Announcing SSSD 2.10.0-beta1
by Pavel Březina
# SSSD 2.10.0-beta1
The SSSD team is announcing the release of version 2.10.0-beta1 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.10.0-beta1
See the full release notes at:
https://sssd.io/release-notes/sssd-2.10.0-beta1.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
# SSSD 2.10-beta1 Release Notes
## Highlights
### General information
* **IMPORTANT note for downstream maintainers!**
This release features significant improvements of "running with less
privileges (under unprivileged service user)" feature. There is still
a `./configure` option `--with-sssd-user=` available that allows
downstream package maintainers to choose if support of non-root service
user should be built. In case such support is built, a preferred way to
configure service user is simply by starting SSSD under this user; for
example, using `User=/Group=` options of systemd sssd.service file.
Upstream defaults are to build `--with-sssd-user=sssd` and to install
systemd service with `User=/Group=sssd`. In this case, only several
helper processes - `ldap_child`, `krb5_child` and `selinux_child` - are
executed with elevated capabilities (that are now granted using fine
grained file capabilities instead of SUID bit). All other SSSD
components run without any capabilities. In this scenario it's still
possible to re-configure SSSD to run under `root` (if needed for some
reason): besides changing `User/Group=` options, some other tweaks of
systemd service files are required.
A legacy method to configure a service user - sssd.conf `user` option
- is now deprecated and its support isn’t built by default. It can be
enabled using `--with-conf-service-user-support` `./configure` option if
needed (for example, due to backward compatibility requirements of
stable releases).
Further, no matter if SSSD is built `--with-sssd-user=sssd` or
`--with-sssd-user=root`, when it's configured to run under `root` (in
both cases) it still runs without capabilities, the same way as when
it's configured to run under `sssd` user. The only difference is from
the DAC perspective.
Important note: owner of `/etc/sssd/sssd.conf` file (and snippets)
should match the user configured to start SSSD service. Upstream spec
file changes ownership of existing `sssd.conf` to `sssd` during package
installation for seamless upgrades.
Additionally, this release fixes a large number of issues with
"socket activation of responders" feature, making it operable
out-of-the-box when the package is built `--with-sssd-user=sssd`. Please
take a note, that user configured to run main sssd.service and socket
activated responders (if used) should match (i.e. if sssd.service is
re-configured from upstream defaults to `root` then responders services
also should be re-configured).
Downstream package maintainers are advised to carefully inspect
changes in `contrib/sssd.spec.in`, `src/sysv/systemd/*` and
`./configure` options that this release brings!
* sssctl `cache-upgrade` command was removed. SSSD performs automatic
upgrades at startup when needed.
* Support of `enumeration` feature (i.e. ability to list all
users/groups using `getent passwd/group` without argument) for AD/IPA
providers is deprecated and might be removed in further releases. Those
who are interested to keep using it awhile should configure its build
explicitly using `--with-extended-enumeration-support` ./configure option.
### New features
* The new tool `sss_ssh_knownhosts` can be used with ssh's
KnownHostsCommand configuration option to retrieve the host's public
keys from a remote server (FreeIPA, LDAP, etc.). This new tool, which is
more reliable, replaces `sss_ssh_knownhostsproxy`. Please consider
switching to using the new tool as the old one will be removed.
### Packaging changes
* Building SSSD now unconditionally requires availability of `ucred`/
`SO_PEERCRED` to enforce certain security checks at runtime (see `man 7
unix` for details).
* SSSD now requires `libini` not older than v1.3
* Explicit `--with-semanage` ./configure switch was removed, going
forward `--with-selinux` includes this.
### Configuration changes
* Default `ldap_id_use_start_tls` value changed from `false` to `true`
for improved security.
* Added a `ldap_use_ppolicy` option for backends with broken ppolicy
extension handling.
* Obsolete `config_file_version` option was removed.
1 week, 3 days
- 1
- 1
- ← Newer
- 1
- Older →