June 2014 - sssd-users - Fedora mailing-lists

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

sssd_sudo receives 0 rules but ldap search returns 5, what is wrong?
by Teemu Keinonen 22 Jul '14

22 Jul '14

Hello, I’m configuring CentOS 6.5 server to authenticate users and sudo rights against local Samba 4.1.8 (compiled from source). Sssd is 1.9.2 from package repository. User authentication works OK, I can log in with user that exists only in Samba but sudoing with the same user fails. After hours of trying I still can’t get it right, sssd_sudo receives 0 rules from samba. Doing ldapsearch with criteria from logs do return sudoer entries as below. Am I missing something obvious? Below are (in order) ldapsearch, ssssd.conf and sssd_default.log (part which I think relevant). [root@dc1 sssd]# ldapsearch -h dc1 -Y GSSAPI -b OU=SUDOers,DC=teemu,DC=local '(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=Host01)(sudoHost=Host01.example.com)(sudoHost=192.168.0.21)(sudoHost=192.168.0.0/24)(sudoHost=fe80::786b:f4ff:fe87:3314)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))' SASL/GSSAPI authentication started SASL username: administrator(a)TEEMU.LOCAL SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <OU=SUDOers,DC=teemu,DC=local> with scope subtree # filter: (&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)(sudoHost=Host01)(sudoHost=Host01.example.com)(sudoHost=192.168.0.21)(sudoHost=192.168.0.0/24)(sudoHost=fe80::786b:f4ff:fe87:3314)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*)))) # requesting: ALL # # defaults, SUDOers, teemu.local dn: CN=defaults,OU=SUDOers,DC=teemu,DC=local objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here instanceType: 4 whenCreated: 20140625194645.0Z whenChanged: 20140625194645.0Z uSNCreated: 3798 uSNChanged: 3798 name: defaults objectGUID:: vrCxbL/QkUGFyZWvELWj/w== objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=teemu,DC=local sudoOption: env_keep+=SSH_AUTH_SOCK distinguishedName: CN=defaults,OU=SUDOers,DC=teemu,DC=local # %wheel, SUDOers, teemu.local dn: CN=%wheel,OU=SUDOers,DC=teemu,DC=local objectClass: top objectClass: sudoRole cn: %wheel instanceType: 4 whenCreated: 20140626094147.0Z whenChanged: 20140626094147.0Z uSNCreated: 3800 uSNChanged: 3800 name: %wheel objectGUID:: jpGX5AmGUkimPw1yl+oZkA== objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=teemu,DC=local sudoUser: %wheel sudoHost: ALL sudoCommand: ALL distinguishedName: CN=%wheel,OU=SUDOers,DC=teemu,DC=local # reima, SUDOers, teemu.local dn: CN=reima,OU=SUDOers,DC=teemu,DC=local objectClass: top objectClass: sudoRole cn: reima instanceType: 4 whenCreated: 20140625194650.0Z whenChanged: 20140625194650.0Z uSNCreated: 3799 uSNChanged: 3799 name: reima objectGUID:: U1paZdVOSke2zmInSenFTg== objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=teemu,DC=local sudoUser: reima sudoHost: ALL sudoCommand: ALL distinguishedName: CN=reima,OU=SUDOers,DC=teemu,DC=local # search result search: 4 result: 0 Success # numResponses: 4 # numEntries: 3 Sssd.conf: [sssd] services = nss, pam, sudo config_file_version = 2 domains = default debug_level = 10 [nss] [pam] [sudo] debug_level = 10 [domain/default] debug_level = 10 id_provider = ldap sudo_provider = ldap ldap_schema = rfc2307bis ldap_referrals = false ldap_uri = ldap://dc1.teemu.local ldap_search_base = cn=Users,dc=teemu,dc=local ldap_sudo_search_base = ou=sudoers,dc=teemu,dc=local ldap_force_upper_case_realm = true # See man sssd-simple access_provider = simple # Uncomment to check for account expiration in DC # access_provider = ldap # ldap_access_order = expire # ldap_account_expire_policy = ad # Enumeration is discouraged for performance reasons. # enumerate = true ldap_default_bind_dn = cn=Administrator,cn=Users,dc=teemu,dc=local ldap_default_authtok = XXXXXX auth_provider = krb5 chpass_provider = krb5 ldap_sasl_mech = gssapi ldap_sasl_authid = dc1$(a)TEEMU.LOCAL krb5_realm = TEEMU.LOCAL krb5_server = dc1.teemu.local krb5_kpasswd = dc1.teemu.local ldap_krb5_keytab = /etc/krb5.sssd.keytab ldap_user_object_class = user ldap_user_name = samAccountName ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_user_shell = loginShell ldap_group_object_class = group sssd_default.log: (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_sudo_refresh_connect_done] (0x0400): SUDO LDAP connection successful (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_sudo_load_sudoers_next_base] (0x0400): Searching for sudo rules with base [ou=sudoers,dc=teemu,dc=local] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=sudoRole)(|(!(sudoHost=*))(sudoHost=ALL)\ (sudoHost=dc1)(sudoHost=dc1)(sudoHost=10.0.2.15)(sudoHost=10.0.2.0/24)(sudoHost=192.168.1.1)(sudoHost=192.168.1.0/24)(sudoHost=fe80::a00:27ff:fede:ba44)(sudoHost=fe80::/6\ 4)(sudoHost=fe80::a00:27ff:fef3:dc1)(sudoHost=fe80::/64)(sudoHost=+*)(|(sudoHost=*\\*)(sudoHost=*?*)(sudoHost=*\**)(sudoHost=*[*]*))))][ou=sudoers,dc=teemu,dc=local]. (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoCommand] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoHost] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoUser] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOption] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsUser] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoRunAsGroup] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotBefore] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoNotAfter] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sudoOrder] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 12 (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_process_result] (0x2000): Trace: sh[0xfed4e0], connected[1], ops[0xff7c20], ldap[0xfedba0] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_get_generic_ext_done] (0x1000): Total count [0] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_sudo_load_sudoers_process] (0x0400): Receiving sudo rules with base [ou=sudoers,dc=teemu,dc=local] (Fri Jun 27 14:56:27 2014) [sssd[be[default]]] [sdap_sudo_load_sudoers_done] (0x0400): Received 0 rules

6 21

Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04[SOLVED]
by Longina Przybyszewska 09 Jul '14

09 Jul '14

I installed another machine, using the same procedure as for the previous one; DNS entry is created, but dyndns updates fail exactly as for the first one: both machines discover the same active DNS server, to which try to send updated A records (I have no access to the log, but asked my AD-admins colleges to look into). sssd.conf : [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd [sssd] debug_level = 6 domains =nat.domain.org config_file_version = 2 services = nss, pam [domain/nat.domain.org] debug_level = 7 ad_domain = nat.domain.org krb5_realm = NAT.DOMAIN.ORG realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad auth_provider = ad access_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u # dyndns_update = true Best Longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of steve Sent: 20. juni 2014 17:42 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04[SOLVED] (fwd) On Fri, 2014-06-20 at 07:37 +0000, Longina Przybyszewska wrote: > > The same happened to the keytab file. Here the right one, corresponding to the log file. > 2 05/19/2014 10:36:55 SKYWALKER$(a)NAT.DOMAIN.ORG > Hi And the corresponding sssd.conf? Anyway, sssd is sending the correct stuff to nsupdate for the forward rr but the log ends there, so assuming it fails for the reverse too. Another good way of debugging it is to perform the update by hand using nsupdate -g Do you have access to the AD dns logs? HTH Steve _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

