August 2016 - sssd-users - Fedora mailing-lists

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

'no primary group ID provided' when trying to use ldap mode against AD
by Daniel Hermans 24 Apr '17

24 Apr '17

Hi, i'd like to use sssd in ldap mode against Active Directory so I have defined: id_provider = ldap auth_provider = ldap Yes krb5 would be better but i only have a BIND account and cannot add computer objects. This 'should' be possible - it works with nslcd. As I don't have Posix attributes i'm using: ldap_id_mapping = true fallback_homedir = /home/%d/%u default_shell = /bin/bash sssd can bind with LDAPS and can seem to get user info from the domain: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users The UID mapping seems to succeed: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID But it gets no further with this message: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ). Any ideas what I'm doing wrong? Is this possible? Various (old) posts suggests it is. This was first (incorrectly) posted to sssd-devel, Jakub Hrozek updated and told me to define ldap_idmap_default_domain_sid so sssd no longer reports this: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain Thanks in advance!!

4 9

Question about AD authentication and trusts
by Guy Knights 21 Nov '16

21 Nov '16

Hi, Can anyone confirm for me if SSSD supports authentication of users belonging to a trusted domain via an AD controller in the trusting domain? ie. A user attempts to log in as fred(a)test1.example.com on a client machine running SSSD, where SSSD has joined a domain test2.example.com and there is a 2-way forest trust between both domains. Is this supported? I've been trying to do so and so far it hasn't been working. For the record, my setup is: AD controller domain test1: Windows server 2012 R2 AD controller domain test2: Windows server 2012 R2 Ubuntu 14.04 client running SSSD 1.12.5 Thanks, Guy

3 2

Joining AD with adcli, strange error
by Joakim Tjernlund 28 Oct '16

28 Oct '16

The other day I tried to join a machine using adcli and during the join I got some strange error msg about not finding: _ldap._tcp.._sites.dc._msdcs.infinera.com Notice the .. between _tcp and _sites, this is not a valid DNS domain, how did this happen? Jocke

3 10

full_name_format and supplemental groups
by Orion Poplawski 25 Oct '16

25 Oct '16

Running IPA with an AD trust. Users are in AD. Trying to use full_name_format = %1$s to strip the domain from user names. This appears to break supplemental groups in strange ways. On the IPA server: Without full_name_format: # id orion(a)ad.nwra.com uid=470202603(orion(a)ad.nwra.com) gid=470202603(orion(a)ad.nwra.com) groups=470202603(orion(a)ad.nwra.com),470200513(domain users(a)ad.nwra.com),470204703(pirep rd users(a)ad.nwra.com),470204714(wireless access@ad.nwra.com),470204715(nwra-users@ad.nwra.com),470204701(boulder@ad.nwra.com),470207608(heimdall users(a)ad.nwra.com),470200512(domain admins(a)ad.nwra.com),470207124(andreas admins(a)ad.nwra.com) With: # id orion(a)ad.nwra.com uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) If I add: default_domain_suffix = ad.nwra.com # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion),470200512(domain admins),470207608(heimdall users),470204714(wireless access),470204715(nwra-users),470204701(boulder),470204703(pirep rd users),470207124(andreas admins),470200513(domain users) Which I guess makes some sense as you'd need to add the domain suffix back on to find the groups. But this appears to completely break IPA clients (with full_name_format = %1$s and default_domain_suffix = ad.nwra.com) # id orion(a)ad.nwra.com id: orion(a)ad.nwra.com: no such user # id orion id: orion: no such user >From looking at the server logs, it looks like only the IPA domain is searched If I reset the server back to normal (drop full_name_format and default_domain_suffix): # id orion uid=470202603(orion) gid=470202603(orion) groups=470202603(orion) I don't get any supplemental groups. I see sssd errors like: (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_mod_group_member] (0x0400): Error: 2 (No such file or directory) (Mon Mar 30 15:20:52 2015) [sssd[be[nwra.com]]] [sysdb_update_members_ex] (0x0020): Could not add member [orion] to group [name=domain admins,cn=groups,cn=nwra.com,cn=sysdb]. Skipping. Is t trying "cn=groups,cn=nwra.com,cn=sysdb" instead of "cn=groups,cn=ad.nwra.com,cn=sysdb" -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 7

sssd_be[30807]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied after upgrading packages
by Steffen Knauf 04 Oct '16

04 Oct '16

Hello, after upgrading sssd package from 1.13.0-40.el7_2.1 to 1.13.0-40.el7_2.9 and upgrading the cyrus-sasl Packages from 2.1.26-19.2.el7 to 2.1.26-20.el7_2 i got the following Message after restarting sssd: sssd_be[30849]: ldapdb_canonuser_plug_init() failed in sasl_canonuser_add_plugin(): invalid parameter supplied sssd_be[30849]: _sasl_plugin_load failed on sasl_canonuser_init for plugin: ldapdb I don't change any configuration in sssd.conf or saslauthd.conf. Setting the relevant debug_level = 9 in sssd.conf don't help, so perhaps can give me a hint? greets Steffen

2 4

pwdReset TRUE not working
by xcorvis＠gmail.com 16 Sep '16

16 Sep '16

I have an environment set up with OpenLDAP, ppolicy and sssd on Ubuntu 12.04. I've got ppolicy working fine, for the most part, but I'm trying to set pwdReset: TRUE in LDAP to force users to change passwords and it's not having any effect. I have pwdMustChange: TRUE in the default password policy, and password prompts for expired passwords works, so I know it's not grossly misconfigured or something. I've spent a few days looking into this and from other posts and blogs it sounds like pwdReset can be handled by sssd and is somehow enforced by pam, but I'm not seeing any error messages about pam or password resets (pam verbosity 3 and debug_level 9). With the lack of errors, I'm basically wondering what are the requirements to get pwdReset functioning with sssd? Thanks.

2 5

Re: pwdReset TRUE not working
by Douglas Duckworth 16 Sep '16

16 Sep '16

I got this working on Centos 6 using the following for password-auth-ac / system-auth-ac. #%PAM-1.0 # pam_succeed_if.so in auth MUST be sufficient # pam_succeed_if.so in account does not currently work with uid under 500 and pwdReset:TRUE in OpenLDAP auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth sufficient pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so #account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account sufficient pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session sufficient pam_sss.so session required pam_unix.so Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690 On Thu, Aug 25, 2016 at 4:59 PM, Lukas Slebodnik <lslebodn(a)redhat.com> wrote: > On (25/08/16 20:44), xcorvis(a)gmail.com wrote: > >I have an environment set up with OpenLDAP, ppolicy and sssd on Ubuntu > 12.04. I've got ppolicy working fine, for the most part, but I'm trying to > set pwdReset: TRUE in LDAP to force users to change passwords and it's not > having any effect. I have pwdMustChange: TRUE in the default password > policy, and password prompts for expired passwords works, so I know it's > not grossly misconfigured or something. > > > >I've spent a few days looking into this and from other posts and blogs it > sounds like pwdReset can be handled by sssd and is somehow enforced by pam, > but I'm not seeing any error messages about pam or password resets (pam > verbosity 3 and debug_level 9). With the lack of errors, I'm basically > wondering what are the requirements to get pwdReset functioning with sssd? > > > Ubuntu 12.04 seems to have sssd 1.8.2 > The ppa[2] seems to have 1.11.5 > > It would be good to test with more recent version of sssd. > You can try sssd in 16.04. > > I can confirm that "pwdReset: TRUE" works with latest sssd 1.13 > which is in xenial(16.04) > > LS > > [1] https://urldefense.proofpoint.com/v2/url?u=http-3A__ > packages.ubuntu.com_search-3Fkeywords-3Dsssd-26searchon- > 3Dnames-26suite-3Dprecise-26section-3Dall&d=DQIGaQ&c= > lb62iw4YL4RFalcE2hQUQealT9-RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e- > CbhH6xUjnRkaqPFUS2wTJ2cw&m=e5O5zPnwDumy2ONJT4dlFcqr7saa51Qy72hsJc4f87I&s= > N0Lii3TQAhrxxkHAsA1mnnJH_nzNooMhVjkJW9AGhio&e= > [2] https://urldefense.proofpoint.com/v2/url?u=https-3A__ > launchpad.net_-7Esssd_-2Barchive_ubuntu_updates&d=DQIGaQ&c= > lb62iw4YL4RFalcE2hQUQealT9-RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e- > CbhH6xUjnRkaqPFUS2wTJ2cw&m=e5O5zPnwDumy2ONJT4dlFcqr7saa51Qy72hsJc4f87I&s= > Ql0q2KebQkGKdDX18BnMX8kAgrDhOP5veCzFmLu1GRg&e= > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists. > fedorahosted.org_admin_lists_sssd-2Dusers-40lists. > fedorahosted.org&d=DQIGaQ&c=lb62iw4YL4RFalcE2hQUQealT9- > RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e-CbhH6xUjnRkaqPFUS2wTJ2cw&m= > e5O5zPnwDumy2ONJT4dlFcqr7saa51Qy72hsJc4f87I&s= > Ik1cAF4mlAZIwL7EXJakHVYvpY3FXgdmwJFM3W4qNp4&e= >

