October 2012 - sssd-users - Fedora mailing-lists

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

A test repository with SSSD 1.9 for RHEL-6.3
by Jakub Hrozek 21 Dec '12

21 Dec '12

Hi, even though RHEL-6.4 is still brewing, I think there might be some interest in trying out the 1.9.x series of the SSSD on RHEL-6.3. So I went ahead and built the SSSD 1.9.2 in a RHEL-6.3 buildroot: http://repos.fedorapeople.org/repos/jhrozek/sssd/epel-6/ The NVR of these test packages will be lower than those in 6.4 to keep the upgrade path clean. The only missing functionality is the PAC responder, which means this SSSD version won't be able to work with an AD domain that is in a trust relationship with an IPA 3.x domain. I had to disable the PAC responder as it requires Kerberos 1.10. Because some new functionality required tweaking the SELinux policy, you will encounter AVC denials when the new fast cache is accessed. That said, my quick smoke testing went fine and we will be glad to hear test results or bug reports. Using the repository comes with a warning - this is NOT an official Red Hat supported repository. The packages have NOT gone through formal QA. If it breaks your RHEL-6.3 installation, you get to keep the pieces. This is the repo configuration I used: -------------------------- [sssd-1.9-RHEL6.3] name=SSSD 1.9.x built for latest stable RHEL baseurl=http://repos.fedorapeople.org/repos/jhrozek/sssd/epel-6/$basearch/ enabled=1 skip_if_unavailable=1 gpgcheck=0 [sssd-1.9-RHEL6.3-source] name=SSSD 1.9.x built for latest stable RHEL - Source baseurl=http://repos.fedorapeople.org/repos/jhrozek/sssd/epel-6/SRPMS enabled=0 skip_if_unavailable=1 gpgcheck=0 -------------------------- Happy testing!

5 15

Re: [SSSD-users] startup problem
by Longina Przybyszewska 31 Oct '12

31 Oct '12

Hi again, Ubuntu-quantal - sssd-1.9.1 Can start sssd in interactive mode , but cannot start it from init scripts as a deamon with "-D -f -d3" options /etc/ssd/sssd.conf mode 600 longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Jakub Hrozek Sent: 18. oktober 2012 10:49 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd and different repositories On Tue, Oct 16, 2012 at 01:25:00PM +0000, Longina Przybyszewska wrote: > Sure, but I guess with sssd it should be simpler ( if it is possible). > As me and Stephen said, with SSSD 1.9, the configuration is quite easy, no need for NIS. In combination with the realmd project, even joining the domain is quite simple. By the way here is our documentation on using the SSSD in an AD domain (that predates realmd): https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%2… I just realized this document could have been better reachable from the front page so I also linked it from https://fedorahosted.org/sssd/wiki/Documentation _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

5 14

sssd equivilent of nss_ldap nss_getgrent_skipmembers?
by Paul B. Henson 30 Oct '12

30 Oct '12

We're working on transitioning from RHEL5 to RHEL6 and have run into a bit of a problem with sssd and our ldap integration. We have a number of groups with a very large number of members, which took excessively long with nss_ldap to retrieve. We implemented the nss_getgrent_skipmembers feature for nss_ldap, got it accepted into the PADL upstream, talked Red Hat into backporting it, and have been using it for years. Basically, this feature allows you to not request the member attribute for a group lookup, the group shows up with no members. However, for the purposes of initgroups, membership is still taken into account and users belong to the correct groups. This works perfectly for our needs. Unfortunately, we have the exact same issue with sssd: # time getent group members [...] real 1m29.589s user 0m0.006s sys 0m0.003s # time getent group students [...] real 0m44.735s user 0m0.007s sys 0m0.002s # time id -a cpcrudo [...] real 2m14.719s In addition, any other lookups appear to be blocked during the delay, so the whole system is basically without naming services for minutes. Is there any way to emulate the behavior of nss_ldap with the nss_getgrent_skipmembers option enabled with sssd? If not, would there be any objection to adding such a feature? Thanks... -- Paul B. Henson | (909) 979-6361 | http://www.csupomona.edu/~henson/ Operating Systems and Network Analyst | henson(a)csupomona.edu California State Polytechnic University | Pomona CA 91768

4 14

Re: [SSSD-users] Different SSSD LDAP search filters for specific PAM services
by Tomas Brandysky 26 Oct '12