4 29

Get error "Incorrect Password" when su to a ldap user with password prompt
by XuQing Tan 01 Jul '14

01 Jul '14

Hi folks i setup sssd 1.9.2 on centos 6 x64 i can get the user info via 'id <user>' i can su to that user as root (no password prompt since i'm root) [root@nick-ldap ~]# su - nick -sh-4.1$ exit logout but i can't su to this user as non-root (with password prompt but get incorrect password error) [root@nick-ldap ~]# su - demo [demo@nick-ldap ~]$ su - nick Password: su: incorrect password [demo@nick-ldap ~]$ do you have anyideas why i got this? thanks Thanks & Best Regards! /// (. .) --------ooO--(_)--Ooo-------- | Nick Tan | ------------------------------------

3 3

Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04[NOT-SOLVED]
by Longina Przybyszewska 25 Jun '14

25 Jun '14

> How SSSD resolves domainname for machine for supplying to nsupdate record? sssd doesn't do anything. nsupdate sends the dns update calls to whatever you have put in /etc/resolv.conf This is not true in my case: ---- /etc/resolv.conf: # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 10.220.2.5 search c.sdu.dk ---- .(Wed Jun 25 12:09:18 2014) [sssd[be[nat.c.sdu.dk]]] [be_nsupdate_create_ptr_msg] (0x0400): -- Begin nsupdate message -- server nat-vdc0b.nat.c.sdu.dk realm NAT.C.SDU.DK update delete 254.4.144.10.in-addr.arpa. in PTR update add 254.4.144.10.in-addr.arpa. 3600 in PTR eta.nat.c.sdu.dk. send (Wed Jun 25 12:09:18 2014) [sssd[be[nat.c.sdu.dk]]] [be_nsupdate_create_ptr_msg] (0x0400): -- End nsupdate message -- ---- host nat-vdc0b.nat.c.sdu.dk nat-vdc0b.nat.c.sdu.dk has address 10.144.5.18 --- Host nat-vdc0b.xxx.xxx.xxx is LDAP/AD _not_ DNSserver. Best, Longina _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 3

How to specify objectClass in search_base?
by Sven Geggus 25 Jun '14

25 Jun '14

Hello, with nslcd I do the following to simulate user private groups without actually creating them in the directory server: ... filter group (&(|(objectClass=Group)(&(!(userAccountControl:1.2.840.113556.1.4.803:=2))(objectClass=User)))(msSFU30NisDomain=example)) ... I tried porting this to sssd using the following: ldap_group_search_base = DC=example,DC=com?subtree?(&(|(objectClass=Group)(&(!(userAccountControl:1.2.840.113556.1.4.803:=2))(objectClass=User)))(msSFU30NisDomain=example)) Unfortunately this does not work as expected. Any Idea how this would be done in sssd? Regards Sven -- "linux is evolution, not intelligent design" (Linus Torvalds) /me is giggls@ircnet, http://sven.gegg.us/ on the Web

3 4

SSSD 1.11 for Ubuntu Lucid
by Jay McCanta 25 Jun '14

25 Jun '14

My apologies if this isn't the right place for this request. I'm looking for sssd ad backend that supports AD domain trusts (within the same forest) and user filtering. As I understand things, that would be 1.11. Has anyone been able to build 1.11 for Ubuntu Lucid? I don't mind having to build some of the extra libraries. I'm just hoping it's been either done or at the very least doable. Thanks to all involved. Jay McCanta F5 Networks, Inc. Seattle, WA There are two kinds of people in the world, those with cleaver signature lines, and me.

5 4

Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04[SOLVED] (fwd)
by Longina Przybyszewska 20 Jun '14

20 Jun '14

Log file d7 as attachment. root@skywalker:/tmp# cat /etc/sssd/sssd.conf [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd [sssd] debug_level = 6 domains =nat.c.sdu.dk config_file_version = 2 services = nss, pam [domain/nat.c.sdu.dk] debug_level = 7 ad_domain = nat.c.sdu.dk krb5_realm = NAT.C.SDU.DK realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad auth_provider = ad access_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u # dyndns_update = true best, Longina --

2 4

Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04 [SOLVED]]
by Longina Przybyszewska 19 Jun '14

19 Jun '14

I hit the same problem "ddns failure" with desktop client Ubuntu 14.04. Following discussion, my setup seems to be correct, but host record disappeared from DNS and can't be updated. After joining with 'realm' DNS A record was correct set up. I work on laptop which I use to suspend overnight. Debug output: root@skywalker:/home-local/longinap# cat /etc/hostnames skywalker root@skywalker:/home-local/longinap# cat /etc/hosts 127.0.0.1 localhost 127.0.1.1 skywalker.domain.org skywalker 10.144.4.254 zeta.domain.org zeta ---------------------------- root@skywalker:/home-local/longinap# hostname -s skywalker root@skywalker:/home-local/longinap# hostname -f skywalker.domain.org root@skywalker:/home-local/longinap# dnsdomainname domain.org root@skywalker:/home-local/longinap# cat /etc/nsswitch.conf # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: compat sss group: compat sss shadow: compat #hosts: files mdns4_minimal [NOTFOUND=return] dns hosts: files dns myhostname networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis sss sudoers: files sss --------------------------------- longinap@skywalker:~$ host skywalker.domain.org Host skywalker.domain.org not found: 3(NXDOMAIN) ---------------/var/log/sssd...---------------------- [sssd[be[domain.org]]] [sdap_dyndns_update_done] (0x0080): nsupdate failed, retrying with server name [sssd[be[domain.org]]] [nsupdate_msg_create_common] (0x0200): Creating update message for server [nat-vdc0a.domain.org] and realm [DOMAIN.ORG] . [sssd[be[domain.org]]] [be_nsupdate_create_fwd_msg] (0x0400): -- Begin nsupdate message -- server nat-vdc0a.domain.org realm DOMAIN.ORG update delete skywalker. in A send update delete skywalker. in AAAA send update add skywalker. 3600 in A 10.80.8.91 send [sssd[be[domain.org]]] [be_nsupdate_create_fwd_msg] (0x0400): -- End nsupdate message -- [sssd[be[domain.org]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [5338] [sssd[be[domain.org]]] [child_handler_setup] (0x2000): Signal handler set up for pid [5338] [sssd[be[domain.org]]] [write_pipe_handler] (0x0400): All data has been sent! [sssd[be[domain.org]]] [be_nsupdate_args] (0x0200): [sssd[be[domain.org]]] [nsupdate_child_stdin_done] (0x1000): nsupdate auth type: GSS-TSIG Sending nsupdate data complete [sssd[be[domain.org]]] [sbus_dispatch] (0x4000): dbus conn: 0x1cbdca0 [sssd[be[domain.org]]] [sbus_dispatch] (0x4000): Dispatching. [sssd[be[domain.org]]] [sbus_message_handler] (0x4000): Received SBUS method [ping] [sssd[be[domain.org]]] [nsupdate_child_timeout] (0x0020): Timeout reached for dynamic DNS update [sssd[be[domain.org]]] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158229]: Dynamic DNS update timed out [sssd[be[domain.org]]] [sdap_id_op_destroy] (0x4000): releasing operation connection [sssd[be[domain.org]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158229]: Dynamic DNS update timed out [sssd[be[domain.org]]] [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158229]: Dynamic DNS update timed out [sssd[be[domain.org]]] [child_sig_handler] (0x1000): Waiting for child [5338]. [sssd[be[domain.org]]] [child_sig_handler] (0x0020): child [5338] was terminated by signal [9]. Best, Longina -----Original Message----- From: sssd-users-bounces(a)lists.fedorahosted.org [mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of Stephen Gallagher Sent: 22. maj 2014 15:44 To: sssd-users(a)lists.fedorahosted.org Subject: Re: [SSSD-users] 1.11.5 ddns failure on Ubuntu 14.04 [SOLVED] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/22/2014 09:28 AM, Rowland Penny wrote: > On 22/05/14 14:06, Stephen Gallagher wrote: On 05/22/2014 08:55 AM, > Rowland Penny wrote: >>>> On 22/05/14 13:50, John Hodrien wrote: >>>>> On Thu, 22 May 2014, Rowland Penny wrote: >>>>> >>>>>> Not on Ubuntu it isn't ;-) >>>>> I'd argue that Ubuntu just has incorrect behaviour then. >>>>> >>>>> If you look at man hosts on an ubuntu machine (13.10), you'll see >>>>> how they describe it, and the example they provide. The format >>>>> described is: >>>>> >>>>> IP_address canonical_hostname [aliases...] >>>>> >>>>> The example is: >>>>> >>>>> 127.0.0.1 localhost 192.168.1.10 foo.mydomain.org >>>>> foo 192.168.1.13 bar.mydomain.org bar >>>>> >>>>> That's the correct format, whether or not Ubuntu applies it. >>>> Thats all very well for a machine with a fixed ip but what about >>>> DHCP ? >>>> > Well, once they adopt systemd, they'll get to start using hosts: > files dns myhostname > >> OK, 'files dns' I understand but 'myhostname' ? I think that means >> that DHCP will store the machines identity in a file somewhere, is >> this correct and if so where ? myhostname is a name-service module that just asks systemd to tell it what IP addresses the system has and what the system's hostname is supposed to be. Then it "magically" returns all the correct and up-to-the-minute information. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlN9/zAACgkQeiVVYja6o6P8hQCggdW2ZtWNYzS9ARsVdXhpDyvH 7+4AoIHnHW4BCv4mm+VwDZxHZuBJkrrK =VGKa -----END PGP SIGNATURE----- _______________________________________________ sssd-users mailing list sssd-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-users