2 2

A problem automounting user's AD home directory
by Matthew Hanley 29 Aug '16

29 Aug '16

I am using sssd-1.13.0-40.el7_2.12.x86_64? on CentOS 7.2 and am running into a problem trying to mount user's home directories from active directory. At this time I am able to authenticate to AD just fine. However, user's home directories in AD are not the traditional '/home/$USER', but are simply a number that was randomly generated. I can do an ldapsearch, grab 'homeDirectory', and parse out the path, but I have to do this externally and can't see a way to pass the information back to SSSD. Is it possible to have SSSD grab the user's AD home directory, and then have it pass it to something that can automount it (autofs or pam_mount)? Thanks! -Matt Matthew Hanley IT Analyst College of Engineering and Computer Science Syracuse University

3 3

SID->UID/GID mapping issues
by John Hodrien 29 Aug '16

29 Aug '16

CentOS 7 install fully updated (sssd-1.13.0-40.el7_2.9.x86_64). Samba setup, SSSD setup, using AD with SFU attributes. wbinfo isn't doing SID -> UID/GID mappings properly. # wbinfo -n correctuser failed to call wbcLookupName: WBC_ERR_UNKNOWN_FAILURE Could not lookup name correctuser # wbinfo -n MYDOMAIN\\correctuser S-1-5-21-XXXXX SID_USER (1) # Correct # wbinfo -s S-1-5-21-XXXXX failed to call wbcLookupSid: WBC_ERR_UNKNOWN_FAILURE Could not lookup sid S-1-5-21-XXXXX # wbinfo --user-sidinfo=S-1-5-21-XXXXX correctuser:*:12345:678:Correct User:/correct/home:/bin/bash I get basically the same behaviour with groups. Results in the display of SIDs in Windows rather than resolved names. Swap out to use winbind instead: alternatives --set libwbclient.so.0.12-64 /usr/lib64/samba/wbclient/libwbclient.so.0.12 All works perfectly well, with all of those cases working fine, and Windows clients happy as Larry. If I restart SSSD and run wbinfo -s, I see in the logs that it find the right record, in as much as it does a sane query, finds a the correctuser record, and stores the user, and it declares that it found the SID later: [sdap_search_user_process] (0x0400): Search for users, returned 1 results. ... [sdap_save_user] (0x0400): Storing info for user correctuser ... [ad_master_domain_next_done] (0x0400): Found SID [S-1-5-21-XXXXX] Nothing looks pained, but it doesn't work. Any clues how to debug this? jh

2 1

sssd pam authentication works with su, but not ssh
by rpoyner＠wisc.edu 29 Aug '16

29 Aug '16

I'm using sssd 1.11.7 in a jail on freebsd 10.2. and seeing an odd failure. sssd is configured for nss, and pam both against an openldap server. Nss seems to work as evidenced by various getent calls. When I ssh to the jail as an ldap user the authentication fails with return code 9: (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: default (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: not set (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: host.edu (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 65873 (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [9][default] (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [9]. (Thu Aug 25 10:55:52 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 24 (Thu Aug 25 10:55:52 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected! When I login to the jail as an un-privleged user and su to the ldap user authentication succeeds: (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not set (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myser (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: /dev/pts/1 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: anotheruser (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 67944 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [myuser@default] (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data: (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: default (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): service: su (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: /dev/pts/1 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: anotheruser (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: not set (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 0 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 67944 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][default] (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0]. (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 24 (Thu Aug 25 11:00:24 2016) [sssd[pam]] [pam_cmd_setcred] (0x0100): entering pam_cmd_setcred Even weirder is the fact that having once used su to authenticate the ldap user, subsequent attempts to ssh as the ldap user succeed! (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3]. (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3]. (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_cmd_authenticate] (0x0100): entering pam_cmd_authenticate (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: not set (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: not set (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: host.edu (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 78882 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_check_user_search] (0x0100): Requesting info for [myuser@default] (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_dp_send_req] (0x0100): Sending request with the following data: (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): command: PAM_AUTHENTICATE (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): domain: default (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): user: myuser (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): service: sshd (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): tty: not set (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): ruser: not set (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): rhost: host.edu (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): authtok type: 1 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): newauthtok type: 0 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): priv: 1 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_print_data] (0x0100): cli_pid: 78882 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_dom_forwarder] (0x0100): pam_dp_send_req returned 0 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_dp_process_reply] (0x0100): received: [0][default] (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_reply] (0x0200): pam_reply called with result [0]. (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_reply] (0x0200): blen: 24 (Thu Aug 25 11:31:03 2016) [sssd[pam]] [client_recv] (0x0200): Client disconnected! (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Received client version [3]. (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_cmd_get_version] (0x0200): Offered version [3]. (Thu Aug 25 11:31:03 2016) [sssd[pam]] [pam_cmd_setcred] (0x0100): entering pam_cmd_setcred (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): name 'myuser' matched without domain, user is myuser (Thu Aug 25 11:31:03 2016) [sssd[pam]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] Suggestions for next steps are welcome. Thanks

4 9

autofs question
by Thomas Beaudry 26 Aug '16

26 Aug '16

Hi Everyone, I am trying to do the following and haven't been able to find a resource on it so I wanted to know if it's even possible. Here is what I want to be able to do. 1. ssh to server (I have and AD credentials check working with sssd already) 2. automount a directory from a NAS on ssh login with sssd. What I would like to be able to use is an auto.master file and an auto.data file to do this and have the credentials provided via sssd. I was able to get this to work without sssd (i.e just autofs and a credential file already), But the server is going to be accessed by many users, so a credentials file isn't the way to go about it. Thanks, Thomas

3 11

Feature request: Partial id_mapping
by Joakim Tjernlund 25 Aug '16

25 Aug '16

Getting to the of our AD domain migration but there is one step I haven't solved. Our users has UID/GID in the new domain while the already present users in the new domain does not. Assigning UID/GID to all users does not sit well with upstream IT so I am looking at what to do with these when they visit/access our site. What comes to mind is partial id_mapping, if a user had UID/GID in the AD use that, otherwise do id_mapping for that user(preferably the same way samba does it since we already have a samba based interim solution). I haven't found a way to do that in sssd, is there? Maybe I am just full of it and this is really a bad idea?