26 Oct '12

On 10/26/2012 11:41 AM, Jakub Hrozek wrote: > On Fri, Oct 26, 2012 at 11:10:45AM +0200, Tomas Brandysky wrote: >>> You can also use a comma-separated list in the ldap_access_order >>> parameter of sssd.conf and then define both service and host for a user. >>> >> >> this is not a solution because defining service for user in LDAP means >> to grant user access to this service not only on a particular server but >> on all servers the same user can access too (for example because of some >> other services). >> >> This is real scenario: >> >> - two servers both running openvpn and ssh services - both configured to >> authenticate users against LDAP >> >> - I want user "one" to have access to: >> - openvpn service on server1 >> - ssh service on server2 >> >> >> I'm not able to manage this with sssd even though I try it with comma- >> separated list in the ldap_access_order parameter. I don't think this >> scenario is so rare in other companies too. This is a quite common >> practice in larger companies maintaining dozens of servers and services >> to grant users access to specific services on specific servers only (as >> we can do easily with pam_ldap). >> >> I will be very surprised if many other companies won't request this >> feature being present in sssd if this is a new official way how to >> handle LDAP authentication in RHEL 6. >> >> >>> For a finer-grained access control, you probably want IPA's HBAC as >>> Sumit said. >> >> I got a look to at IPA's HBAC and it seems to be overkill to me. I can >> imagine such a solution in very large enterprises where kinda more >> sophisticated integrated security information management solution might >> come in handy. >> >> I think our company(as many others) will stick with "old" pam_ldap >> solution which was there working since RHEL4. At least until this >> feature is integrated to sssd. >> >> Tomas > > I'm sorry the current means of access control do not work for you. > > Unfortunately we have finite time and resources and the next 1.10 release > is already getting quite big. I would suggest raising a feature request > via the usual RHEL channels to bump the priority up. As we have valid RHEL support paid I will try to file such a request. > > Or, if you'd be willing to work with us and contribute a patch, I'll be > glad to help with getting you up to speed and getting the patch > accepted upstream. Thanks for making such a suggestion ;) but I'm not a developer not have time for that. I was just confronted with sssd in RHEL/Centos 6 as IT administrator and since I manage couple of production servers in midsize company using LDAP authentication and because I'm recently preparing our environment to move from Centos 5 to Centos 6 I was trying to find out how it's supposed to work "the new way". Tomas

2 1

Re: [SSSD-users] Different SSSD LDAP search filters for specific PAM services
by Tomas Brandysky 26 Oct '12

26 Oct '12

On 10/25/2012 04:14 PM, Jakub Hrozek wrote: > On Thu, Oct 25, 2012 at 01:48:49PM +0200, Tomas Brandysky wrote: >> On 10/25/2012 11:36 AM, Sumit Bose wrote: >>> On Thu, Oct 25, 2012 at 10:36:05AM +0200, Tomas Brandysky wrote: >>>> Hello, >>>> >>>> we're upgrading from Centos 5.8 to Centos 6.3 and have realized few >>>> things have changed in the system. >>>> >>>> We're using LDAP authentication (nss_ldap package) on our Centos 5.8 >>>> servers and have different PAM ldap configuration files configured to be >>>> used for specific PAM services at the moment. >>>> >>>> Here is the example of our setup: >>>> >>>> /etc/pam.d/service1: >>>> auth sufficient pam_ldap.so config=/etc/ldap_service1.conf >>>> >>>> /etc/pam.d/service2: >>>> auth sufficient pam_ldap.so config=/etc/ldap_service2.conf >>>> >>>> Thus we can use specific LDAP filters for various different services as >>>> not all users having access to one service also have access to other >>>> services on the same server. >>>> >>>> Now we're facing the problem to manage the same functionality with >>>> System Security Services Daemon (SSSD) which was newly presented with >>>> RHEL 6. >>>> >>>> We didn't find out so far how to specify custom sssd configuration file >>>> (or specific part of the configuration section/domain) in PAM service >>>> configuration. According to documentation only these options can be >>>> specified when using pam_sss module: [forward_pass] [use_first_pass] >>>> [use_authtok]. >>>> >>>> None of them can be used to make a difference in a ldap filter to be used. >>>> >>>> Is there a way how to configure specific search filters depending on PAM >>>> service ? >>>> >>>> Thank you for any suggestion >>> >>> I think what you are looking for is covered in >>> https://fedorahosted.org/sssd/ticket/1021. >>> >> >> yes, that's exactly what I miss in sssd. >> I'm surprised such a feature isn't supported yet as the same goal could >> be accomplished in RHEL4/5 releases with older methods. I see this as a >> step back. Is there some real possibility to have this feature in some >> later release which could come as update in RHEL 6 ? > > I don't think we are tracking this feature request for RHEL6. If > you need the functionality in RHEL6, feel to propose it through the > support. > >> >>> If you only want to allow/deny access for specific users to specific >>> service you can add an attribute to the user objects in the LDAP server >>> listing the allowed PAM services and use ldap_user_authorized_service. >>> See sssd-ldap man page for details. >> >> I know about ldap_user_authorized_service but I need to specify a >> combination of service and host access. I can't effort to grant users >> access to ssh service globaly when they can access ssh only on some of >> dozens servers we have. >> > > You can also use a comma-separated list in the ldap_access_order > parameter of sssd.conf and then define both service and host for a user. > this is not a solution because defining service for user in LDAP means to grant user access to this service not only on a particular server but on all servers the same user can access too (for example because of some other services). This is real scenario: - two servers both running openvpn and ssh services - both configured to authenticate users against LDAP - I want user "one" to have access to: - openvpn service on server1 - ssh service on server2 I'm not able to manage this with sssd even though I try it with comma- separated list in the ldap_access_order parameter. I don't think this scenario is so rare in other companies too. This is a quite common practice in larger companies maintaining dozens of servers and services to grant users access to specific services on specific servers only (as we can do easily with pam_ldap). I will be very surprised if many other companies won't request this feature being present in sssd if this is a new official way how to handle LDAP authentication in RHEL 6. > For a finer-grained access control, you probably want IPA's HBAC as > Sumit said. I got a look to at IPA's HBAC and it seems to be overkill to me. I can imagine such a solution in very large enterprises where kinda more sophisticated integrated security information management solution might come in handy. I think our company(as many others) will stick with "old" pam_ldap solution which was there working since RHEL4. At least until this feature is integrated to sssd. Tomas