2 3

sssd + realm + SPN
by Longina Przybyszewska 18 Jun '14

18 Jun '14

It could be very convenient to have the same method for both joining machine and adding service principal names with 'realmd', everything done from Linux box. Do you have plans for that option in realmd? Best, Longina

3 4

org structure as user/group structure?
by Max Lock 18 Jun '14

18 Jun '14

Hi All, I'm querying an AD server using LDAP lookups only. I can authenticate a user just fine but the groups configured on the AD system aren't relevant to what we're doing. Looking at the the sssd-ldap man page, the ldap_group options look like they may be used to modify the group lookups to look at user data instead. In each user record we have directReports: and manager: attributes. Could these be used so that if Alice reports to Bob she's mapped to the Bob group etc? -Cheers Max. The information contained in this email, including any attachments, is intended solely for use by the individual or entity named above and may be confidential. If you have received this email in error please delete it and notify the sender immediately; you should not retain the message or disclose its contents to anyone. Thank you. hibu (UK) Limited, One Reading Central, Forbury Road, Reading, Berkshire, RG1 3YL, registered in England No. 4205228. hibu Sales Limited, One Reading Central, Forbury Road, Reading, Berkshire, RG1 3YL, registered in England No. 1403041. VAT registered number: GB765346017 © hibu (UK) Limited 2013. All rights reserved. hibu and other ™ are trademarks of hibu (UK) Limited or its licensors.

5 5

sssd with openldap and dynlist overlay
by Ansgar Jazdzewski 12 Jun '14

12 Jun '14

Hi, i configured openldap to use the dynlist overlay, wite the uid into the attr memberUid dependening on the result off an ldap filter (in attr memberURL) in slapd.conf: --- overlay dynlist dynlist-attrset posixGroup memberURL memberUid:uid --- After set ldap deref threshold to 0 the groups are listed correct (getent group -s sss) but with id the membership is not shown. so something is wrong but i have no idea. Thanks for your help Ansgar

2 1

using SSSD with nscd
by Daniel Jung 12 Jun '14

12 Jun '14

According to the redhat/fedora doc on this subject is to suggesting that sssd is not meant to run with nscd but could be ran with nscd caching host only and rest to sssd. Curious to hear of lists opinions on this setup. Benefits of not runnig nscd at all and run sssd only and use no nscd at all. Cheers,

5 7

setting sss_authorized_keys?
by Daniel Jung 11 Jun '14

11 Jun '14

According to the doc, In order to manage user keys, SSSD has a tool, sss_ssh_authorizedkeys, which performs two operations: 1. Retrieves the user's public key from the user entries in the Identity Management (IPA) domain. 2. Stores the user key in a custom file, .ssh/sss_authorized_keys, in the standard authorized keys format. So i can get the sss_ssh_authorizedkeys to spit out the publickey, and can auth using it via sshd, however, I do not see .ssh/sss_authorized_keys being created under users directory. I even tried creating the file and see if it gets updated. Don't see anything obvious in the ssh_config that would indicate adding authorized_keys. Anyone?

2 2

sss_ssh_authorizedkeys issues
by Daniel Jung 11 Jun '14

11 Jun '14

Hi, I see that it was added in 2012 in Feb. So i assume version forward from 1.8.0 will support this? I am running 1.9.2 on centos, installed from the centos repo. I added ldap_user_ssh_public_key = sshPublicKey to my LDAP domain and i can see it being loaded in the sss_LDAP.log after setting debug_level = 10 I tried doing creating [ssh] in hopes of getting more detailed log when running sss_ssh_authorizedkeys ${id} but dont see anything ... The error i get is "Error looking up public keys" I have sshPublicKey set and can be queried using ldapsearch uid=${id} sshPublicKey What am i overlooking? Cheers

3 3

Re: [SSSD-users] ddns updates not required?
by John Hodrien 10 Jun '14

10 Jun '14

On 7 Jun 2014 18:38, steve <steve(a)steve-ss.com> wrote: > Hi > Thanks. > Yes, same here. Even though bind allows the signed updates from sssd, we > don't need them. We can authenticate using sssd no matter what IP is > assigned and no matter what is stored in AD. Maybe the ddns requirement > could be removed from the default ad-backend? You can hijack a keytab from another machine and use it for sssd, so correct DNS really doesn't matter for pure sssd operation. You'll only cause bother for things using kerberos auth as a service (say samba/http/NFS/SSH), which if you like such things is a big deal. jh

4 4

sssd basic questions
by Robert Zmijan 09 Jun '14

09 Jun '14

Hi I want to setup sssd to use ldap_default_bind_dn and ldap_default_authok. currently I have in my sssd.conf ldap_default_bind_dn = cn=sssd,ou=services,dc=myhost,dc=net ldap_default_authok = mypassword I understand that I would have to put 'mypassword' in ldap under the name of 'sssd' the problem I'm facing is that when i type: sss_obfuscate I get this: File "/usr/sbin/sss_obfuscate", line 81 print "Cannot read internal configuration files" /etc/sssd/sssd.conf is readable for everyone (rw- r-- r--) I'm using Gentoo Are there any other files sss_obfuscate needs access to? The other question is regarding the ldap attributes sssd needs to have access to in ldap database. I thought I would list those attributes in my slapd.conf access list and grant the access to the 'sssd' user entry. Is this a sensible way to configure sssd? Thanks in advance Robert

