Sssd-maintainers August 2024

sssd-maintainers@lists.fedoraproject.org

1 participants
3 discussions

[Bug 2308428] New: Failed to start sssd-kcm.socket service
by bugzilla＠redhat.com 14 Sep '24

14 Sep '24

https://bugzilla.redhat.com/show_bug.cgi?id=2308428 Bug ID: 2308428 Summary: Failed to start sssd-kcm.socket service Product: Fedora Version: 41 OS: Linux Status: NEW Component: sssd Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: pnemade(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora I upgraded my Fedora 40 Silverblue system to Fedora 41 Silverblue system. I am using toolbox on this upgraded system to use kinit command. However I found its failed with error "kinit: Connection refused while getting default ccache" I then checked for any failed services on this system and found below parag@f41sb:~$ sudo systemctl status sssd-kcm.service × sssd-kcm.service - SSSD Kerberos Cache Manager Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.service; indirect; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf Active: failed (Result: exit-code) since Thu 2024-08-29 08:36:37 IST; 2min 14s ago Duration: 17ms Invocation: a0e98bf8241640c3b720f1beeeaa5293 TriggeredBy: × sssd-kcm.socket Docs: man:sssd-kcm(5) Process: 2766 ExecStartPre=/bin/chown -f sssd:sssd /etc/sssd/sssd.conf (code=exited, status=1/FAILURE) Process: 2771 ExecStartPre=/bin/chown -f -R sssd:sssd /etc/sssd/conf.d (code=exited, status=0/SUCCESS) Process: 2773 ExecStart=/usr/libexec/sssd/sssd_kcm ${DEBUG_LOGGER} (code=exited, status=3) Main PID: 2773 (code=exited, status=3) Aug 29 08:36:37 f41sb sssd_kcm[2773]: Failed to connect to '/var/lib/sss/secrets/secrets.ldb' with backend 'tdb': Unable to open tdb '/var/lib/sss/secrets/secrets.ldb': Permission denied Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [sss_sec_init] (0x0020): Failed to initialize secdb [5]: Input/output error Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [ccdb_secdb_init] (0x0020): Cannot initialize the security database Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [kcm_ccdb_init] (0x0020): Cannot initialize ccache database Aug 29 08:36:37 f41sb sssd_kcm[2773]: (2024-08-29 8:36:37): [kcm] [kcm_process_init] (0x0010): fatal error initializing responder data Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Main process exited, code=exited, status=3/NOTIMPLEMENTED Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Failed with result 'exit-code'. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Start request repeated too quickly. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.service: Failed with result 'exit-code'. Aug 29 08:36:37 f41sb systemd[1]: Failed to start sssd-kcm.service - SSSD Kerberos Cache Manager. and parag@f41sb:~$ sudo systemctl status sssd-kcm.socket × sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket Loaded: loaded (/usr/lib/systemd/system/sssd-kcm.socket; enabled; preset: enabled) Active: failed (Result: service-start-limit-hit) since Thu 2024-08-29 08:36:37 IST; 2min 39s ago Duration: 23.535s Invocation: de4f2f42700f47a3958789b82f7d5070 Triggers: ● sssd-kcm.service Docs: man:sssd-kcm(8) Listen: /run/.heim_org.h5l.kcm-socket (Stream) Aug 29 08:36:14 f41sb systemd[1]: Listening on sssd-kcm.socket - SSSD Kerberos Cache Manager responder socket. Aug 29 08:36:37 f41sb systemd[1]: sssd-kcm.socket: Failed with result 'service-start-limit-hit'. Can someone help to know better how to fix this service failure issue so that I can start using kinit command? Reproducible: Always Steps to Reproduce: 1. Take Fedora 41 bare metal Silverblue system not VM 2. use fedora toolbox 3. in toolbox just run "kinit" or "klist" it fails Actual Results: kinit: Connection refused while getting default ccache Expected Results: Should run kinit and get a ticket -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2308428 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 22

[Bug 2299722] New: SELinux preventing password authentication
by bugzilla＠redhat.com 20 Aug '24

20 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2299722 Bug ID: 2299722 Summary: SELinux preventing password authentication Product: Fedora Version: rawhide Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: orion(a)nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: We're seeing SELinux preventing password authentication: In permissive mode it works and we see: type=AVC msg=audit(1721842903.063:1198): avc: denied { read } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842903.064:1199): avc: denied { view } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842903.064:1200): avc: denied { write } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842989.327:1210): avc: denied { read } for pid=31647 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721843092.725:1229): avc: denied { read } for pid=31751 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 krb5_child.log shows: (2024-07-24 9:54:32): [krb5_child[30625]] [set_lifetime_options] (0x0100): [RID#771] No specific renewable lifetime requested. (2024-07-24 9:54:32): [krb5_child[30625]] [set_lifetime_options] (0x0100): [RID#771] No specific lifetime requested. (2024-07-24 9:54:32): [krb5_child[30625]] [set_canonicalize_option] (0x0100): [RID#771] Canonicalization is set to [true] (2024-07-24 9:54:34): [krb5_child[30625]] [create_ccache] (0x0020): [RID#771] 1548: [13][Permission denied] Version-Release number of selected component (if applicable): sssd-2.9.5-1.fc39.x86_64 selinux-policy-39.7-1.fc39.noarch How reproducible: Unsure -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2299722 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2305856] New: sss_ssh_knownhosts man page does not contain information about replacements
by bugzilla＠redhat.com 20 Aug '24

20 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2305856 Bug ID: 2305856 Summary: sss_ssh_knownhosts man page does not contain information about replacements Product: Fedora Version: rawhide OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: orion(a)nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora ssh fails with: ****************************************************************************** Your system is configured to use the obsolete tool sss_ssh_knownhostsproxy. Please read the sss_ssh_knownhosts(1) man page to learn about its replacement. ****************************************************************************** But man sss_ssh_knownhosts contains just: SSS_SSH_KNOWNHOSTS(1) SSSD Manual pages SSS_SSH_KNOWNHOSTS(1) NAME sss_ssh_knownhosts - get OpenSSH known hosts public keys SYNOPSIS sss_ssh_knownhosts [options] HOST DESCRIPTION sss_ssh_knownhosts acquires SSH public keys for host HOST and outputs them in OpenSSH known_hosts key format (see the “SSH_KNOWN_HOSTS FILE FORMAT” section of sshd(8) for more information). ssh(1) can be configured to use sss_ssh_knownhosts for public key host authentication using the “KnownHostsCommand” option: KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H Please refer to the ssh_config(5) man page for more details about this option. OPTIONS -d,--domain DOMAIN Search for host public keys in SSSD domain DOMAIN. -?,--help Display help message and exit. EXIT STATUS In case of successful execution, even if no key was found, 0 is returned. 1 is returned in case of error. SEE ALSO sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5) AUTHORS The SSSD upstream - https://github.com/SSSD/sssd/ SSSD 07/22/2024 SSS_SSH_KNOWNHOSTS(1) and no information about a replacement or it being obsolete. sssd-2.10.0~beta2-3.fc41.x86_64 Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2305856 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

2024

2023

2022

2021

2020

Sssd-maintainers August 2024