2 1

Re: [SSSD-users] Different SSSD LDAP search filters for specific PAM services
by Tomas Brandysky 25 Oct '12

25 Oct '12

On 10/25/2012 11:36 AM, Sumit Bose wrote: > On Thu, Oct 25, 2012 at 10:36:05AM +0200, Tomas Brandysky wrote: >> Hello, >> >> we're upgrading from Centos 5.8 to Centos 6.3 and have realized few >> things have changed in the system. >> >> We're using LDAP authentication (nss_ldap package) on our Centos 5.8 >> servers and have different PAM ldap configuration files configured to be >> used for specific PAM services at the moment. >> >> Here is the example of our setup: >> >> /etc/pam.d/service1: >> auth sufficient pam_ldap.so config=/etc/ldap_service1.conf >> >> /etc/pam.d/service2: >> auth sufficient pam_ldap.so config=/etc/ldap_service2.conf >> >> Thus we can use specific LDAP filters for various different services as >> not all users having access to one service also have access to other >> services on the same server. >> >> Now we're facing the problem to manage the same functionality with >> System Security Services Daemon (SSSD) which was newly presented with >> RHEL 6. >> >> We didn't find out so far how to specify custom sssd configuration file >> (or specific part of the configuration section/domain) in PAM service >> configuration. According to documentation only these options can be >> specified when using pam_sss module: [forward_pass] [use_first_pass] >> [use_authtok]. >> >> None of them can be used to make a difference in a ldap filter to be used. >> >> Is there a way how to configure specific search filters depending on PAM >> service ? >> >> Thank you for any suggestion > > I think what you are looking for is covered in > https://fedorahosted.org/sssd/ticket/1021. > yes, that's exactly what I miss in sssd. I'm surprised such a feature isn't supported yet as the same goal could be accomplished in RHEL4/5 releases with older methods. I see this as a step back. Is there some real possibility to have this feature in some later release which could come as update in RHEL 6 ? > If you only want to allow/deny access for specific users to specific > service you can add an attribute to the user objects in the LDAP server > listing the allowed PAM services and use ldap_user_authorized_service. > See sssd-ldap man page for details. I know about ldap_user_authorized_service but I need to specify a combination of service and host access. I can't effort to grant users access to ssh service globaly when they can access ssh only on some of dozens servers we have. > > If you want more fine grained access control you might want to have a > look at the FreeIPA HBAC rules. ok, I've not heard about this. Will check it out. Thank you Tomas > > HTH > > bye, > Sumit > >> >> Regards >> >> Tomas Brandysky >> _______________________________________________ >> sssd-users mailing list >> sssd-users(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/sssd-users > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users >

3 2

Different SSSD LDAP search filters for specific PAM services
by Tomas Brandysky 25 Oct '12

25 Oct '12

Hello, we're upgrading from Centos 5.8 to Centos 6.3 and have realized few things have changed in the system. We're using LDAP authentication (nss_ldap package) on our Centos 5.8 servers and have different PAM ldap configuration files configured to be used for specific PAM services at the moment. Here is the example of our setup: /etc/pam.d/service1: auth sufficient pam_ldap.so config=/etc/ldap_service1.conf /etc/pam.d/service2: auth sufficient pam_ldap.so config=/etc/ldap_service2.conf Thus we can use specific LDAP filters for various different services as not all users having access to one service also have access to other services on the same server. Now we're facing the problem to manage the same functionality with System Security Services Daemon (SSSD) which was newly presented with RHEL 6. We didn't find out so far how to specify custom sssd configuration file (or specific part of the configuration section/domain) in PAM service configuration. According to documentation only these options can be specified when using pam_sss module: [forward_pass] [use_first_pass] [use_authtok]. None of them can be used to make a difference in a ldap filter to be used. Is there a way how to configure specific search filters depending on PAM service ? Thank you for any suggestion Regards Tomas Brandysky

2 1

Re: [SSSD-users] sssd and different repositories
by Longina Przybyszewska 18 Oct '12