7 18

ddns updates not required?
by steve 07 Jun '14

07 Jun '14

Hi Samba4 DC with sssd clients. It seems that ddns updates are not necessary for Linux against AD as no check is made in dns before tickets are issued. In the hope that this would simplify configuration, could anyone confirm this behaviour? Thanks, Steve

2 2

timeout and offline mode behaviour
by Joschi Brauchle 06 Jun '14

06 Jun '14

Hello everone, we have an issue/problem that seems highly related to the current "timeout and offline mode behaviour". We have several SSSD 1.9.5 systems with "cache_credentials = true", which experience periodic blocking/pausing of the complete X session for several seconds (~5-10) when these machines are not connected to their home network. The user is not able to use the machine at all during these lockups, which is very annoying... These are some of the details: 1) The LDAP server has a local 192.168.x.x IP, which is resolvable globally. 2) The LDAP server is behind a firewall, dropping packets from outside networks. 3) The lockups seem to occur if the clients are not connected to this "home" network but to a different network with similar configuration (192.168.x.x, which is pretty common). I am still trying to track down the issue with "debug_level = 9" and get the logs of such a lockup. @Jakub: Could you let me know which openLDAP version you are using and suspecting to be the problem? Could you let me know how to trigger/test the issue reliably (the DNS setup you are using to trigger it)? I would like to confirm that we are having the same or possibly different problem... Best regards, Joschi Brauchle

6 14

Announcing SSSD 1.12 beta 2
by Jakub Hrozek 05 Jun '14

05 Jun '14

=== SSSD 1.12 Beta 2 === The SSSD team is proud to announce the second beta release of version 1.12 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd. RPM packages will be made available for Fedora rawhide shortly. The SSSD 1.12.0 release is scheduled for the end of June. Our goal is to stabilize the release and focus solely on bug fixes until the final 1.12.0 release. At the same time, the SSSD is string-frozen until the release of 1.12.0. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This releases merges the enhancements that were included in 1.11.6 and stabilizes the strings before releasing 1.12.0. With this beta2, SSSD enters a string freeze period before the final 1.12.0 release * Several patches that improve portability of SSSD, especially with consideration of BSD systems have been included * The sss_usermod tool was enhanced to add or modify custom attributes for entries in domains configured with id_provider=local. This feature is mostly useful for testing the InfoPipe responder without having to configure a remote server. * Fixed unit tests on big-endian architectures == Documentation Changes == * A new option ldap_use_tokengroups was added. Setting this option to False disables the support for tokenGroups, which is useful for environments that wish to restrict the group nesting level. Doing so with tokenGroups enabled is nontrivial since the tokenGroups attribute flattens the group memberships. * A new option homedir_substring makes it possible to substitute a templatized home directory attribute for a client-side defined value == Tickets Fixed == https://fedorahosted.org/sssd/ticket/2182 [RFE] Add the possibility to add custom attributes for the local provider https://fedorahosted.org/sssd/ticket/2308 document that simple access provider supports group nesting == Detailed Changelog == Jakub Hrozek (6): * Updating the version to 1.12beta2 * TOOLS: Allow adding and modifying custom attributes with sss_usermod * TESTS: fgetc returns int, not char * MAN: Fix a typo in the ldap_id_mapping page * LDAP: Fix DEBUG message * Updating the translations for the 1.12beta2 release Lukas Slebodnik (14): * UTIL: Add function sss_parse_name_const * NSS: Refactor expand_homedir_template * NSS: Add option to expand homedir template format * TEST: Add test for expand homedir * PAM: Include header file security/pam_appl.h * MAKE: Remove PAM libraries from libsss_simple * CONFIGURE: Enhance detection of pam * PAM: Fix compilation of pam_test_client with openpam * PAM: Use fallback version of some pam macros * PAM: Define compatible macros for some functions. * PAM: add ignore_authinfo_unavail option * SDAP: Use portable constant as level in setsockopt * Unify usage of function gethostname * MAN: Add reference to manual page sssd-sudo Pavel Březina (1): * man: clarify refresh_expired_interval Pavel Reichl (5): * LDAP: fix - find primary group by gid * MAN: Detailed ldap_group_nesting_level option * SDAP: Make nesting_level = 0 to ignore nested groups * SDAP: Add option to disable use of Token-Groups * MAN: hint nested groups by simple access provider

3 2

FreeIPA public demo available
by Martin Kosek 05 Jun '14

05 Jun '14

Hello all FreeIPA users and enthusiasts! I would like to invite everyone to try our new public FreeIPA demo instance running on Red Hat OpenStack platform: http://www.freeipa.org/page/Demo The demo will always hold the latest stable version of FreeIPA or a Beta version of a next major release (e.g. when 4.0 Beta is available). The demo is great for: * Testing changes and enhancements in the most recent CLI/Web UI/API * Testing integration in the OS - FreeIPA clients can be enrolled * Testing web applications with LDAP/Kerberos authentication and advanced integration with FreeIPA You can read all the details in the page referred above. Feedback welcome! -- Martin Kosek <mkosek(a)redhat.com> Supervisor, Software Engineering - Identity Management Team Red Hat Inc.