5 11

DDNS update against Windows AD when switching to WiFi ?
by Joakim Tjernlund 24 Aug '16

24 Aug '16

Currently we have different IP addresses when using wired(Ethernet) and WiFi. I would like sssd to refresh its DDNS record whenever I switch between wired and WiFi, is this possible? So far I have only managed to refresh DDNS by restarting sssd but maybe there is a better way? Jocke

2 2

sssd seems seems not to respect default_realm = xxx ?
by Joakim Tjernlund 23 Aug '16

23 Aug '16

I changed the default REALM in krb5.conf but that did not have any effect on logins. I had to change the order of domains = in sssd.conf for logins to switch over to the new default domain. Should not sssd respect default_realm = xx in krb5.conf? Using sssd 1.13.4 Jocke

3 7

adcli --service-name strangeness
by Joakim Tjernlund 23 Aug '16

23 Aug '16

If I add --service-name="nfs" when joining a domain I do not get any host/* or RestrictedKrbHost/* entries in my keytab. Is this intentional? Jocke

2 3

adcli --service-name="host" vs. --user-principal=host/gentoo-lab.transmode.se@TRANSMODE.SE?
by Joakim Tjernlund 23 Aug '16

23 Aug '16

Is there a difference between the above two options? Also, I have always wondered why there is two version of ever service as in: host/GENTOO-LAB(a)TRANSMODE.SE vs. host/gentoo-lab.transmode.se(a)TRANSMODE.SE Jocke

3 3

DDNS not working due to non FQDN hostname
by Joakim Tjernlund 22 Aug '16

22 Aug '16

Discovered why DDNS was not working in this ticket: https://fedorahosted.org/sssd/ticket/2565 May I suggest that if gethostname() returns a non . name, sssd should automatically add the configured SSSD domain name in sssd.conf ( [domain/domain.name] ) Jocke

5 18

Announcing SSSD 1.14.1
by Jakub Hrozek 19 Aug '16

19 Aug '16

=== SSSD 1.14.1 === The SSSD team is proud to announce the release of version 1.14.1 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The IPA provider now supports logins with enterprise principals (also known as additional UPN suffixes). This functionality also enabled Active Directory users from trusted AD domains who use an additional UPN suffix to log in. Please note that this feature requires a recent IPA server. * When a user name is overriden in an IPA domain, resolving a group these users are a member of now returns the overriden user names * Users can be looked up by and log in with their e-mail address as an identifier. In order to do so, an attribute that represents the user's e-mail address is fetched by default. This attribute can by customized by setting the ldap_user_email configuration option. * A new ad_enabled_domains option was added. This option lets the administrator select domains that SSSD should attempt to reach in the AD forest SSSD is joined to. This option is useful for deployments where not all domains are reachable on the network level, yet the administrator needs to access some trusted domains and therefore disabling the subdomains provider completely is not desirable. * The sssctl tool has two new commands active-server and servers that allow the administrator to observe the server that SSSD is bound to and the servers that SSSD autodiscovered * SSSD used to fail to start when an attribute name is present in both the default SSSD attribute map and the custom ldap_user_extra_attrs map * GPO policy procesing no longer fails if the gPCMachineExtensionNames attribute only contains whitespaces * Several commits fix regressions related to switching all user and group names to fully qualified format, such as running initgroups for a user who is only a member of a primary group * Several patches fix regressions caused by splitting the database into two ldb files, such as when user attributes change without increasing the modifyTimestamp attribute value * systemd unit files are now shipped for the sssd-secrets responder, allowing the responder to be socket-activated. To do so, administrators should enable the sssd-secrets.socket and sssd-secrets.service systemd units. * The sssd binary has a new switch --disable-netlink that lets sssd skip messages from the kernel's netlink interface. * A crash when entries with special characters such as '(' were requested was fixed * The ldap_rfc_2307_fallback_to_local_users option was broken in the previous version. This release fixes the functionality. == Packaging Changes == * The NFS ID-mapping plugin was moved to its own subpackage == Documentation Changes == * A new option ad_enabled_domains was added * A new LDAP attribute mapping for e-mail addresses called ldap_user_email was added == Tickets Fixed == https://fedorahosted.org/sssd/ticket/2789 Warn if ad_server contains IP address https://fedorahosted.org/sssd/ticket/2828 Add an option to disable checking for trusted domains in the subdomains provider https://fedorahosted.org/sssd/ticket/2856 [RFE] Allow users to authenticate with alternative names https://fedorahosted.org/sssd/ticket/2860 Add support for disabling netlink use https://fedorahosted.org/sssd/ticket/2948 Handle overriden name of members in the memberUid attribute https://fedorahosted.org/sssd/ticket/2958 Support multiple principals for IPA users https://fedorahosted.org/sssd/ticket/2978 pid file name decalration is duplicated https://fedorahosted.org/sssd/ticket/2987 Improve information about krb5_keytab & ldap_krb5_keytab option in sssd man pages https://fedorahosted.org/sssd/ticket/3009 sssd fails to mark a connection as bad on searches that time out https://fedorahosted.org/sssd/ticket/3018 Detect of IPA server can handle enterprise principals https://fedorahosted.org/sssd/ticket/3024 sssd-common brings in nfs-utils https://fedorahosted.org/sssd/ticket/3064 incorrect dataExpireTimestamp setting in the timestamps cache https://fedorahosted.org/sssd/ticket/3068 fixes to the initial config schema implementation https://fedorahosted.org/sssd/ticket/3069 The sssctl tool should provide information about active and available servers https://fedorahosted.org/sssd/ticket/3072 task: Add a 1.14 upstream repo https://fedorahosted.org/sssd/ticket/3077 sssd does not work under non-root user https://fedorahosted.org/sssd/ticket/3084 DP: Don't pass empty string, but NULL to providers https://fedorahosted.org/sssd/ticket/3086 tools: sssctl config-check and sssctl cache ignore --help https://fedorahosted.org/sssd/ticket/3087 tools: make sssctl command names consistent https://fedorahosted.org/sssd/ticket/3088 Review and update SSSD's wiki pages for 1.14.1 release https://fedorahosted.org/sssd/ticket/3089 Error message "Failed to retrieve users" is sometimes misleading https://fedorahosted.org/sssd/ticket/3090 Don't print message about trust direction on clients https://fedorahosted.org/sssd/ticket/3091 remove DEBUG(SSSDBG_TRACE_INTERNAL, "Trace: ldap_result found nothing!\n"); https://fedorahosted.org/sssd/ticket/3093 Missing nested groups in user groups https://fedorahosted.org/sssd/ticket/3094 SELINUX_getpeercon failed [-1][Unknown error -1]. https://fedorahosted.org/sssd/ticket/3096 sssctl: Time stamps without time zone information https://fedorahosted.org/sssd/ticket/3101 sssd does not start if sub-domain user is used with simple access provider https://fedorahosted.org/sssd/ticket/3109 Wrong pam error code returned for password change in offline mode https://fedorahosted.org/sssd/ticket/3110 Access denied after activating user in 389ds https://fedorahosted.org/sssd/ticket/3111 sssd doesn't start on IPA client if IPA server VM is paused https://fedorahosted.org/sssd/ticket/3120 SSSD fails to start when ldap_user_extra_attrs contains mail https://fedorahosted.org/sssd/ticket/3121 [abrt] [faf] sssd: unknown function(): /usr/libexec/sssd/sssd_nss killed by 11 https://fedorahosted.org/sssd/ticket/3122 Do not check local users with disabled local_negative_timeout https://fedorahosted.org/sssd/ticket/3130 Better error message if sssctl is ran w/o activating the IFP responder https://fedorahosted.org/sssd/ticket/3132 check return value of sysdb_search_user_by_upn() == Detailed Changelog == Dan Lavu (1): * MAN: Update description of sssctl Fabiano Fidêncio (5): * sssctl: Use localtime for time stamps * RESPONDERS: Decrease debug level for failures in SELINUX_getpeercon() * RESPONDERS: Show a bit more info in case of SELINUX_getpeercon() failure * RESPONDERS: Pass errno to strerror() when SELINUX_getpeercon() fails * SDAP: Don't log an op failure when no users are found Jakub Hrozek (18): * Updating the version for the 1.14.1 release * FO: Set port to NOT_WORKING when trying a next server * LDAP: Fix storing initgroups for users with no supplementary groups * LDAP: Use FQDN when linking parent LDAP groups * SYSDB: Fix setting dataExpireTimestamp if sysdb is supposed to set the current time * PAM: Do not act on ldb_message in case of a failure * IPA: Check the return value of sss_parse_internal_fqname * SIMPLE: Do not parse names on startup * SIMPLE: Fail on any error parsing the access control list * SIMPLE: Make the DP handlers testable * TESTS: Use the DP handlers in simple provider tests, add more tests * CONFIG: full_name_format is an allowed option for all domains * CONFIG: re_expression is an allowed option for all domains * SPEC: Own the secrets DB path * UTIL: Use sss_atomic_read_s in generate_csprng_buffer * SECRETS: Use sss_atomic_read/write for better readability * BUILD: Ship systemd service file for sssd-secrets * Updating the translations for the 1.14.1 release Justin Stephenson (4): * Make resolv_is_address() function public and create some basic tests * Warn if IP address is used as option for ipa_server/ad_server * Monitor: Add support for disabling netlink * SSSCTL: More helpful error message when InfoPipe? is disabled Lukas Slebodnik (37): * sssctl: Fix error handling after memory allocation failure * sssctl: Fix format string for size_t * doxygen: Fix path to header file ipa_hbac.h * ipa_hbac: Fix documentation for hbac_enable_debug * sssctl: Fix warning maybe-uninitialized * nss-srv-tests: Fix prototype of wrapped ncache functions * TOOLS: Prevent dereference of null pointer * sysdb-tests: Fix cast from pointer to integer * SPEC: Move nfsidmap plugin to separate package * test_utils: Clean files after sss_write_krb5_conf_snippet * CI: Use /bin/sh as a CONFIG SHELL * SECRETS: Log message for failures with removing file * Amend debug messages after failure of unlink * SYSDB: Do not try to modify ts cache for unsupported DNs * SDAP: sanitize member name before using in filter * SDAP: sysdb_search_users does not set users_count for failures * SYSDB: Sanitize dn in sysdb_get_user_members_recursively * LDAP: Fix Dereference after NULL check * NSS: Do not check local users with disabled local_negative_timeout * config_schema: Add ldap_user_email to schema * intg: Make location of sssd nss module configurable * intg: Allow to test netgroups * NSS: Use correct name for invalidating memory cache * SYSDB: Avoid optimisation with modifyTimestamp for users * dyndns-tests: Fix false positive failures * LDAP: Log autofs rfc2307 config changes only with enabled responder * DP: Add log message for get account info * ds.py: Do not call teardown in destructor * test_local_domain: Restore correct env variable * intg: rename test with enumeration * test_enumeration: Remove test without enumeration * intg: create ldap test without enumeration * sssd_id.py: Primary group should be returned for initgroups * intg: Fix pep8 warnings * test_ldap: test nested membership with rfc2307bis * test_ldap: test resolving of names with special characters * intg: Test extra attributes duplicate Michal Židek (13): * sssctl: config-check access check report * config: override_space is monitor's option * config: Fix user_attributes * config: Allow timeout for all sevices * config: Add config_file_version to schema * dyndns: Add checks for NULL * sdap: Fix ldap_rfc_2307_fallback_to_local_users * sss_ini: Change debug level of config error msgs * sssctl: Consistent commands naming * tools: Add missing gettext macro * sssctl: Generic help for cache-upgrade and config-check * gpo: gPCMachineExtensionNames with just whitespaces * sdap: Skip exact duplicates when extending maps Pavel Březina (17): * sssctl: move filter creation to separate function * sssctl: improve readability of a condition * DP: rename be_acct_req to dp_id_data * DP: Initialize D-Bus as soon as possible * utils: add remove_subtree * sssctl: use internal API to remove files * rdp: add ability to forward reply to the client request * sbus: add sbus_request_reply_error() * sbus: add utility function to simplify message and reply handling * sssctl: use talloc with sifp * failover: mark subdomain service with sd_ prefix * sssctl: print active server and server list * sifp: fix coverity warning * sbus: allow freeing msg through dbus api when using talloc * PROXY: Do not abuse data provider interface * DP: Remove old data provider interface * NSS: Remove unused functions Petr Cech (18): * SYSDB: Fixing DB update * PROVIDERS: Setting right {u,g}id if unprivileged * SYSDB: Removing of duplication of sysdb_ts_cache_attrs * test_utils: Fixing assignment discards 'const' qualifier * LDAP: Changing of confusing debug message * IPA: Changing of confusing debug message * Revert "LDAP: Lookup services by all protocols unless a protocol is specified" * PROVIDER: Conversion empty string from D-Bus to NULL * LDAP: Fixing wrong pam error code for passwd * UTILS: Fixing duplication of pid file declaration * AD_PROVIDER: Add ad_enabled_domains option * AD_PROVIDER: Initializing of ad_enabled_domains * AD_PROVIDER: ad_enabled_domains - only master * AD_PROVIDER: ad_enabled_domains - other then master * TESTS: Adding tests for ad_enabled_domains option * LDAP: Adding support for SIGTERM signal * LDAP: Adding SIGTERM signal before SIGKILL * LDAP: Adding SIGCHLD callback Sumit Bose (33): * views: allow override added for non-default views at runtime * IPA: read ipaNTAdditionalSuffixes for master and trusted domains * sysdb: add UPN suffix support for the master domain * sysdb: make subdomain calls aware of upn_suffixes * DP: add dp_get_module_data() * IPA: add ipa_init_get_krb5_auth_ctx() * IPA: enable enterprise principals if server supports them * IPA: fix [capaths] output * UTIL: make domain mapping content testable * tests: add tests for sss_get_domain_mappings_content() * AD: avoid memory leak in netlogon_get_domain_info() and make it public * AD: netlogon_get_domain_info() allow missing arguments and empty results * tests: add tests for netlogon_get_domain_info * AD: replace ad_get_client_site_parse_ndr() with netlogon_get_domain_info() * sysdb_master_domain_add_info: properly set do_update * IPA: make ipa_resolve_user_list_{send|recv} public and allow AD users * IPA: expand ghost members of AD groups in server-mode * sysdb: add sysdb_get_user_members_recursively() * views: properly override group member names * IPA: fix lookup by UPN for subdomains * LDAP: allow multiple user principals * LDAP: new attribute option ldap_user_email * sysdb: include email in UPN searches * LDAP: include email in UPN searches * NSS: add user email to fill_orig() * utils: add is_email_from_domain() * LDAP/IPA: add local email address to aliases * NSS: continue with UPN/email search if name was not found * PAM: continue with UPN/email search if name was not found * NSS: use different neg cache name for UPN searches * PAM: Fix domain for UPN based lookups * SDAP: add special handling for IPA Kerberos enterprise principal strings * SDAP: add enterprise principal strings for user searches Thorsten Scherf (1): * Fixed some typos in man pages