18 Oct '12

Sure, but I guess with sssd it should be simpler ( if it is possible). Longina From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej Valousek Sent: 16. oktober 2012 14:55 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd and difrent repositories Yes, you can use your existing NIS servers for authorization AND use Kerberos for authentication - no need for sssd here. You just need to make sure all users in your NIS passwd table have also accounts in AD. Ondrej On 10/16/2012 02:25 PM, Longina Przybyszewska wrote: HI, Thanks, but actually I asked if I can use _Linux NIS_ server for authorization. You say I have to move NIS maps into AD and use Windows NIS – that means “no” ?. . All users at my site have accounts in AD, and in addition, Linux users have Linux accounts in respective NIS domains. In AD there are 3 domains for users accounts, in Linux, several other. Can WINdows NIS manage multi domains? I am not able to perform migration, as we have the Windows team dealing with MSWins and have to wait until they WILL do that. I have admin credentials but am not authorized to more than create user and computer account. Saying so – is there anything I can do now with sssd, in the existing env ironment, to improve authentication on Linux (using AD Kerberos for authentication and existing linux NIS server for the rest) ??? Best regards Longina Przybyszewska Systemprogrammør, IT Services Tel. +45 6550 2359 Mobile +45 6011 2359 Fax +45 6550 2467 Email longina(a)sdu.dk<mailto:longina@sdu.dk> Web http://www.sdu.dk/ansat/longina Addr. Campusvej 55, DK-5230 Odense M, Denmark [Description: C:\Documents and Settings\longina\Application Data\Microsoft\Signaturer\sduemaillogoUK.jpg] ________________________________ Campusvej 55 · DK-5230 Odense M · Denmark · Tel. +45 6550 1000 · www.sdu.dk<http://www.sdu.dk/> From: sssd-users-bounces(a)lists.fedorahosted.org<mailto:sssd-users-bounces@lists.fedorahosted.org> [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Ondrej Valousek Sent: 16. oktober 2012 13:14 To: End-user discussions about the System Security Services Daemon Subject: Re: [SSSD-users] sssd and difrent repositories Yes, it is. sssd will do the first task for you and for the second you need to install IDMU (Identity mgmt for Unix) and its migration assistant to migrate your maps into AD. Just note you will need Windows server 2003 R2 or newer for this (older AD schema is incompatible w/ sssd). Ondrej On 10/16/2012 12:21 PM, Longina Przybyszewska wrote: Hi list, I am going to set up proof-of -concept installation of Ubuntu (Precise) client/server using sssd to authenticate/authorize against Active Directory. At this moment everything seems to be a challenge - as I am exclusive (ok ;-) almost exclusive... ) hard core Linux user. As our Windows team is not ready with AD schema for Unix - my first exercise could be -get login/ssh authenticate (and change passwd) against AD -get uid/gid/auto.home map/shell from existing Linux NIS server Is my plan realistic ? Best regards Longina Przybyszewska Systemprogrammør, IT Services Tel. +45 6550 2359 Mobile +45 6011 2359 Fax +45 6550 2467 Email longina(a)sdu.dk<mailto:longina@sdu.dk> Web http://www.sdu.dk/ansat/longina Addr. Campusvej 55, DK-5230 Odense M, Denmark UNIVERSITY OF SOUTHERN DENMARK _______________________________________________________________ Campusvej 55 * DK-5230 * Odense M * Denmark * Tel. +45 6550 1000 * www.sdu.dk<http://www.sdu.dk> -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org<mailto:sssd-users-bounces@lists.fedorahosted.org> [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Jakub Hrozek Sent: 12. oktober 2012 22:40 To: sssd-devel(a)lists.fedorahosted.org<mailto:sssd-devel@lists.fedorahosted.org>; sssd-users(a)lists.fedorahosted.org<mailto:sssd-users@lists.fedorahosted.org>; freeipa-interest(a)redhat.com<mailto:freeipa-interest@redhat.com> Subject: [SSSD-users] Announcing SSSD 1.9.2 === SSSD 1.9.2 === The SSSD team is proud to announce the release of version 1.9.2 of the System Security Services Daemon. This is mostly a bugfix release again. I am going to branch off the 1.9 branch from master so that we can start including the 1.10 features in master. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly, initially for F-18 and rawhide and later also backported to F-17. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Users or groups from trusted domains can be retrieved by UID or GID as well * Several fixes that mitigate file descriptor leak during logins * SSH host keys are also removed from the cache after being removed from the server * Fix intermittent crash in responders if the responder was shutting down while requests were still pending * Catch an error condition that might have caused a tight loop in the sssd_nss process while refreshing expired enumeration request * Fixed memory hierarchy of subdomains discovery requests that caused use-after-free access bugs * The krb5_child and ldap_child processes can print libkrb5 tracing information in the debug logs == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1008 Make sssd api conf file location configurable https://fedorahosted.org/sssd/ticket/1319 group lookups optimizations for IPA https://fedorahosted.org/sssd/ticket/1499 Add details about TGT validation to sssd-krb5 man page https://fedorahosted.org/sssd/ticket/1512 [sssd[krb5_child[PID]]]: Credential cache directory /run/user/UID/ccdir does not exist https://fedorahosted.org/sssd/ticket/1514 [abrt] sssd-1.8.4-13.fc16: __GI_exit: Process /usr/libexec/sssd/sssd_pam was killed by signal 6 (SIGABRT) https://fedorahosted.org/sssd/ticket/1539 Collect Krb5 Trace on High Debug Levels https://fedorahosted.org/sssd/ticket/1551 sssd_nss process hangs, stuck in loop; "self restart" does recover, but old process hangs around using 100% CPU https://fedorahosted.org/sssd/ticket/1561 getting user/group entry by uid/gid sometimes fails https://fedorahosted.org/sssd/ticket/1569 Use pam_set_data to close the fd in the pam module https://fedorahosted.org/sssd/ticket/1571 sssd_nss intermittent crash https://fedorahosted.org/sssd/ticket/1574 SSH host keys are not being removed from the cache == Packaging Changes == * The libsss_sudo-devel package no longer contains the package-config file. The libsss_sudo-devel shared object has been moved to the libsss_sudo package. == Detailed Changelog == E Deon Lackey (1): * Fix language errors in the sssd-krb5.conf man page Jakub Hrozek (14): * Bumping the version to 1.9.1 release * Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hosts * Fix segfault when ID-mapping an entry without a SID * Fix memory hierarchy in subdomains discovery * PAM: close socket fd with pam_set_data * Couple of specfile fixes * Remove libsss_sudo.pc and move libsss_sudo.so to libsss_sudo * Two fixes to child processes * Collect krb5 trace on high debug levels * PAM: fix handling the client fd in pam destructor * Create ghost users when a user DN is encountered in IPA * Only call krb5_set_trace_callback on platforms that support it * MAN: improve wording of default_domain parameter * Updating the translations for the 1.9.2 release Jan Cholasta (1): * SSH: When host keys are removed from LDAP, remove them from the cache as well Ondrej Kos (1): * Add more info about ticket validation Pavel Březina (3): * do not fail if POLLHUP occurs while reading data * do not call dp callbacks when responder is shutting down * nss_cmd_retpwent(): do not go into infinite loop if n < 0 Sumit Bose (3): * Save time of last get_domains request * Check for subdomains if getpwuid or getgrgid are the first requests * Allow extdom exop to return flat domain name as well Thorsten Scherf (1): * Fixed: translation bug Yuri Chornoivan (1): * Fix typos _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org<mailto:sssd-users@lists.fedorahosted.org> https://lists.fedorahosted.org/mailman/listinfo/sssd-users _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org<mailto:sssd-users@lists.fedorahosted.org> https://lists.fedorahosted.org/mailman/listinfo/sssd-users _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org<mailto:sssd-users@lists.fedorahosted.org> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 1

