory] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [loginShell] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPrincipalName] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowLastChange] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMin] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMax] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowWarning] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowInactive] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowExpire] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowFlag] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbLastPwdChange] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPasswordExpiration] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [pwdAttribute] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 9 (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x4d1eeb0], connected[1], ops[0x4d5be80], ldap[0x4d1f060] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [cn=nxp21358,ou=Personal,ou=People,ou=NXDI,o=NXP]. (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x4d1eeb0], connected[1], ops[0x4d5be80], ldap[0x4d1f060] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0), (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9): Receiving info for the user (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x4d1eeb0], connected[1], ops[(nil)], ldap[0x4d1f060] (Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing! Now, browsing through the options that can be set, we sat that we were able to set an ldap_default_authtok_type. However, the only possible option here is "password". However, the object "password" is unknown in eDirectory. All other options can be set/remapped to other attributes, and this particular one cannot. Is there a work around for this that anyone knows of ? best regards, Andy

3 3

[PATCH] Support password obfuscation in sssd.conf
by Jakub Hrozek 30 Aug '10

30 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/7] Move crypto functions into its own subdir A refactoring patch that creates a common util/crypto subdir with per-implementation subdirectories for each underlying crypto library supported by SSSD. [PATCH 2/7] Add safe copy/move macros for uint16_t These will be used later on in the code [PATCH 3/7] Password obfuscation utility functions This is where the actual obfuscation happens. Adds two utility functions - one to obfuscate a password and inverse to extract the cleartext password back. So far, only NSS-based implementation is provided. [PATCH 4/7] Fix pysss linking I noticed that the python bindings were not properly linked so a simple import pysss failed [PATCH 5/7] Python bindings for obfuscation Provides python bindings for utility functions from patch 3/7. These will be used later on in the obfuscation tool itself. [PATCH 6/7] sss_obfuscate tool A tool to add obfuscated passwords into the SSSD config file [PATCH 7/7] Deobfuscate password in back ends When obfuscated password is used in config file, the LDAP backend converts it back to clear text and uses it to authenticate to the server. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkx7+ksACgkQHsardTLnvCWpMACeK0NuGKyhlowPR6LSX6eGtYzB 0EYAniANilgnHBHDBBpXNHTZjdxYrE/+ =fRlo -----END PGP SIGNATURE-----

1 0

Announcing security release for SSSD (all supported versions)
by Stephen Gallagher 24 Aug '10

24 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Last week, we discovered a security vulnerability in SSSD when using LDAP for authentication. Full details are available at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2940 Updated SSSD tarballs are now available for SSSD 1.1.x, 1.2.x and 1.3.x. See https://fedorahosted.org/sssd/wiki/Releases for the appropriate release for your deployment. Packages for Fedora are built and should be available in updates-testing within 24 hours. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkx0Ai8ACgkQeiVVYja6o6NhAACgqUKp6G2bLDNNJVVmiB/X03nj HcwAnjxCWJL2uUzs1M6IvRyacRDhjcwy =XLwv -----END PGP SIGNATURE-----

1 0

Updates of sssd-ldap man page
by Jan Zelený 24 Aug '10

24 Aug '10

Hello everybody, I've done review of sssd-ldap. Since I'm new here, I'd like to post my findings here and consult them before I start posting patches to documentation. The review is related to Ticket #601. Besides issue described in there I found several other missing config options and some other inconsistencies: ldap_schema is missing supported values AD and IPA, which seem to have the same behavior as RFC2307bis. It would be good to at least mention this and maybe a plan for future. ldap_search_timeout is missing, but it is present in sssd 1.2.2. It seems it is still used, so I'd like to know what is the plan here (if I should at least put a note about it in documentation or not). ldap_network_timeout and ldap_opt_timeout have both default values 6, not 5. ldap_access_filter - is ldap even supported as access provider? I tried to find this out for couple hours and it doesn't seem like it. But it is possible I just don't see this in the code. If ldap isn't supported as access provider, I'll mention it in the man page. Then there are some directives, which are missing in the documentation and they seem to be recognized by sssd. Please correct me if I've put in this list directives which aren't recognized and therefore shouldn't be documented. ldap_search_timeout ldap_user_search_scope ldap_user_search_filter ldap_group_search_scope ldap_group_search_filter ldap_offline_timeout ldap_purge_cache_timeout entry_cache_timeout account_cache_expiration ldap_entry_usn ldap_rootdse_last_usn ldap_user_pwd ldap_user_modify_timestamp ldap_user_shadow_last_change ldap_user_shadow_min ldap_user_shadow_max ldap_user_shadow_warning ldap_user_shadow_inactive ldap_user_shadow_expire ldap_user_shadow_flag ldap_user_krb_last_pwd_change ldap_user_krb_password_expiration ldap_pwd_attribute ldap_group_pwd ldap_group_modify_timestamp -- Jan