1 0

netlink messages on Infiniband causing sssd to exit
by Ryan Novosielski 19 Aug '16

19 Aug '16

Over time, I’ve been having seemingly random sssd quits that I’ve not been able to figure out. Today, I finally traced it to fluctuations on my Infiniband fabric: sssd.log (Tue Nov 3 13:17:59 2015) [sssd] [message_type] (0x0200): netlink Message type: 16 (Tue Nov 3 13:17:59 2015) [sssd] [link_msg_handler] (0x1000): netlink link message: iface idx 4 (ib0) flags 0x1003 (broadcast,multicast,up) (Tue Nov 3 13:17:59 2015) [sssd] [message_type] (0x0200): netlink Message type: 16 (Tue Nov 3 13:17:59 2015) [sssd] [link_msg_handler] (0x1000): netlink link message: iface idx 4 (ib0) flags 0x11043 (broadcast,multicast,up,running,lower) This exactly corresponds to the time in /var/log/messages for the unexplained shutdown: 2015-11-03T13:17:59-05:00 node75 sssd[pam]: Shutting down 2015-11-03T13:17:59-05:00 node75 sssd[be[default]]: Shutting down 2015-11-03T13:17:59-05:00 node75 sssd[nss]: Shutting down Here is sssd_default.log for good measure: (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1414770/0x14133d0 (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1414770/0x13fef90 (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_ptask_destructor] (0x0400): Terminating periodic task [Cleanup of default] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sdap_handle_release] (0x2000): Trace: sh[0x14bd850], connected[1], ops[(nil)], ldap[0x1424260], destructor_lock[0], release_memory[0] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_connection_callback] (0x4000): Successfully removed connection callback. (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [sbus_remove_watch] (0x2000): 0x1415970/0x1416430 (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): The symlink points to [/var/lib/sss/pipes/private/sbus-dp_default.18702] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): The path including our pid is [/var/lib/sss/pipes/private/sbus-dp_default.18702] (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [remove_socket_symlink] (0x4000): Removed the symlink (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_client_destructor] (0x0400): Removed PAM client (Tue Nov 3 13:17:59 2015) [sssd[be[default]]] [be_client_destructor] (0x0400): Removed NSS client I can duplicate this by manually taking down the Infiniband link: [root@node24 ~]# service sssd status sssd (pid 9132) is running... [root@node24 ~]# ifdown ib0 [root@node24 ~]# service sssd status sssd dead but pid file exists I have also noticed that sssd will not start on boot. As I know that Infiniband tends to flutter a little bit before the link comes up, I’m thinking this is probably the same cause. Can anyone explain this behavior and tell me what I might do to prevent it? -- ____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Senior Technologist || \\ and Health | novosirj(a)rutgers.edu - 973/972.0922 (2x0922) || \\ Sciences | OIRT/High Perf & Res Comp - MSB C630, Newark `'