1 0

Announcing SSSD 1.11.6
by Jakub Hrozek 04 Jun '14

04 Jun '14

=== SSSD 1.11.6 === The SSSD team is proud to announce the release of version 1.11.6 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 19 and 20 shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This release focuses on delivering bug fixes and a subset of the DBus interface from 1.12. * A new responder, called InfoPipe was added. This responder provides a public D-Bus interface accessible over the system bus. In this release, only methods for retrieving user attributes and list of groups were added. The full interface is being developed in the 1.12 series. The primary consumer if this interface subset are Apache modules such as mod_lookup_identity or mod_intercept_form_submit * Fixed bug in the AD responder that caused crashes when authenticating as a user from a trusted domain to a system enrolled to a trusted domain other than the forest root * A potential crash on timeout in the autofs client library was fixed. * Several patches that improve portability of SSSD, especially with consideration of BSD systems have been included == Packaging Changes == * The InfoPipe responder is packaged in its own subpackage == Documentation Changes == * The new InfoPipe responder has several configuration options. Refer to the sssd-ifp manual page for details. * The LDAP provider has a new option ldap_user_extra_attrs that enables the administrator to extend the map of attributes downloaded when looking up a user. These custom attributes can then be retrieved with the new DBus API. * A new pam_sss option ignore_authinfo_unavail was added. Setting this option makes pam_sss return PAM_IGNORE when SSSD is not running instead of PAM_AUTHINFO_UNAVAIL. This option is mostly useful for BSD systems. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1853 [RFE] Allow sssd to replace macro (ie. %H) with value specified in config file https://fedorahosted.org/sssd/ticket/2114 refresh_expired_interval man page doc is not clear https://fedorahosted.org/sssd/ticket/2294 In sssd.conf, setting "ldap_group_nesting_level = 0" does not appear to work https://fedorahosted.org/sssd/ticket/2305 SSSD Crashes when storage experiences high latency https://fedorahosted.org/sssd/ticket/2312 Fails to start in interactive mode when stdin isn't a pts device https://fedorahosted.org/sssd/ticket/2322 segfault in sssd_be when cross forest users are queried https://fedorahosted.org/sssd/ticket/2333 Expanding home directory fails when the request comes from the PAC responder https://fedorahosted.org/sssd/ticket/2334 Simple access fails to look up primary group when using sssd-ad until running the id command. == Detailed Changelog == Alexander Bokovoy (1): * ipa subdomains provider: make sure search by SID works for homedir Benjamin Franzke (1): * BUILD: Link libsss_krb5_common.so to libkeyutils.so Jakub Hrozek (36): * Updating the version for the 1.11.6 development * LDAP: Check the LDAP handle before using it * AD: Do not remove non-root domains when looking up root domain * Remove duplicate declaration * UTIL: Move sss_parse_name_for_domains declaration to util.h * IFP: Fix a typo in the Makefile * IFP: Re-add the InfoPipe? server * IFP: Connect to the system bus * TESTS: Create a default sss_names_ctx in create_dom_test_ctx * TESTS: Split a separate common_mock_resp_dp module * RESPONDERS: Add a new request sss_parse_inp_send * LDAP: Fix off-by-one bug in sdap_copy_opts * LDAP: Make it possible to extend an attribute map * AD: Initialize user_map_cnt in server mode * Add a unit test for sss_parse_name_for_domains * SBUS: Generate introspection from the interface meta structure * SBUS: Create an sbus_method_meta instance for Introspection * IFP: Close memstream handle in introspect destructor * SBUS: several trivial style fixes * SBUS: Fix error handling condition * SBUS: Add a convenience function sbus_error_new * SBUS: Split out dbus_conn_send * SBUS: Add SBUS_CONN_TYPE_SYSBUS * SBUS: Add an async request to retrieve the caller ID * SBUS: Refactor sbus_message_handler to retrieve caller ID * IFP: Add utility functions * IFP: use a list of allowed_uids for authentication * IFP: Initialize negative cache timeout * IFP: Add GetUserAttrs? call * IFP: Per-attribute ACL for users * SYSDB: return SYSDB_NAME from sysdb_initgroups * IFP: Add a GetGroupsList? method * MAN: Add sssd-ifp to the list of translatable manual pages * BUILD: Disable dbus tests when running distcheck * Updating the translations for the 1.11.6 release * Updating the translations again for the 1.11.6 release Lukas Slebodnik (38): * AUTOMAKE: Do not include generated files into tarball * UTIL: Use constant instead of value for stdin. * MONITOR: Fix start up with empty standard input * BUILD: Make samba4 libraries optional * BUILD: Explicitly link libsss_ad.so with sasl libs * sss_autofs: Check return value of autofs make request * sss_autofs: Do not try to free empty autofs context * man: Substitute entity values for entity references * TEST: Some macros aren't defined in older version of check. * TEST: Link ipa_ldap_opt test with openldap libs * UTIL: Add function sss_parse_name_const * NSS: Refactor expand_homedir_template * NSS: Add option to expand homedir template format * TEST: Add test for expand homedir * SPEC: Remove duplicate sssd_ifp. * SBUS: Fix warning declaration shadows a global declaration * Remove unused parameter from ifp_user_get_attr_handle_reply * Remove unused parameter from ifp_user_get_groups_reply * resolv: Do not try to free addrinfo in case of error * CONFIGURE: Remove duplicate detection of pam * CRYPTO: Use unprefixed version of function stpncpy * PAM: macro PAM_DATA_REPLACE isn't available in openpam. * PAM: Fix problem with missing declaration. * UTIL: Fix order of header files. * LDAP: Don't use macro _XOPEN_SOURCE for extra features * PAM: add ignore_authinfo_unavail option * SDAP: Use portable constant as level in setsockopt * PAM: Include header file security/pam_appl.h * MAKE: Remove PAM libraries from libsss_simple * CONFIGURE: Enhance detection of pam * PAM: Fix compilation of pam_test_client with openpam * PAM: Use fallback version of some pam macros * PAM: Define compatible macros for some functions. * SBUS: Define DBUS_ERROR_INIT for old version of dbus * SBUS: Include config.h for enabling function in stdio.h * Unify usage of function gethostname * MAN: Add reference to manual page sssd-sudo * KRB: Prevent dereference of a null pointer Nikolai Kondrashov (12): * Add cscope inverted index files to .gitignore * Move DEBUG macro body to debug_fn * Remove extra flushing from debug message output * Cleanup debug_fn * Make DEBUG macro definition variadic * Make DEBUG macro invocations variadic * Fixup DEBUG macro invocations update * Update DEBUG* invocations to use new levels * Update debug levels in sss_semanage_error_callback * Update debug level in sysdb_check_upgrade_02 * Remove DEBUG macro support for old debug levels * build: Switch to AM_DISTCHECK_CONFIGURE_FLAGS Pavel Březina (6): * man: clarify refresh_expired_interval * IFP: do not create client socket * tests: add confdb_path to sss_test_ctx * sbus_tests: fix missing invoker in initializer * sbus request: fix error initialization * SBUS: remove unused variables Pavel Reichl (10): * SDAP: augmented logging for group saving * AD Provider: bug-fix uninitialized variable * AD Provider: bugfix use-after-free * SYSDB: augmented logging when adding new group * LDAP: fix - find primary group by gid * MAN: Detailed ldap_group_nesting_level option * SDAP: Make nesting_level = 0 to ignore nested groups * SDAP: Add option to disable use of Token-Groups * refactor calls of sss_parse_name * TEST: Remove unused variable Stef Walter (13): * sbus: Add meta data structures and code generator * sbus: Add sbus_vtable and update codegen to support it * nss: Stop using one DBus interface with totally different methods * sbus: Rework sbus to use interface metadata and vtables * sbus: Generate constants from interface definitions * sbus: Use constants to make dbus calls * sbus: Add struct sbus_request to represent a DBus invocation * sbus: Refactor how we export DBus interfaces * sbus: Make sbus_new_server() work for non-priveleged processes * sbus_tests: Add some testing of dispatch and handler code * sbus: Add the sbus_request_parse_or_finish() method * sbus: Add type-safe DBus method handlers and finish functions * sbus_codegen_tests: Add test case type-safe handler args Sumit Bose (1): * Make LDAP extra attributes available to IPA and AD

4 9

timeout and offline mode behaviour
by "Thomas B. Rücker" 04 Jun '14

04 Jun '14

Hi, we're using SSSD in combination with active directory and have received complaints from users about a corner case in our setup. Our AD servers are only reachable from within our corporate network, connection attempts from the outside are dropped by firewalls. This leads to the following scenario: - user takes machine (e.g. laptop) outside the corporate network - user tries to authenticate (or in some cases also tries to "ls" which causes uid/gid lookup) - sssd will try to reach the configured servers for up to 30s - sssd goes (back) into offline mode and uses cached credentials and authenticates the user This will however NOT happen if sssd gets told by the IP stack that a connection to the target IP is not possible (e.g. "ip route add blackhole 192.0.2.23/32" or one of the routers along the way generates an ICMP unreachable). In such cases sssd will go immediately into offline mode and use cached credentials. I'm aware that this is over all sensible behaviour, but what I would hope to fine tune is how sssd stays in offline mode. Currently it seems like it will leave offline mode when it tries to reconnect (hardcoded 30s?). That leads to a flip flop scenario where it seems to be 30s offline and 30s "online/connecting" and users have a fairly high chance to hit a time during which their authentication will seemingly stall. So my question is: Is there a better way to deal with this in the sssd context? If not we'll probably have to implement separate connection checking and inject and remove blackhole routes accordingly. Not the nicest of workarounds in my book. Thanks, cheers Thomas PS: We're using sssd on many distributions, but our main distro at the moment is ubuntu 12.04 with sssd 1.8.6 and we'll be rolling out 14.04 in addition, which has sssd 1.11.3.