Active Directory Integration test day coming up on Thursday, 2012-10-18
by Jakub Hrozek 16 Oct '12

16 Oct '12

Hi, The Fedora Test day scheduled for Thursday, October 18th is focused on Active Directory integration, in particular the realmd project and to some extent the Active Directory provider of the SSSD. This test day should be of particular interest to admins who manage Linux boxes enrolled in an Active Directory domain. As usual, join us in #fedora-test-day on FreeNode IRC. All the test instructions are on the wiki: https://fedoraproject.org/wiki/Test_Day:2012-10-18_Active_Directory See the full feature page at if you'd like to learn more about the feature: http://fedoraproject.org/wiki/Features/ActiveDirectory If you are interested and have the spare cycles, please join us during this Fedora Test day and help us make sure that Fedora 18 works with Active Directory out of the box!

1 0

sssd and difrent repositories
by Longina Przybyszewska 16 Oct '12

16 Oct '12

Hi list, I am going to set up proof-of -concept installation of Ubuntu (Precise) client/server using sssd to authenticate/authorize against Active Directory. At this moment everything seems to be a challenge - as I am exclusive (ok ;-) almost exclusive... ) hard core Linux user. As our Windows team is not ready with AD schema for Unix - my first exercise could be -get login/ssh authenticate (and change passwd) against AD -get uid/gid/auto.home map/shell from existing Linux NIS server Is my plan realistic ? Best regards Longina Przybyszewska Systemprogrammør, IT Services Tel. +45 6550 2359 Mobile +45 6011 2359 Fax +45 6550 2467 Email longina(a)sdu.dk Web http://www.sdu.dk/ansat/longina Addr. Campusvej 55, DK-5230 Odense M, Denmark UNIVERSITY OF SOUTHERN DENMARK _______________________________________________________________ Campusvej 55 * DK-5230 * Odense M * Denmark * Tel. +45 6550 1000 * www.sdu.dk -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Jakub Hrozek Sent: 12. oktober 2012 22:40 To: sssd-devel(a)lists.fedorahosted.org; sssd-users(a)lists.fedorahosted.org; freeipa-interest(a)redhat.com Subject: [SSSD-users] Announcing SSSD 1.9.2 === SSSD 1.9.2 === The SSSD team is proud to announce the release of version 1.9.2 of the System Security Services Daemon. This is mostly a bugfix release again. I am going to branch off the 1.9 branch from master so that we can start including the 1.10 features in master. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly, initially for F-18 and rawhide and later also backported to F-17. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Users or groups from trusted domains can be retrieved by UID or GID as well * Several fixes that mitigate file descriptor leak during logins * SSH host keys are also removed from the cache after being removed from the server * Fix intermittent crash in responders if the responder was shutting down while requests were still pending * Catch an error condition that might have caused a tight loop in the sssd_nss process while refreshing expired enumeration request * Fixed memory hierarchy of subdomains discovery requests that caused use-after-free access bugs * The krb5_child and ldap_child processes can print libkrb5 tracing information in the debug logs == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1008 Make sssd api conf file location configurable https://fedorahosted.org/sssd/ticket/1319 group lookups optimizations for IPA https://fedorahosted.org/sssd/ticket/1499 Add details about TGT validation to sssd-krb5 man page https://fedorahosted.org/sssd/ticket/1512 [sssd[krb5_child[PID]]]: Credential cache directory /run/user/UID/ccdir does not exist https://fedorahosted.org/sssd/ticket/1514 [abrt] sssd-1.8.4-13.fc16: __GI_exit: Process /usr/libexec/sssd/sssd_pam was killed by signal 6 (SIGABRT) https://fedorahosted.org/sssd/ticket/1539 Collect Krb5 Trace on High Debug Levels https://fedorahosted.org/sssd/ticket/1551 sssd_nss process hangs, stuck in loop; "self restart" does recover, but old process hangs around using 100% CPU https://fedorahosted.org/sssd/ticket/1561 getting user/group entry by uid/gid sometimes fails https://fedorahosted.org/sssd/ticket/1569 Use pam_set_data to close the fd in the pam module https://fedorahosted.org/sssd/ticket/1571 sssd_nss intermittent crash https://fedorahosted.org/sssd/ticket/1574 SSH host keys are not being removed from the cache == Packaging Changes == * The libsss_sudo-devel package no longer contains the package-config file. The libsss_sudo-devel shared object has been moved to the libsss_sudo package. == Detailed Changelog == E Deon Lackey (1): * Fix language errors in the sssd-krb5.conf man page Jakub Hrozek (14): * Bumping the version to 1.9.1 release * Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hosts * Fix segfault when ID-mapping an entry without a SID * Fix memory hierarchy in subdomains discovery * PAM: close socket fd with pam_set_data * Couple of specfile fixes * Remove libsss_sudo.pc and move libsss_sudo.so to libsss_sudo * Two fixes to child processes * Collect krb5 trace on high debug levels * PAM: fix handling the client fd in pam destructor * Create ghost users when a user DN is encountered in IPA * Only call krb5_set_trace_callback on platforms that support it * MAN: improve wording of default_domain parameter * Updating the translations for the 1.9.2 release Jan Cholasta (1): * SSH: When host keys are removed from LDAP, remove them from the cache as well Ondrej Kos (1): * Add more info about ticket validation Pavel Březina (3): * do not fail if POLLHUP occurs while reading data * do not call dp callbacks when responder is shutting down * nss_cmd_retpwent(): do not go into infinite loop if n < 0 Sumit Bose (3): * Save time of last get_domains request * Check for subdomains if getpwuid or getgrgid are the first requests * Allow extdom exop to return flat domain name as well Thorsten Scherf (1): * Fixed: translation bug Yuri Chornoivan (1): * Fix typos _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

4 5

Re: [SSSD-users] sssd and different repositories
by Longina Przybyszewska 16 Oct '12

16 Oct '12

Ubuntu Precise has sssd-1.8.2 I use ' msktutil' - a very nice utility for joining AD domain. It is easy to join a bunch of computers and renew expired passwds with it. Realmd project looks interessant too. longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Jakub Hrozek Sent: 16. oktober 2012 14:13 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] sssd and different repositories On Tue, Oct 16, 2012 at 10:21:02AM +0000, Longina Przybyszewska wrote: > Hi list, > I am going to set up proof-of -concept installation of Ubuntu > (Precise) client/server using sssd to authenticate/authorize against Active Directory. > At this moment everything seems to be a challenge - as I am exclusive (ok ;-) almost exclusive... ) hard core Linux user. > > As our Windows team is not ready with AD schema for Unix - my first > exercise could be -get login/ssh authenticate (and change passwd) > against AD -get uid/gid/auto.home map/shell from existing Linux NIS > server > > Is my plan realistic ? I'm not sure what version of the SSSD does Ubuntu Precise ship, but I would recommend using 1.9.x and the AD provider. You might also want to look into the realmd project, that could simplify joining an AD domain for you. _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