5 7

sssd incorrectly claims duplicate GIDs found
by Jeff White 18 Aug '16

18 Aug '16

I am running 80+ CentOS 7 systems all configured identically. I found one of my groups is not working on several of them. sssd's log shows: Aug 18 08:25:07 cn33 sssd[nss][3804]: More groups have the same GID [7021] in directory server. SSSD will not work correctly. sssd is configured to query Active Directory so I ran an query for 'gidNumber=7021' via ldapsearch. That returned only one result. 7021 is also not in /etc/group. I have not been able to find any useful information in sssd's other logs (nor do I know what each log is, so I'm just digging blindly): # ls -lh /var/log/sssd/ total 75M -rw------- 1 root root 0 Aug 16 03:42 krb5_child.log -rw------- 1 root root 5.4K Aug 18 08:10 krb5_child.log-20160816 -rw------- 1 root root 3.5K Aug 18 08:26 ldap_child.log -rw------- 1 root root 18K Jul 26 07:03 ldap_child.log-20160720.gz -rw------- 1 root root 1.5M Aug 18 08:25 ldap_child.log-20160727 -rw------- 1 root root 19M Aug 18 08:28 sssd_ad.wsu.edu.log -rw------- 1 root root 497K Aug 8 03:37 sssd_ad.wsu.edu.log-20160808.gz -rw------- 1 root root 53M Aug 14 03:47 sssd_ad.wsu.edu.log-20160814 -rw------- 1 root root 0 May 10 10:43 sssd.log -rw------- 1 root root 593K Aug 18 08:25 sssd_nss.log -rw------- 1 root root 3.8K Aug 12 03:14 sssd_nss.log-20160812.gz -rw------- 1 root root 722K Aug 14 03:49 sssd_nss.log-20160814 -rw------- 1 root root 0 May 10 10:43 sssd_pam.log I restarted the daemon and cleared cache with `sss_cache -E`, still gets the same error. Oddly, this is not effecting all of my systems. On some, the group works: $ getent group 7021 its_p_sto_qa_hpc_kamiak-kelley:*:7021:person1,person2,whatever The working and failing systems are running the same version of sssd: # salt -L cn31,cn33,cn29,cn5,cn34,cn17 cmd.run 'rpm -q sssd' # broken nodes cn33: sssd-1.13.0-40.el7_2.2.x86_64 cn29: sssd-1.13.0-40.el7_2.2.x86_64 cn31: sssd-1.13.0-40.el7_2.2.x86_64 cn34: sssd-1.13.0-40.el7_2.2.x86_64 cn17: sssd-1.13.0-40.el7_2.2.x86_64 cn5: sssd-1.13.0-40.el7_2.2.x86_64 # salt -L cn28,cn16,cn44,cn1,cn42,cn9 cmd.run 'rpm -q sssd' # working nodes cn16: sssd-1.13.0-40.el7_2.2.x86_64 cn28: sssd-1.13.0-40.el7_2.2.x86_64 cn42: sssd-1.13.0-40.el7_2.2.x86_64 cn1: sssd-1.13.0-40.el7_2.2.x86_64 cn44: sssd-1.13.0-40.el7_2.2.x86_64 cn9: sssd-1.13.0-40.el7_2.2.x86_64 So what now? How can I determine what sssd is unhappy about? -- Jeff White HPC Systems Engineer Information Technology Services - WSU

3 3

Mounting NFS over cross domains
by Joakim Tjernlund 17 Aug '16

17 Aug '16

Feels like I am very close to having integrated our two domains but one thing remains ... I have a NFSv4(sec=krb5i,sec=krb5) server in realm TRANSMODE.SE and a NFS client in INFINERA.COM realm and automounts the NFS share in the client. This all works, I get access in the client and kan access files but all files are listed with user=nobody, group=nobody: ls -l total 48 drwxrws--- 2 nobody nobody 104 Aug 17 15:34 ./ drwxrws--- 15 nobody nobody 4096 Aug 17 16:16 ../ -rwxrwx--- 1 nobody nobody 7 Aug 17 15:34 dasdsad.txt* -rwxrwx--- 1 nobody nobody 6180 Aug 17 15:34 New Microsoft Excel Worksheet.xlsx* -rwxrwx--- 1 nobody nobody 11292 Aug 17 15:34 New Microsoft Word Document.docx* Any idea how I can get the correct user/group IDs listed ? Jocke

2 5

Re: Group Enumeration Issue
by Douglas Duckworth 17 Aug '16

17 Aug '16

Michael I have the same number of users and groups present in output of "getent passwd" and "getent group" vs host which is configured with pam_ldap and ldap_nss but not sssd. If I specify in /etc/nsswitch.conf, shown below, thus removing order "files ldap sss," then restarting sssd and nslcd things still work. passwd: files sss shadow: files sss group: files sss So is there *really* an issue? The OS: Red Hat Enterprise Linux AS release 4 (Nahant Update 3) The LDAP: OpenLDAP: slapd 2.2.13 (Aug 18 2005 22:23:00) Thanks again for so much assistance. Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690 On Tue, Aug 16, 2016 at 6:37 PM, Michael Ströder <michael(a)stroeder.com> wrote: > Douglas Duckworth wrote: > > Thanks so much for the assistance. > > > > Added: > > > > ldap_disable_paging = true > > > > Does this mean the problem's resolved? > > > > I login successfully then error repeats.... > > So the issue is likely not solved. ;-) > > Which LDAP server is this? > > Note that you might run into a size or time limit while retrieving all > entries. > I'd check with ldapsearch command-line tool binding as the very same > identity > whether you can retrieve all needed entries via LDAP. > > Ciao, Michael. > >

1 0

DNS resolver broken in sssd?
by Ondrej Valousek 17 Aug '16

17 Aug '16

Hi list, I am regularly getting messages like: (Mon Aug 8 21:20:19 2016) [sssd[be[default]]] [be_resolve_server_process] (0x0080): Couldn't resolve server (myserver.com) resolver returned (5) Or (Wed Aug 10 15:47:46 2016) [sssd[be[default]]] [nsupdate_get_addrs_done] (0x0040): Could not resolve address for this machine, error [5]: Input/output error, resolver returned: [11]: Could not contact DNS servers I am also running TCPdump in the background - no DNS query has been performed at the time of the error and my dns servers are working fine. What could be the reason? Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