2 3

[PATCH] Don't build SSSDConfig API when configured with --without-python-bindings
by Stephen Gallagher 23 Aug '10

23 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If the --without-python-bindings argument was passed to configure, the SSSD would fail to build. Prior to this patch, it was only controlling whether to build the C bindings (for use with the local provider), but the configure script was written such that it wouldn't look up the path to python. This broke the SSSDConfig API build. This patch skips building the SSSDConfig API when - --without-python-bindings is specified (since presumably the reason for using this option is that the target system doesn't have python (e.g. an appliance) - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxpebAACgkQeiVVYja6o6PcMQCgnG7wh/2LM59hGVMQalRQkhT4 HiUAoJVmFDS4qOCLQ6RVVHa4nHjEDCFv =GMCc -----END PGP SIGNATURE-----

2 3

[PATCH] Remove src/Makefile.am and src/configure.ac
by Stephen Gallagher 23 Aug '10

23 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 They are no longer used. The toplevel Makefile.am builds everything now. I forgot to remove them when I moved the Makefile commands up to the root. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxydQYACgkQeiVVYja6o6OmrgCfTJpv48M1tjaDsjnispJ0V0CB 9nkAni8Ib+UOTr3otD1VbCqS9OptEwAo =Iauc -----END PGP SIGNATURE-----

2 2

[PATCHES] Fix builds on Gentoo
by Stephen Gallagher 23 Aug '10

23 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Two patches submitted by Maxim <kolmax94(a)gmail.com> I ack them both. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxydUYACgkQeiVVYja6o6P+fgCeOn4B4U3io10QL0ff/VbkbIFS G0gAoIIvf7sVR2SJHkNy8TRCIYw9Zjo8 =vwWJ -----END PGP SIGNATURE-----

1 1

[PATCH] Fix two problems with --as-needed
by Jakub Hrozek 23 Aug '10

23 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, On Fedora, I saw two problems when building and using sssd with - -Wl,--as-needed: The configure-time check for HAVE_DBUS_WATCH_GET_UNIX_FD wasn't run correctly which resulted in using the deprecated DBus function and subsequent GCC warning. The other issue was that the LDAP backend wouldn't start and complained about "libsss_ldap.so: undefined symbol: hash_error_string". The attached patch addresses them. It is at least partial fix for #559. Jakub -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxO5PEACgkQHsardTLnvCVqzACfVKjUjDMLP5OWK9md9hoL7nbU TNcAn2fXTvI1SIPlxJ5faPYgO23zAnCp =OUib -----END PGP SIGNATURE-----

2 4

how does enumeration work
by Eric Doutreleau 23 Aug '10

23 Aug '10

hi i m trying to use sssd 1.2.2-19 on my fedora 13 machine and i have some questions about enumeration. Here is my sssd.conf ( ldap part ) [domain/default] ldap_id_use_start_tls = False ldap_tls_reqcert = never cache_credentials = True ldap_search_base = dc=int-evry,dc=fr ldap_user_search_base = ou=People,dc=int-evry,dc=fr ldap_group_search_base = ou=Group,ou=System,dc=int-evry,dc=fr #ldap_group_search_base = ou=Groups,dc=int-evry,dc=fr chpass_provider = none id_provider = ldap auth_provider = ldap debug_level = 3 min_id = 1 ldap_uri = ldap://ldap2.int-evry.fr/ , ldap://ldap3.int-evry.fr/ , ldap://ldap1.int-evry.fr/ ldap_schema = rfc2307 access_provider = permit ldap_default_bind_dn = cn=mcibind,ou=System,dc=int-evry,dc=fr ldap_default_authtok_type = password ldap_default_authtok = xxxxx enumerate = True create_homedir = True tested is an account that have never logged on the computer. when the network is out i type getent passwd | grep tested tested:*:14501:145:RASSAR:/mci/mci/tested:/usr/local/bin/bash the account tested is here but i can't log with this account here is the message on the secure log file Aug 23 11:44:39 b008-07 login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty4 ruser= rhost= user=tested Aug 23 11:44:39 b008-07 login: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty4 ruser= rhost= user=tested Aug 23 11:44:39 b008-07 login: pam_sss(login:auth): received for user tested: 9 (Authentication service cannot retrieve authentication info) Aug 23 11:44:40 b008-07 login: FAILED LOGIN 1 FROM (null) FOR tested, Authentication failure Does enumeration permit to store credentials for people that have never logged in the machine?

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2010