1 0

Announcing SSSD 1.9.2
by Jakub Hrozek 12 Oct '12

12 Oct '12

=== SSSD 1.9.2 === The SSSD team is proud to announce the release of version 1.9.2 of the System Security Services Daemon. This is mostly a bugfix release again. I am going to branch off the 1.9 branch from master so that we can start including the 1.10 features in master. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly, initially for F-18 and rawhide and later also backported to F-17. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Users or groups from trusted domains can be retrieved by UID or GID as well * Several fixes that mitigate file descriptor leak during logins * SSH host keys are also removed from the cache after being removed from the server * Fix intermittent crash in responders if the responder was shutting down while requests were still pending * Catch an error condition that might have caused a tight loop in the sssd_nss process while refreshing expired enumeration request * Fixed memory hierarchy of subdomains discovery requests that caused use-after-free access bugs * The krb5_child and ldap_child processes can print libkrb5 tracing information in the debug logs == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1008 Make sssd api conf file location configurable https://fedorahosted.org/sssd/ticket/1319 group lookups optimizations for IPA https://fedorahosted.org/sssd/ticket/1499 Add details about TGT validation to sssd-krb5 man page https://fedorahosted.org/sssd/ticket/1512 [sssd[krb5_child[PID]]]: Credential cache directory /run/user/UID/ccdir does not exist https://fedorahosted.org/sssd/ticket/1514 [abrt] sssd-1.8.4-13.fc16: __GI_exit: Process /usr/libexec/sssd/sssd_pam was killed by signal 6 (SIGABRT) https://fedorahosted.org/sssd/ticket/1539 Collect Krb5 Trace on High Debug Levels https://fedorahosted.org/sssd/ticket/1551 sssd_nss process hangs, stuck in loop; "self restart" does recover, but old process hangs around using 100% CPU https://fedorahosted.org/sssd/ticket/1561 getting user/group entry by uid/gid sometimes fails https://fedorahosted.org/sssd/ticket/1569 Use pam_set_data to close the fd in the pam module https://fedorahosted.org/sssd/ticket/1571 sssd_nss intermittent crash https://fedorahosted.org/sssd/ticket/1574 SSH host keys are not being removed from the cache == Packaging Changes == * The libsss_sudo-devel package no longer contains the package-config file. The libsss_sudo-devel shared object has been moved to the libsss_sudo package. == Detailed Changelog == E Deon Lackey (1): * Fix language errors in the sssd-krb5.conf man page Jakub Hrozek (14): * Bumping the version to 1.9.1 release * Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hosts * Fix segfault when ID-mapping an entry without a SID * Fix memory hierarchy in subdomains discovery * PAM: close socket fd with pam_set_data * Couple of specfile fixes * Remove libsss_sudo.pc and move libsss_sudo.so to libsss_sudo * Two fixes to child processes * Collect krb5 trace on high debug levels * PAM: fix handling the client fd in pam destructor * Create ghost users when a user DN is encountered in IPA * Only call krb5_set_trace_callback on platforms that support it * MAN: improve wording of default_domain parameter * Updating the translations for the 1.9.2 release Jan Cholasta (1): * SSH: When host keys are removed from LDAP, remove them from the cache as well Ondrej Kos (1): * Add more info about ticket validation Pavel Březina (3): * do not fail if POLLHUP occurs while reading data * do not call dp callbacks when responder is shutting down * nss_cmd_retpwent(): do not go into infinite loop if n < 0 Sumit Bose (3): * Save time of last get_domains request * Check for subdomains if getpwuid or getgrgid are the first requests * Allow extdom exop to return flat domain name as well Thorsten Scherf (1): * Fixed: translation bug Yuri Chornoivan (1): * Fix typos

1 0

Announcing SSSD 1.8.5
by Jakub Hrozek 07 Oct '12

07 Oct '12

=== SSSD 1.8.5 === The SSSD team is proud to announce the bugfix release of the System Security Services Daemon version 1.8.5. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly, this time for F-16 and F-17. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Fixed a potential segfault when SRV records are used to discover services * The client libraries now use robust mutexes to avoid a potential deadlock if a thread was cancelled while holding a mutex * Do not return an error when the SELinux support is not configured * Fixed returning an error to the PAM stack when the SSSD was performing authentication but the kpasswd server was unreachable * The SSSD used to skip a whole nesting level instead of a single already processed group when loading nested group membership structure * Added support for terminating idle connections and make the idle timeout configurable * The sss_ssh_knownostsproxy command no longer aborts when processing a host without DNS records * The shadowLastChange attribute is noe correctly updated with days since the Epoch, not seconds == Tickets Fixed == * https://fedorahosted.org/sssd/ticket/1356 SSH: Don't abort connection in sss_ssh_knownhostsproxy when DNS records are missing * https://fedorahosted.org/sssd/ticket/1271 Use HTML_TIMESTAMP instead of HTML_FOOTER_DESCRIPTION * https://fedorahosted.org/sssd/ticket/1360 Provide "service filter" for SELinux context * https://fedorahosted.org/sssd/ticket/1354 Add support for terminating idle connections * https://fedorahosted.org/sssd/ticket/1452 KRB5: Only return PAM error for unreachable kpasswd when performing chpass * https://fedorahosted.org/sssd/ticket/1419 Fixed wrong number in shadowLastChange * https://fedorahosted.org/sssd/ticket/1460 Use PTHREAD_MUTEX_ROBUST to avoid deadlock in the client * https://fedorahosted.org/sssd/ticket/1515 KRB5: Return PAM_AUTH_ERR on incorrect password * https://fedorahosted.org/sssd/ticket/1364 FO: Check server validity before setting status == Detailed Changelog == Jakub Hrozek (8): * Use HTML_TIMESTAMP instead of HTML_FOOTER_DESCRIPTION * Send the correct enumeration request * Process all groups from a single nesting level * SYSDB: Make sysdb_attrs_get_el_int() public * KRB5: Only return PAM error for unreachable kpasswd when performing chpass * Use PTHREAD_MUTEX_ROBUST to avoid deadlock in the client * KRB5: Return PAM_AUTH_ERR on incorrect password * FO: Check server validity before setting status Jan Cholasta (3): * SSH: Update sss_ssh_knownhostsproxy manual page * SSH: Supress error message output in sss_ssh_knownhostsproxy * SSH: Don't abort connection in sss_ssh_knownhostsproxy when DNS records are missing Jan Zeleny (2): * Provide "service filter" for SELinux context * Fixed wrong number in shadowLastChange Shantanu Goel (4): * Set return errno to the value prior to calling close(). * Log message if close() fails in destructor. * Do not send SIGPIPE on disconnection * Add support for terminating idle connections Stephen Gallagher (2): * Bumping version to 1.8.5 * Make the client idle timeout configurable Timo Aaltonen (1): * Move SELinux processing from session to account PAM stack