4 7

Re: Group Enumeration Issue
by Douglas Duckworth 16 Aug '16

16 Aug '16

Thanks so much for the assistance. Added: ldap_disable_paging = true Does this mean the problem's resolved? I login successfully then error repeats.... (Tue Aug 16 09:55:41 2016) [sssd[be[LDAP]]] [sdap_get_generic_op_finished] (0x0040): Unexpected result from ldap: Protocol error(2), paged results cookie is invalid (Tue Aug 16 09:55:41 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [5]: Input/output error (Tue Aug 16 09:55:41 2016) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040): Failed to retrieve users (Tue Aug 16 09:55:41 2016) [sssd[be[LDAP]]] [sdap_dom_enum_ex_users_done] (0x0040): User enumeration failed: 5: Input/output error (Tue Aug 16 09:55:41 2016) [sssd[be[LDAP]]] [be_ptask_done] (0x0040): Task [enumeration]: failed with [5]: Input/output error (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [be_res_get_opts] (0x0100): Lookup order: ipv4_first (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [monitor_common_send_id] (0x0100): Sending ID: (%BE_LDAP,1) (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [sss_names_init_from_args] (0x0100): Using re [(?P<name>[^@]+)@?(?P<domain>[^@]*$)]. (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. Later: (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'old dinosaur' as 'working' (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0x177a8f0] (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [be_client_init] (0x0100): Set-up Backend ID timeout [0x177d690] (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [client_registration] (0x0100): Cancel DP ID timeout [0x177a8f0] (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [client_registration] (0x0100): Added Frontend client [NSS] (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [enum_users_done] (0x0100): Users higher USN value: [20160816071917Z] <---- enumeration works? (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [client_registration] (0x0100): Cancel DP ID timeout [0x177d690] (Tue Aug 16 09:58:43 2016) [sssd[be[LDAP]]] [client_registration] (0x0100): Added Frontend client [PAM] (Tue Aug 16 09:58:44 2016) [sssd[be[LDAP]]] [sdap_process_group_send] (0x0040): No Members. Done! <------ this repeats much - only showing one line for sake of space (Tue Aug 16 09:58:44 2016) [sssd[be[LDAP]]] [enum_groups_done] (0x0100): Groups higher USN value: [20160727234025Z] <---- enumeration works? I type getent passwd / group: (Tue Aug 16 10:03:43 2016) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040): Failed to retrieve users (Tue Aug 16 10:08:17 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Tue Aug 16 10:08:39 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Tue Aug 16 10:08:43 2016) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040): Failed to retrieve users Greater logging with me typing "getent user" attached... I am not able to see any issues. I can post more extensive logs if that would be helpful. Thanks Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690 On Tue, Aug 16, 2016 at 5:29 AM, Michael Ströder <michael(a)stroeder.com> wrote: > Jakub Hrozek wrote: > > This is a different issue now. It looks like the server does not support > > paged searches correctly or has issues with the paging support, because > > it sends an invalid cookie (the invalid cookie message is reported by > > openldap-libs..) > > [..] > > I wonder if it would be possible to increase the page size with the > > ldap_page_size option to make the enumeration results fit into one page? > > Or simply use > > ldap_disable_paging = true > > Note that only AD allows circumventing search limits with this extended > control. > All other LDAP servers I know and especially OpenLDAP enforce the search > size > limits also with paged search. > > Ciao, Michael. > >

2 1

Re: Group Enumeration Issue
by Douglas Duckworth 16 Aug '16

16 Aug '16

Thank you Jakub I understand what we're doing isn't supported and horrible practice. We are replacing the insecure LDAP server very soon. I set ldap_uri = ldap://BLAH in sssd.conf and seems to be working despite expired cert. Though there are some error messages I would like to resolve. We are using host-based access control: auth_provider = ldap access_provider = ldap ldap_access_order = host ldap_user_authorized_host = host As you can see sdap_access_host does grant access to accounts with the host attribute: (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'BLAH' as 'working' (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'BLAH as 'working' (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: sysadmin (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser: (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: proxy (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 11864 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_access_host] (0x0100): Access granted for [CLIENT] (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success] (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sending result [0][LDAP] (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler_callback] (0x0100): Sent result [0][LDAP] (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [be_pam_handler] (0x0100): Got request with the following data (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): domain: LDAP (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): user: sysadmin (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): service: sshd (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): tty: ssh (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): ruser: (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): rhost: proxy (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): priv: 1 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): cli_pid: 11864 (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [pam_print_data] (0x0100): logon name: not set (Mon Aug 15 11:21:13 2016) [sssd[be[LDAP]]] [sdap_access_host] (0x0100): Access granted for [CLIENT] Though right before the above successful login we see: (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'BLAH as 'working' (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [set_server_common_status] (0x0100): Marking server 'BLAH' as 'working' (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_get_generic_op_finished] (0x0040): Unexpected result from ldap: Protocol error(2), paged results cookie is invalid (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [5]: Input/output error (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_get_users_done] (0x0040): Failed to retrieve users (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [sdap_dom_enum_ex_users_done] (0x0040): User enumeration failed: 5: Input/output error (Mon Aug 15 11:16:54 2016) [sssd[be[LDAP]]] [be_ptask_done] (0x0040): Task [enumeration]: failed with [5]: Input/output error Does this mean that enumeration occurs not with SSSD but NSS? Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690 On Mon, Aug 15, 2016 at 3:45 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote: > On Fri, Aug 12, 2016 at 12:05:46PM -0400, Douglas Duckworth wrote: > > Clarification > > > > This works: > > > > ldapsearch -x -ZZ -H ldap://blah dc=blah-x uid=me -d3 > > > > Again says expired certificate. > > > > I set ldap_uri = ldaps://blah, ldap://blah and ldap_tls_reqcert = never > in > > sssd.conf but still failure. > > To be honest I'm not sure if setting the tls_reqcert value to never only > hides the trust issues or also expiration issues. > > btw the ldapsearch is for ldap:// with TLS, but SSSD is asked for > ldaps://, does sssd work with ldap:// only? (if you need confidentiality > for identity lookups you can set ldap_id_use_start_tls. For > authentication, TLS will be tried automatically, SSSD doesn't support > authentication over an unencrypted channel) > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists. > fedorahosted.org_admin_lists_sssd-2Dusers-40lists. > fedorahosted.org&d=DQIGaQ&c=lb62iw4YL4RFalcE2hQUQealT9- > RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e-CbhH6xUjnRkaqPFUS2wTJ2cw&m= > ZqsTB2JT98oTSoYAWIbe7YnWKuNrXDEVIK7i1Ljyqlg&s= > o0iBmvS8uYOP0J6AMR_SEAGXSzzv_YQaLY4v02fCfoU&e= >

3 2

SSSD-PAM failure
by Thomas Beaudry 15 Aug '16

15 Aug '16

Happy <onday everyone! I have a problem getting sssd/pam to work. I can do a getent passwd username and su finds the user, but the password authentication fails. Here is my sssd_pam.log error log: (Thu Aug 4 12:31:07 2016) [sssd[pam]] [pam_process_init] (0x0010): sss_process_init() failed (Thu Aug 4 12:31:07 2016) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Thu Aug 4 12:31:07 2016) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector Would you know how to fix this problem? I can send you more info if you want to help. I have been googling the problem for awhile to no avail. Thanks, Thomas

4 29

GSSAPI token errors
by Robert Moulton 15 Aug '16

15 Aug '16

On a CentOS 6 system we recently implemented sssd auth against an AD domain (Samba 4 AD, specifically). The system messages log often shows flurries of these GSSAPI errors: sssd[be[notarealdomain.com]]: GSSAPI Error: Invalid token was supplied (Token header is malformed or corrupt) Any idea what might be wrong? Troubleshooting tips? (We don't have much experience with sssd, admittedly.) When the flurries happen, system load increases markedly, and we suspect that a recent system crash was related. Our sssd.conf: ---------- [sssd] services = nss, pam config_file_version = 2 domains = notarealdomain.com [nss] [pam] [domain/notarealdomain.com] id_provider = ad access_provider = ad ldap_id_mapping=false krb5_keytab=/etc/krb5.sssd.keytab ---------- thanks in advance, -r