5 13

Re: [SSSD-users] timeout and offline mode behaviour
by Joschi Brauchle 02 Jun '14

02 Jun '14

> On 06/02/2014 07:51 AM, John Hodrien wrote: > > On Mon, 2 Jun 2014, Stephen Gallagher wrote: > > > >> This is the real problem. If SSSD can route to the IP address, > >> then we have to proceed assuming that the LDAP server should be > >> available (thereby attempting to connect to it and perform > >> online authentication). There's really no way to determine ahead > >> of time whether the service is "supposed" to be available. > >> > >> You may want to play with the option 'ldap_opt_timeout' (see > >> sssd-ldap(5)). It controls how long the OpenLDAP client libraries > >> will wait for a response (in your case, how long it will wait > >> while the packets are dropped. It defaults to 6s). > > > > This should be a one off hit though, right? If I discover the > > LDAP server is offline, I should remember this, admittedly recheck > > periodically, but never cause another delay waiting for it to > > spring back into life. Given the way some of these laptops are > > used, I'd even quite like to configure it to default to this > > state. > > > > When I last tried this (which was a while ago) these delays would > > happen repeatedly, so the setup was unusable, and I had to ditch > > sssd on the laptop. > > Well, in most common cases, the LDAP server is unresolvable when not > on the VPN/inside the network, so SSSD immediately detects that it > can't get there and the delay is unnoticeable. > > It's those cases where the server is addressable but unresponsive that > is much harder to handle. > > Right now, we have a two-minute sleep between operations trying to go > online again. (I think I saw a patch go in for 1.12 that makes this > configurable). That's mostly so that we catch cases where you've > connected to the VPN but for one reason or another SSSD doesn't get > notified that the network state changed (there are lots of edge-cases > that cause this). I am not 100% sure that the LDAP server being unresponsive is the cause... Once I have the logs I will know more! But isn't this is design flaw of the LDAP connectivity test? If connectivity is tested only after some application/the system is requesting information from SSSD and the server is unresponsive, this causes a long and unpleasant delay if the request is kept pending until the connection times out. Hence, I'd suggest that SSSD periodically tests the LDAP connection in the background (or after network state change) *without* an actual request triggering this. As long as the LDAP server is unreachable or unresponsive, SSSD should stay in offline mode and answer requests right away with cached results. Joschi Brauchle