1 0

[SSSD] Announcing SSSD 1.9.1
by Jakub Hrozek 05 Oct '12

05 Oct '12

=== SSSD 1.9.1 === The SSSD team is proud to announce the release of version 1.9.1 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly, initially for F-18 and rawhide and later also backported to F-17. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The distribution tarball was fixed to include a missing file, which prevented "make rpms" from running correctly. * Handle gracefully the situation where the namingContext is zero-length, such as when connected to the Novell eDirectory server. * A new option default_domain_suffix was added. This option is mainly useful for environments whose users come from a trusted domain so that the user doesn't have to specify that trusted domain with every user lookup. * Many man page fixes that were held from the 1.9.0 release during the string freeze * The entries in the generated known_hosts file are now expired preventing the file from growing indefinitely * The PID file is now created after all the SSSD services start up to avoid notifying the user via the init system before SSSD is able to handle requests. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1303 SSSD is slow at startup https://fedorahosted.org/sssd/ticket/1357 Init script reports complete before sssd is actually working https://fedorahosted.org/sssd/ticket/1471 Range Retrieval: Unable to retrieve all members when filter is used in search base. https://fedorahosted.org/sssd/ticket/1483 Mention ldap_schema types on newlines or comma separate them. https://fedorahosted.org/sssd/ticket/1494 ldap_chpass_update_last_change is not included in the manual page https://fedorahosted.org/sssd/ticket/1525 Explain default re_expression in IPA and AD provider man pages https://fedorahosted.org/sssd/ticket/1529 [RFE] Login with users from a trusted domain always requires a FQ name https://fedorahosted.org/sssd/ticket/1533 Improve recreating new ccache file when the old one is not accessible any more https://fedorahosted.org/sssd/ticket/1535 Flip the default value of ldap_initgroups_use_matching_rule_in_chain https://fedorahosted.org/sssd/ticket/1537 Fix sssd-ad id ranges https://fedorahosted.org/sssd/ticket/1540 [man sssd-ldap] 'ldap_access_filter' description needs to be updated https://fedorahosted.org/sssd/ticket/1541 Manpage has ldap_autofs_search_base as experimental feature https://fedorahosted.org/sssd/ticket/1542 User authentication using LDAP doesn't work https://fedorahosted.org/sssd/ticket/1546 sss_seed "-h" and "--help" options should output similar results https://fedorahosted.org/sssd/ticket/1548 User authentication fails when password is read from a file using -p option of SSS_SEED tool. https://fedorahosted.org/sssd/ticket/1549 Providing invalid UID/GID values, terminates sss_seed tool without any error message https://fedorahosted.org/sssd/ticket/1554 sss_seed should not allow blank passwords https://fedorahosted.org/sssd/ticket/1562 Domains overlap in range 1 - 4294967295 https://fedorahosted.org/sssd/ticket/1563 Document the need to restart autofs service. == Detailed Changelog == Jakub Hrozek (11): * Bumping the version to 1.9.1 release * Document ldap_chpass_update_last_change * sudo and autofs search bases should not be marked experimental * Flip the default value of ldap_initgroups_use_matching_rule_in_chain * Include param_help_py.xml in the list of po4a sources * Note that Range Retrieval is not supported when filter is used in the search base. * Change the log level of two DEBUG messages in check_domain_ranges * Remove unused variable * Check for existing pidfile before starting the providers * man: Note that automounter must be restarted to re-read the master map * Updating the translations for 1.9.1 release Jan Cholasta (2): * SSH: Refactor sysdb and related code * SSH: Expire hosts in known_hosts Michal Zidek (7): * Change option to display help message in man pages. * sss_seed: Option --debug did not work in sss_seed tool. * sss_seed: Show error message when interactive input fails. * sss_seed: Make only first line of password file valid. * sss_seed: Passwords longer then PASS_MAX not allowed. * sss_seed: Improved error message when the domain does not exist. * Variable in sdap_sudo_rules_refresh_send could be used, uninitialized. Ondrej Kos (4): * sssd-ldap manpage: ldap_scheme formatting * Log possibly non-randomizable ccache file template * Slices calculation is alway wrong for default values * Fix default upper limit of slices Pavel Březina (5): * Fix few coding style issues * monitor: create pid file after all responders are started * remove left over principal selection * manpage: ldap_access_filter is not always mandatory * do not create pid file twice Stephen Gallagher (2): * LDAP: Handle empty namingContexts values safely * BUILD: Include the patch file in the tarball Sumit Bose (4): * Add new option default_domain_suffix * Use flat name for master domain as well * sysdb_master_domain_get_info: fix copy-and-paste error * Add man page section about provider specific re_expression

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2012