2 5

Re: Group Enumeration Issue
by Douglas Duckworth 15 Aug '16

15 Aug '16

Jakub I had base set to Accounts OU in nslcd so I can now enumerate groups by setting base correctly :) However I still do see this issue in sssd_LDAP log: (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'blah' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_send] (0x4000): Using file descriptor [21] for LDAP connection. (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_send] (0x0400): Setting 30 seconds timeout for connecting (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): ldap_install_tls failed: Connect error (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_state_destructor] (0x0400): calling ldap_unbind_ext for ldap:[0x20333d0] sd:[21] (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [5]: Input/output error. (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0x202c170], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [_be_fo_set_port_status] (0x8000): Setting status: PORT_NOT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1564 (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 636 of server 'blah' as 'not working' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0400): Marking port 636 of duplicate server 'blah as 'not working' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [get_server_status] (0x1000): Status of server 'blah is 'name resolved' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'blah' is 'not working' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP' (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5 (Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [check_online_callback] (0x0100): Backend returned: (1, 0, <NULL>) [Provider is Offline] LDAPTLS_REQCERT=never ldapsearch -Z -x uid=blah works... ldapsearch - Z debug: ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP blah:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying blah:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success tls_write: want=137, written=137 ldapsearch - ZZ debug shows the certificate has expired thus is not trusted. I have "ldap_tls_reqcert = never" set in sssd.conf as a temporary measure, while /etc/openldap/ldap.conf has "tls_reqcert allow." Shouldn't that allow TLS to work without verifying PKI chain? This LDAP server is over 9000 years old. We're in the process of replacing it, as well as switching from pam_ldap to sssd, so for now I would like to get this working even if we're undermining the purpose of PKI. Thanks for your help! Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690 On Fri, Aug 12, 2016 at 4:08 AM, Jakub Hrozek <jhrozek(a)redhat.com> wrote: > On Thu, Aug 11, 2016 at 05:17:14PM -0400, Douglas Duckworth wrote: > > Hello > > > > I am able to enumerate users but not groups using "getent group." > > > > I believe our old LDAP server uses standard rcf2307 schema: > > > > # blah, Group, blah.blah.blah.edu > > dn: cn=blah,ou=Group,dc=blah,dc=blah,dc=blah,dc=edu > > objectClass: posixGroup > > objectClass: top > > cn: blahgroup > > gidNumber: 1045 > > memberUid: blah > > > > I can login over ssh, use getent password, while id returns correct > > information: > > > > [root@nfs-server ~]# id LUZER > > uid=8877(LUZER) gid=1009 groups=1009 > > > > My SSSD configuration and debug logs are attached. > > > > I can resolve the LDAP server and perform searches against it though the > > logs to show repeated DNS issues. Though if DNS was a problem, and thus > > provider offline, then how could I login and enumerate users? > > These messages: > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] > (0x0020): ldap_install_tls failed: Connect error > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sss_ldap_init_state_destructor] > (0x0400): calling ldap_unbind_ext for ldap:[0x183db80] sd:[18] > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] > (0x0020): sdap_async_connect_call request failed: [5]: Input/output error. > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sdap_handle_release] > (0x2000): Trace: sh[0x1850770], connected[0], ops[(nil)], ldap[(nil)], > destructor_lock[0], release_memory[0] > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [_be_fo_set_port_status] > (0x8000): Setting status: PORT_NOT_WORKING. Called from: > src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1564 > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): > Marking port 636 of server 'blah.blah.blah.edu' as 'not working' > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0400): > Marking port 636 of duplicate server 'blah.blah.blah.edu' as 'not working' > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] > (0x0100): Trying to resolve service 'LDAP' > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [get_server_status] (0x1000): > Status of server 'blah.blah.blah.edu' is 'name resolved' > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): > Port status of port 636 for server 'blah.blah.blah.edu' is 'not working' > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] > (0x0020): No available servers for service 'LDAP' > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [be_resolve_server_done] > (0x1000): Server resolution failed: 5 > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] > (0x0020): Failed to connect, going offline (5 [Input/output error]) > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [be_mark_offline] (0x2000): > Going offline! > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [be_mark_offline] (0x2000): > Initialize check_if_online_ptask. > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [be_ptask_create] (0x0400): > Periodic task [Check if online (periodic)] was created > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [be_ptask_schedule] (0x0400): > Task [Check if online (periodic)]: scheduling task 81 seconds from now > [1470949681] > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [be_run_offline_cb] (0x0080): > Going offline. Running callbacks. > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] > (0x4000): notify offline to op #1 > (Thu Aug 11 17:06:40 2016) [sssd[be[LDAP]]] [sdap_dom_enum_ex_connected] > (0x0400): Backend is marked offline, retry later! > > make it look like the certificate is not correct, sssd tries to connect to > the server and fails. > > Does searching the server with ldapsearch using -ZZ succeed? > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists. > fedorahosted.org_admin_lists_sssd-2Dusers-40lists. > fedorahosted.org&d=DQIGaQ&c=lb62iw4YL4RFalcE2hQUQealT9- > RXrryqt9KZX2qu2s&r=2Fzhh_78OGspKQpl_e-CbhH6xUjnRkaqPFUS2wTJ2cw&m= > JsOPoBFWPBpJyy-yyj1h3uae8Lv75j8uDzdmH0lNtmI&s=ZGFp6o41jb-6yZ_8HbXk- > oB3WympSLRZQDUcu0GA-CI&e= >

2 2

Group Enumeration Issue
by Douglas Duckworth 12 Aug '16

12 Aug '16

Hello I am able to enumerate users but not groups using "getent group." I believe our old LDAP server uses standard rcf2307 schema: # blah, Group, blah.blah.blah.edu dn: cn=blah,ou=Group,dc=blah,dc=blah,dc=blah,dc=edu objectClass: posixGroup objectClass: top cn: blahgroup gidNumber: 1045 memberUid: blah I can login over ssh, use getent password, while id returns correct information: [root@nfs-server ~]# id LUZER uid=8877(LUZER) gid=1009 groups=1009 My SSSD configuration and debug logs are attached. I can resolve the LDAP server and perform searches against it though the logs to show repeated DNS issues. Though if DNS was a problem, and thus provider offline, then how could I login and enumerate users? Any help is greatly appreciated and may engender free booze if you're in New York. Thanks! Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-5454 F: 212-746-8690

2 1

Trying to use sssd to connect to large AD service - secondary groups not loading
by Robert Sturrock 10 Aug '16

10 Aug '16

Hi All. I'm struggling a bit trying to get sssd (client is RHEL7.2, so using sssd-1.13.0-40.el7_2.1.x86_64) to connect to a large institutional AD (100k+ users, each user belonging to dozens or even hundreds of groups). I'm following the instructions here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… The config file (redacted slightly) is at the bottom. Most of the time, when I first login to the client system, using credentials from AD, the only group I see is 'domain users'. It's quite slow to login (a couple of minutes). When I interrogate the cache, the user I'm logging in as shows up against many of the groups as 'ghost: username' (I don't know what this means), as well as 'original_member:'. When I run a simple 'groups username' against other users in the domain, I mostly get just 'domain users', but sometimes (infrequently) it will a list the right set of groups. Can anyone provide some pointers on what I should be looking at to get the groups showing up reliably? Thanks, Robert. [sssd] config_file_version = 2 domains = ad.example.com services = nss, pam, pac debug_level = 7 [domain/ad.example.com] id_provider = ad auth_provider = ad chpass_provider = ad access_provider = simple simple_allow_users = crs, [...others...] cache_credentials = true debug_level = 7 [nss] debug_level = 9 [pam] [pac] debug_level = 10

2 1

Cross domain trust and SSO/NFS ?
by Joakim Tjernlund 05 Aug '16

05 Aug '16

We are migrating to a new domain AD domain and I got cross domain trust problems(there is a bidirectional cross trust between the two ADs, how can I test this works from Linux?). All users in domain A has been copied to domain B(using the same UID/GID as in domain A). I have managed to configure sssd for both domains(lets call the old domain A and the new B), joined to both domains and I can login using any of the 2 domains. But here is the problem: If I use the new domain(B) as default login domain, I cannot ssh to another system still in domain A password less(without entering my password again) or access files on NFS mounted files exported from domain A. I know very little about cross trust etc. so I want to ask: 1) Is this even possible? 2) I have no idea where to start looking for what went wrong, need som pointers. We are using sssd 1.13.4 on the new domain B machines while servers in domain A uses an older sssd(1.12.5) Jocke

4 13

dyndns updates in sssd-13.4
by Longina Przybyszewska 04 Aug '16

04 Aug '16

Hi , After upgrade to sssd-13.4, dyndns updates don't work in AD cross realm environment Our DNS server is : -not on the identity server (exactly, not on the default DC for the domain) -DNS server and reverse DNS server are different machines It worked in previous release (also, DNS updates only) Now, for fixing this I need to use the option 'dyndns_server' for explicitly point to the server. It is not possible for dyndns_ptr updates, since sssd obviously assumes that there is one DNS for both A and PTR records. Do you plan 'dyndns_ptr_server' option as well in future realeseS? Best, Longina

2 5

SSSD SUDO Groups
by Jagannath Naidu 03 Aug '16

03 Aug '16

HI List, I am able to do the following Environment: windows 2012 AD CentOS 6 1. Authenticate users based on group 2. users are able to sudo My Question: Suppose I want to create multiple sudo groups, say two sudo groups. 1. one group has has access to use commands fdisk,chmod 2. Another group has access use su command Is it possible to differentiate users to restrict sudo access ? Please help me here to resolve this issue. Regards Jagannath Naidu