3 4

1.12 beta can't authenticate
by steve 02 Jun '14

02 Jun '14

Hi can kinit OK but pam doesn't allow us in it seems. Any ideas? Thanks Steve --- --- --- openSUSE 13.1 make install of beta build over a working 1.11.5.1 Here is a domain user: id steve2 uid=3000021(steve2) gid=20513(domain users) grupos=20513(domain users),21111(staff2) steve2 can authenticate and su fine with 1.11.5.1 on the same client pam: auth required pam_env.so auth optional pam_gnome_keyring.so auth sufficient pam_unix.so try_first_pass auth required pam_sss.so use_first_pass client log: 2014-05-31T16:25:27.738959+02:00 catral su: pam_unix(su:auth): authentication failure; logname=steve uid=1000 euid=0 tty=pts/1 ruser=steve rhost= user=steve2 2014-05-31T16:25:29.102746+02:00 catral su: pam_sss(su:auth): authentication success; logname=steve uid=1000 euid=0 tty=pts/1 ruser=steve rhost= user=steve2 2014-05-31T16:25:29.164275+02:00 catral su: pam_sss(su:account): Access denied for user steve2: 4 (Error del sistema) sssd -i -d7: 2014-05-31T16:25:07.537030+02:00 catral sssd: Starting up 2014-05-31T16:25:07.854951+02:00 catral sssd[be[hh3.site]]: Starting up 2014-05-31T16:25:09.645973+02:00 catral sssd[pam]: Starting up 2014-05-31T16:25:09.665278+02:00 catral sssd[nss]: Starting up 2014-05-31T16:25:09.702723+02:00 catral sssd[autofs]: Starting up (Sat May 31 16:25:24 2014) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected! (Sat May 31 16:25:24 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Sat May 31 16:25:24 2014) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [steve2]. (Sat May 31 16:25:24 2014) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'steve2' matched without domain, user is steve2 (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [steve2] from [<ALL>] (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [steve2(a)hh3.site] (Sat May 31 16:25:24 2014) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): Returning info for user [steve2(a)hh3.site] (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [steve2]. (Sat May 31 16:25:24 2014) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'steve2' matched without domain, user is steve2 (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [steve2] from [<ALL>] (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [steve2(a)hh3.site] (Sat May 31 16:25:24 2014) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. (Sat May 31 16:25:24 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): Returning info for user [steve2(a)hh3.site] (Sat May 31 16:25:27 2014) [sssd] [service_send_ping] (0x0100): Pinging hh3.site (Sat May 31 16:25:27 2014) [sssd] [ping_check] (0x0100): Service hh3.site replied to ping (Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [steve2]. (Sat May 31 16:25:27 2014) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'steve2' matched without domain, user is steve2 (Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [steve2] from [<ALL>] (Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [steve2(a)hh3.site] (Sat May 31 16:25:27 2014) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. (Sat May 31 16:25:27 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): Returning info for user [steve2(a)hh3.site] (Sat May 31 16:25:27 2014) [sssd[pam]] [accept_fd_handler] (0x0400): Client connected! (Sat May 31 16:25:27 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3]. (Sat May 31 16:25:27 2014) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3]. (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate (Sat May 31 16:25:27 2014) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'steve2' matched without domain, user is steve2 (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): domain: not set (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): user: steve2 (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): service: su (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: pts/1 (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser: steve (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 (Sat May 31 16:25:27 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 2423 (Sat May 31 16:25:27 2014) [sssd[pam]] [sss_dp_issue_request] (0x0400): Issuing request for [0x8054300:3:steve2@hh3.site] (Sat May 31 16:25:27 2014) [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [hh3.site][3][1][name=steve2] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_get_account_info] (0x0100): Got request for [3][1][name=steve2] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_req_set_domain] (0x0400): Changing request domain from [hh3.site] to [hh3.site] (Sat May 31 16:25:27 2014) [sssd[pam]] [sss_dp_internal_get_send] (0x0400): (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [fo_resolve_service_send] (0x0100): Entering request [0x8054300:3:steve2@hh3.site] Trying to resolve service 'AD_GC' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status] (0x1000): Status of server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_port_status] (0x1000): Port status of port 0 for server 'hh16.hh3.site' is 'neutral' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status] (0x1000): Status of server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_resolve_server_process] (0x0200): Found address for server hh16.hh3.site: [192.168.1.16] TTL 7200 (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://hh16.hh3.site' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://hh16.hh3.site:3268' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://hh16.hh3.site:3268/??base] with fd [18]. (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [altServer] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [namingContexts] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedControl] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedExtension] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedFeatures] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedLDAPVersion] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedSASLMechanisms] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [domainControllerFunctionality] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [defaultNamingContext] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [highestCommittedUSN] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_get_server_opts_from_rootdse] (0x0100): Setting AD compatibility level to [4] (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_kinit_send] (0x0400): Attempting kinit (/etc/krb5.keytab, CATRAL$, HH3.SITE, 86400) (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_kinit_next_kdc] (0x1000): Resolving next KDC for service AD (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status] (0x1000): Status of server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_port_status] (0x1000): Port status of port 0 for server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [get_server_status] (0x1000): Status of server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [be_resolve_server_process] (0x0200): Found address for server hh16.hh3.site: [192.168.1.16] TTL 7200 (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://hh16.hh3.site' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://hh16.hh3.site' (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [sdap_kinit_kdc_resolved] (0x1000): KDC resolved, attempting to get TGT... (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [create_tgt_req_send_buffer] (0x0400): buffer size: 47 (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for tgt child (Sat May 31 16:25:27 2014) [sssd[be[hh3.site]]] [write_pipe_handler] (0x0400): All data has been sent! (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [main] (0x0400): ldap_child started. (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): total buffer size: 47 (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): realm_str size: 8 (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): got realm_str: HH3.SITE (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): princ_str size: 7 (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): got princ_str: CATRAL$ (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): keytab_name size: 16 (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): got keytab_name: /etc/krb5.keytab (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [CATRAL $(a)HH3.SITE] (Sat May 31 16:25:27 2014) [[sssd[ldap_child[2424]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [/etc/krb5.keytab] (Sat May 31 16:25:28 2014) [sssd] [service_send_ping] (0x0100): Pinging nss (Sat May 31 16:25:28 2014) [sssd] [service_send_ping] (0x0100): Pinging pam (Sat May 31 16:25:28 2014) [sssd] [service_send_ping] (0x0100): Pinging autofs (Sat May 31 16:25:28 2014) [sssd] [ping_check] (0x0100): Service autofs replied to ping (Sat May 31 16:25:28 2014) [sssd] [ping_check] (0x0100): Service pam replied to ping (Sat May 31 16:25:28 2014) [[sssd[ldap_child[2424]]]] [prepare_response] (0x0400): (Sat May 31 16:25:28 2014) [sssd] [ping_check] (0x0100): Service nss replied to ping Building response for result [0] (Sat May 31 16:25:28 2014) [[sssd[ldap_child[2424]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [46] msg [FILE:/usr/local/var/lib/sss/db/ccache_HH3.SITE] (Sat May 31 16:25:28 2014) [[sssd[ldap_child[2424]]]] [main] (0x0400): ldap_child completed successfully (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [read_pipe_handler] (0x0400): EOF received, client finished (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_tgt_recv] (0x0400): Child responded: 0 [FILE:/usr/local/var/lib/sss/db/ccache_HH3.SITE], expired on [1401582327] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_cli_auth_step] (0x1000): the connection will expire at 1401547228 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sasl_bind_send] (0x0100): Executing sasl bind mech: gssapi, user: CATRAL$ (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [child_sig_handler] (0x1000): Waiting for child [2424]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [child_sig_handler] (0x0100): child [2424] finished successfully. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status] (0x0100): Marking port 0 of server 'hh16.hh3.site' as 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [set_server_common_status] (0x0100): Marking server 'hh16.hh3.site' as 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_user_data_cmp] (0x1000): Comparing GC with GC (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status] (0x0400): Marking port 0 of duplicate server 'hh16.hh3.site' as 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_initgr_next_base] (0x0400): Searching for users with base [DC=hh3,DC=site] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=steve2)(objectclass=user)(&(uidNumber=*)(!(uidNumber=0))))][DC=hh3,DC=site]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [sAMAccountName] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixUserPassword] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [unixHomeDirectory] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPrincipalName] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [name] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectGUID] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [primaryGroupID] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [whenChanged] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uSNChanged] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user] (0x0400): Save user (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_primary_name] (0x0400): Processing object steve2 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user] (0x0400): Processing user steve2 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user] (0x0400): Adding original memberOf attributes to [steve2]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user] (0x0400): Adding user principal [steve2(a)HH3.SITE] to attributes of [steve2]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_save_user] (0x0400): Storing info for user steve2 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no filter][CN=steve2,CN=Users,DC=hh3,DC=site]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [tokenGroups] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_ad_tokengroups_initgr_posix_tg_done] (0x1000): Processing membership SID [S-1-5-21-451355595-2219208293-2714859210-1111] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_ad_tokengroups_initgr_posix_tg_done] (0x1000): Processing membership SID [S-1-5-21-451355595-2219208293-2714859210-513] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_ad_tokengroups_initgr_posix_tg_done] (0x1000): Processing membership SID [S-1-5-32-545] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_ad_tokengroups_initgr_posix_tg_done] (0x0080): Domain not found for SID S-1-5-32-545 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [sdap_ad_tokengroups_update_members] (0x1000): Updating memberships for [steve2] (Sat May 31 16:25:28 2014) [sssd[nss]] [nss_memcache_initgr_check] (0x1000): Got request for [steve2(a)hh3.site] (Sat May 31 16:25:28 2014) [sssd[pam]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [steve2(a)hh3.site] (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_check_user_search] (0x0400): (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success Returning info for user [steve2(a)hh3.site] (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data: (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): domain: hh3.site (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): user: steve2 (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): service: su (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: pts/1 (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser: steve (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 2423 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [be_req_set_domain] (0x0400): Changing request domain from [hh3.site] to [hh3.site] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [be_pam_handler] (0x0100): Got request with the following data (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): domain: hh3.site (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): user: steve2 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): service: su (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): tty: pts/1 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): ruser: steve (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): rhost: (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): authtok type: 1 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): newauthtok type: 0 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): priv: 0 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): cli_pid: 2423 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [krb5_pam_handler] (0x1000): Wait queue of user [steve2] is empty, running request immediately. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200): Switch user to [3000021][20513]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200): Switch user to [0][0]. (Sat May 31 16:25:28 2014) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Sat May 31 16:25:28 2014) [sssd[pam]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x8054300:3:steve2@hh3.site] (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [get_server_status] (0x1000): Status of server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [get_port_status] (0x1000): Port status of port 0 for server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [get_server_status] (0x1000): Status of server 'hh16.hh3.site' is 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [be_resolve_server_process] (0x0200): Found address for server hh16.hh3.site: [192.168.1.16] TTL 7200 (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://hh16.hh3.site' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://hh16.hh3.site' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [write_pipe_handler] (0x0400): All data has been sent! (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [main] (0x0400): krb5_child started. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [unpack_buffer] (0x1000): total buffer size: [106] (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [unpack_buffer] (0x0100): cmd [241] uid [3000021] gid [20513] validate [true] enterprise principal [true] offline [false] UPN [steve2(a)HH3.SITE] (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_3000021] keytab: [/etc/krb5.keytab] (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true] (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [k5c_setup] (0x0100): Not using FAST. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [main] (0x0400): Will perform online auth (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [tgt_req_child] (0x1000): Attempting to get a TGT (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [HH3.SITE] (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [validate_tgt] (0x0400): TGT verified using key for [host/catral.hh3.site(a)HH3.SITE] (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][2]. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [steve2\@HH3.SITE@HH3.SITE] might not be correct. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [become_user] (0x0200): Trying to become user [3000021][20513]. (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [k5c_send_data] (0x0200): Received error code 0 (Sat May 31 16:25:28 2014) [[sssd[krb5_child[2425]]]] [main] (0x0400): krb5_child completed successfully (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [read_pipe_handler] (0x0400): EOF received, client finished (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [parse_krb5_child_response] (0x1000): child response [0][3][36]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [parse_krb5_child_response] (0x1000): child response [0][-1073741822][16]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [parse_krb5_child_response] (0x1000): child response [0][-1073741823][32]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [parse_krb5_child_response] (0x1000): TGT times are [1401546329][1401546329][1401582329][1401632728]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status] (0x0100): Marking port 0 of server 'hh16.hh3.site' as 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [set_server_common_status] (0x0100): Marking server 'hh16.hh3.site' as 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [ad_user_data_cmp] (0x1000): Comparing LDAP with LDAP (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [fo_set_port_status] (0x0400): Marking port 0 of duplicate server 'hh16.hh3.site' as 'working' (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200): Switch user to [3000021][20513]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [switch_creds] (0x0200): Switch user to [0][0]. (Sat May 31 16:25:28 2014) [sssd[be[hh3.site]]] [safe_remove_old_ccache_file] (0x0400): New and old ccache file are the same, none will be deleted. (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [check_wait_queue] (0x1000): Wait queue for user [steve2] is empty. (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success] (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler_callback] (0x0100): Sending result [0][hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0]. (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): blen: 69 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler_callback] (0x0100): (Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17] with input [steve2]. (Sat May 31 16:25:29 2014) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'steve2' matched without domain, user is steve2 (Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [steve2] from [<ALL>] (Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [steve2(a)hh3.site] (Sat May 31 16:25:29 2014) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. (Sat May 31 16:25:29 2014) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0400): Returning info for user [steve2(a)hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_cmd_acct_mgmt] (0x0100): Sent result [0][hh3.site] entering pam_cmd_acct_mgmt (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [child_sig_handler] (0x1000): (Sat May 31 16:25:29 2014) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): Waiting for child [2425]. name 'steve2' matched without domain, user is steve2 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [child_sig_handler] (0x0100): command: PAM_ACCT_MGMT child [2425] finished successfully. (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): domain: not set (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): user: steve2 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): service: su (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: pts/1 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser: steve (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 2423 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [steve2(a)hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_check_user_search] (0x0400): Returning info for user [steve2(a)hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data: (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_ACCT_MGMT (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): domain: hh3.site (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): user: steve2 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): service: su (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): tty: pts/1 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): ruser: steve (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 0 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 2423 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_req_set_domain] (0x0400): Changing request domain from [hh3.site] to [hh3.site] (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler] (0x0100): Got request with the following data (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): command: PAM_ACCT_MGMT (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): domain: hh3.site (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): user: steve2 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): service: su (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): tty: pts/1 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): ruser: steve (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): rhost: (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): authtok type: 0 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): newauthtok type: 0 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): priv: 0 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [pam_print_data] (0x0100): cli_pid: 2423 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_access_send] (0x0400): Performing access check for user [steve2] (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_account_expired_ad] (0x0400): Performing AD access check for user [steve2] (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [ad_gpo_connect_done] (0x0400): sam_account_name is catral.hh3.site$ (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectclass=user)(sAMAccountName=catral.hh3.site $))][dc=hh3,dc=site]. (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [distinguishedName] (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy target. (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [ad_gpo_access_done] (0x0040): GPO-based access control failed. (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, No existe el fichero o el directorio) [Internal Error (Error del sistema)] (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler_callback] (0x0100): Sending result [4][hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [4][hh3.site] (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [4]. (Sat May 31 16:25:29 2014) [sssd[pam]] [pam_reply] (0x0200): blen: 25 (Sat May 31 16:25:29 2014) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Sat May 31 16:25:29 2014) [sssd[be[hh3.site]]] [be_pam_handler_callback] (0x0100): Sent result [4][hh3.site] (Sat May 31 16:25:32 2014) [sssd[nss]] [client_recv] (0x0200): Client disconnected! ^C(Sat May 31 16:25:35 2014) [sssd] [monitor_quit_signal] (0x0040): Monitor received Interrupción: terminating children (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0040): Returned with: 0 (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating [autofs][2413] (Sat May 31 16:25:35 2014) [sssd[autofs]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_client_destructor] (0x0400): Removed autofs client (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child [autofs] terminated with a signal (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating [pam][2412] (Sat May 31 16:25:35 2014) [sssd[pam]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_client_destructor] (0x0400): Removed PAM client (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child [pam] terminated with a signal (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating [nss][2411] (Sat May 31 16:25:35 2014) [sssd[nss]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [sbus_dispatch] (0x0080): Connection is not open for dispatching. (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_client_destructor] (0x0400): Removed NSS client (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child [nss] terminated with a signal (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Terminating [hh3.site][2410] (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [remove_krb5_info_files] (0x0200): Could not remove [/usr/local/var/lib/sss/pubconf/kpasswdinfo.HH3.SITE], [2][No existe el fichero o el directorio] (Sat May 31 16:25:35 2014) [sssd[be[hh3.site]]] [be_ptask_destructor] (0x0400): Terminating periodic task [Cleanup of hh3.site] (Sat May 31 16:25:35 2014) [sssd] [monitor_quit] (0x0020): Child [hh3.site] terminated with a signal sssd.conf [sssd] services = nss, pam, autofs config_file_version = 2 domains = hh3.site [nss] [pam] [autofs] [domain/hh3.site] ad_hostname = catral.hh3.site ad_server = hh16.hh3.site ad_domain = hh3.site ldap_schema = ad id_provider = ad access_provider = ad auth_provider = ad chpass_provider = ad ldap_id_mapping=false ldap_sasl_mech = gssapi ldap_sasl_authid = CATRAL$(a)HH3.SITE krb5_keytab = /etc/krb5.keytab ldap_krb5_init_creds = true autofs_provider=ldap ldap_autofs_search_base = OU=automount,DC=hh3,DC=site ldap_autofs_map_object_class = automountMap ldap_autofs_entry_object_class = automount ldap_autofs_map_name = automountMapName ldap_autofs_entry_key = automountKey ldap_autofs_entry_value = automountInformation KDC Kerberos: AS-REQ steve2\@HH3.SITE@HH3.SITE from ipv4:192.168.1.25:39732 for krbtgt/HH3.SITE(a)HH3.SITE Kerberos: Client sent patypes: 149 Kerberos: Looking for PKINIT pa-data -- steve2\@HH3.SITE@HH3.SITE Kerberos: Looking for ENC-TS pa-data -- steve2\@HH3.SITE@HH3.SITE Kerberos: No preauth found, returning PREAUTH-REQUIRED -- steve2 \@HH3.SITE@HH3.SITE Kerberos: AS-REQ steve2\@HH3.SITE@HH3.SITE from ipv4:192.168.1.25:56942 for krbtgt/HH3.SITE(a)HH3.SITE Kerberos: Client sent patypes: encrypted-timestamp, 149 Kerberos: Looking for PKINIT pa-data -- steve2\@HH3.SITE@HH3.SITE Kerberos: Looking for ENC-TS pa-data -- steve2\@HH3.SITE@HH3.SITE Kerberos: ENC-TS Pre-authentication succeeded -- steve2 \@HH3.SITE@HH3.SITE using arcfour-hmac-md5

3 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2014