2 3

Re: nfsidmap with 'sss'method[SOLVED]
by Longina Przybyszewska 03 Aug '16

03 Aug '16

Hi again, I tracked down the problem probably to the NFS server's idmapd.conf configuration - which was not identical on both machines: Nfs-server (sssd-12.5) used Method = nsswitch, while Nfs-client Method = sss; Nfs-server is configured differently than nfs-client, it has all domains listed explicitly in sssd.conf; Nfs-client (sssd-13.4) has only one domain (join domain) listed. This configuration worked up to sssd-13.3 (on client side) Best Longina > -----Original Message----- > From: Jakub Hrozek [mailto:jhrozek@redhat.com] > Sent: 28. juli 2016 09:52 > To: sssd-users(a)lists.fedorahosted.org > Subject: [SSSD-users] Re: nfsidmap with 'sss'method > > On Wed, Jul 27, 2016 at 01:46:31PM +0000, Longina Przybyszewska wrote: > > Hi, > > I upgraded to sssd-13.4 (kernel 4.4.0-31-generic #50-Ubuntu) -. > > > > After upgrade I have problems with nfs4+Kerberos idmaping, using krb > localauth snippet and choosing 'sss' method in /etc/idmap.conf; > > I get (igen!) famous nobody mapping for cross realm users; Mapping of > > groups is correct, as groups are in the same domain as computers. > > > > I can mount with sec=krb5, get access to my nfs-mounted home directory, > get r/w permissions, but listing a file shows wrong owner: > > > > ausr@nat.domain@adm-lnx438:~$ ls -ld . > > drwxr-xr-x 3 4294967294 lnx-primary(a)adm.domain 28 Aug 18 2015 SSSD- > GIT > > > > ausr(a)nat.domain --> 4294967294 > > group(a)adm.domain --> group > > > > In logfile: > > Jul 27 14:23:55 adm-lnx438 nfsidmap[22500]: key: 0x26626a54 type: uid > > value: ausr@nat.domain@adm.domain timeout 600 Jul 27 14:23:55 > > adm-lnx438 nfsidmap[22500]: nfs4_name_to_uid: calling > > sss_nfs->name_to_uid Jul 27 14:23:55 adm-lnx438 nfsidmap[22500]: user > > ausr@nat.domain@adm.domain not in memcache Jul 27 14:23:56 adm- > lnx438 > > nfsidmap[22500]: sss_nfs_name_to_uid: rc=2 msg=No such file or > > directory > > It looks like the sss_nfs_* functions are at least called, is there anything in > the logs around that time? > > > Jul 27 14:23:56 adm-lnx438 nfsidmap[22500]: nfs4_name_to_uid: > > sss_nfs->name_to_uid returned -2 Jul 27 14:23:56 adm-lnx438 > > nfsidmap[22500]: nfs4_name_to_uid: final return value is -2 Jul 27 > > 14:23:56 adm-lnx438 nfsidmap[22500]: nfs4_name_to_uid: calling > > sss_nfs->name_to_uid Jul 27 14:23:56 adm-lnx438 nfsidmap[22500]: user > > nobody(a)adm.domain not in memcache Jul 27 14:23:56 adm-lnx438 > > nfsidmap[22500]: sss_nfs_name_to_uid: rc=2 msg=No such file or > > directory Jul 27 14:23:56 adm-lnx438 nfsidmap[22500]: > > nfs4_name_to_uid: sss_nfs->name_to_uid returned -2 Jul 27 14:23:56 > > adm-lnx438 nfsidmap[22500]: nfs4_name_to_uid: final return value is -2 > > Jul 27 14:23:56 adm-lnx438 nfsidmap[22504]: key: 0x276b113b type: gid > > value: lnx-primary(a)adm.domain timeout 600 Jul 27 14:23:56 adm-lnx438 > > nfsidmap[22504]: nfs4_name_to_gid: calling sss_nfs->name_to_gid Jul 27 > > 14:23:56 adm-lnx438 nfsidmap[22504]: found group > > lnx-primary(a)adm.domain in memcache Jul 27 14:23:56 adm-lnx438 > > nfsidmap[22504]: sss_nfs_name_to_gid: rc=0 msg=Success Jul 27 14:23:56 > > adm-lnx438 nfsidmap[22504]: nfs4_name_to_gid: sss_nfs->name_to_gid > > returned 0 Jul 27 14:23:56 adm-lnx438 nfsidmap[22504]: > > nfs4_name_to_gid: final return value is 0 > > > > ---- > > getent passwd ausr(a)nat.domain > > ausr@nat.domain:*:10002:30000000:Ausr :/home/ausr:/bin/bash > > > > id ausr(a)nat.domain > > uid=10002(ausr(a)nat.domain) gid=30000000(lnx-primary(a)adm.domain) > > groups=30000000(lnx- > primary(a)adm.domain),4(adm),24(cdrom),27(sudo),46(p > > lugdev),113(lpadmin),131(lxd),),9002(lnx-xxx-nfs4users2(a)c.xxx.dk),6666 > > (nfs4users2(a)nat.domain),30000006(data-adm-lnx-nfs0a-qbl-admin-id- > 00001 > > @adm.domain),9999(usr-xxx- > glu@c.xxx.dk),8888(nfs4users@nat.domain),300 > > 00002(lnx-ladm-clients(a)adm.domain) > > > > Any ideas what could happen? > > > > Best > > Longina > > > > > _______________________________________________ > > sssd-users mailing list > > sssd-users(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahost > > ed.org > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/admin/lists/sssd- > users(a)lists.fedorahosted.org

2 1

NFSserver sss_nfs_princ_to_ids: not implemented
by Longina Przybyszewska 03 Aug '16

03 Aug '16

Hi, I am testing the new NFS-server with Kerberos ,and interaction with Nfs-client, all based on Ubuntu-16.04 and sssd-13.4. I have got a systematic "Permission denied" for owner accessing home directory , mounted on Nfs-client, with right permissions and right nfsidmapping. In the syslog on the Nfs-server I found following messages - coming when resolving machine's principal name , and the file owner's principal name : rpc.svcgssd[3126]: nfs4_gss_princ_to_ids: calling sss_nfs->princ_to_ids rpc.svcgssd[3126]: sss_nfs_princ_to_ids: not implemented The strange thing is, that during login process I can mount homedir with right permissions and the right nfs name mapping ! kernel version for both , NFs-server/client is 4.4.0-31-generic #50 -Ubuntu; The same Nfs-client mounts home directory from the old server (NFS+Kerberos, sssd-12.5) without problems. Any idea? Mange hilsner Longina

1 0

sssd System error
by Schiller Frank 03 Aug '16

03 Aug '16

Hi, I'm trying to authenticate with active-directory users (Windows Server 2008 R2) on my Ubuntu 16.04 workstation. I used the steps in "SSSD and Active Directory" from the Ubuntu documentation. Adding the computer-account to active-directory worked. Running id <active-directory-user> also returns the correct active-directory-groups the user is in. But I can't login with active-directory-user. content of /var/log/auth.log: pam_sss(login:auth): authentication success; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=<active-directory-user> pam_sss(login:account): Access denied for user<active-directory-user>: 4 (System error) output of "service sssd status": sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: active (running) since Mo 2016-07-25 12:47:37 CEST; 35min ago Process: 1913 ExecStart=/usr/sbin/sssd -D -f (code=exited, status=0/SUCCESS) Main PID: 2088 (sssd) CGroup: /system.slice/sssd.service ├─2088 /usr/sbin/sssd -D -f ├─2092 /usr/lib/x86_64-linux-gnu/sssd/sssd_be --domain DOMAIN.LOCAL --uid 0 --gid 0 --debug-to-files ├─2131 /usr/lib/x86_64-linux-gnu/sssd/sssd_nss --uid 0 --gid 0 --debug-to-files └─2132 /usr/lib/x86_64-linux-gnu/sssd/sssd_pam --uid 0 --gid 0 --debug-to-files Jul 25 12:49:21 ubuntu16 sssd_be[2092]: GSSAPI client step 1 Thank you very much for any help. Best Regards Frank

4 11

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users August 2016