January 2019 - sssd-users - Fedora mailing-lists

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

ID Views for IPA ID Views for AD users inconsistent resolution
by Louis Abel 01 Aug '21

01 Aug '21

I didn't get a response in #sssd, so I figured I'll try here at the mail list. # rpm -q sssd ipa-server sssd-1.16.0-19.el7_5.5.x86_64 ipa-server-4.5.4-10.el7_5.3.x86_64 I've been scratching my head trying to resolve this particular issue. I'm having issues with AD users where when they login, they'll get the UID/GID assigned in the ID views correctly, but only some of the time. Other times, they won't get the id view assigned to them. This is all done in the default trust view. What makes this issue even more interesting is that out of my 6 domain controllers, sometimes it'll be one server out of the six that does it, sometimes it's two. But it's never the same ones, so it's difficult to track the particular issue down. What's even more interesting is this is not occurring with some users (like my own). I have yet to see it occur with my account or even the rest of my team's accounts. One of the things I tried to do is delete the ID views of the offending users and recreate them to no avail. I put SSSD into debug mode on the IPA servers and tried to get some relevant logs and such to try and figure this out. Below is my SSSD configuration, ldb info, and debug logs (removing private information where possible). I'm trying to determine if this is either a bug within SSSD or if this is a misconfiguration on my part. $ ldbsearch -H cache_ipa.example.com.ldb name=user.name(a)ad.example.com originalADuidNumber uidNumber originalADgidNumber gidNumber asq: Unable to register control with rootdse! # record 1 dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb originalADuidNumber: 55616902 originalADgidNumber: 55616902 uidNumber: 55616902 gidNumber: 55616902 $ ipa idoverrideuser-show "Default Trust View" user.name(a)ad.example.com Anchor to override: user.name(a)ad.example.com UID: 40001 GID: 40001 Home directory: /home/user.name Login shell: /bin/bash $ ldbsearch -H timestamps_ipa.example.com.ldb | less dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb objectCategory: user originalModifyTimestamp: 20180823172515.0Z entryUSN: 92632390 initgrExpireTimestamp: 1535133621 lastUpdate: 1535128235 dataExpireTimestamp: 1535133635 distinguishedName: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb ## DEBUG LOGS (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 32 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 32 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1080], connected[1], ops[(nil)], ldap[0x55f30a5d0f90] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [ipaanchoruuid=:SID:S-1-5-21-922099545-2851689246-2917073205-16902,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaAnchorUUID] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaOriginalUid] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 32 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): Found override for object with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [uidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x0080): Override attribute for [gidNumber] has more [2] than one value, using only the first. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [gidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [homeDirectory] with [/home/user.name] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [loginShell] with [/bin/bash] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a6819a0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a681a60 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a681a60 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [safe_original_attributes] (0x4000): Original object does not have [sshPublicKey] set. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a683c50 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a683d10 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a683d10 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [uidNumber] of entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d1c0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a68d280 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a68d280 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [cache, ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d330 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a688900 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a689320 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6893e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a688900 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a634920 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6349e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6893e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6349e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 0/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Fetching group S-1-5-21-922099545-2851689246-2917073205-20676 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 33 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 33 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 33 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 1/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_memberships_send] (0x0400): External group information still valid. ## /etc/sssd/sssd.conf [domain/ipa.example.com] cache_credentials = True krb5_store_password_if_offline = True # krb5_realm = IPA.EXAMPLE.COM ipa_domain = ipa.example.com ipa_hostname = entl01.ipa.example.com # Server Specific Settings ipa_server = entl01.ipa.example.com ipa_server_mode = True subdomain_homedir = %o fallback_homedir = /home/%u default_shell = /bin/bash id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, sudo, pam, ssh domains = ipa.example.com [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,activemq,informix,oracle,xdba,grid,dbadmin,weblogic,operator,postgres,devolog memcache_timeout = 600 homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp]

2 1

Enumerate users from external group from AD trust
by Bolke de Bruin 29 Nov '19

29 Nov '19

Hello, I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain. One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using “getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not: [root@master centos]# getent group ad_users ad_users:*:1950000004: [root@master centos]# id bolke(a)ad.local UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test@ad.local) [root@master centos]# getent group ad_users ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local> If I clear the cache (sss_cache -E) the entry is gone again: [root@master centos]# getent group ad_users ad_users:*:1950000004: My question is how do I get sssd to enumerate *all users* in a group consistently? Thanks! Bolke * https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-gro…

3 15

SSSD strangeness
by simonc99＠hotmail.com 05 Nov '19

05 Nov '19

Hi All We've got SSSD 1.13.0 installed as part of a Centos 7.2.1511 installation. We've used realmd to join the host concerned to our 2008R2 AD system. This went really well, and consequently we've been using SSSD to provide login services and kerberos integration for our fairly large hadoop system. The authconfig that's implicitly run as part of realmd produces the following sssd.conf: [sssd] domains = <joined domain> config_file_version = 2 services = nss, pam [pam] debug_level = 0x0080 [nss] timeout = 20 force_timeout = 600 debug_level = 0x0080 [domain/<joined domain>] ad_domain = <joined domain> krb5_realm = <JOINED DOMAIN> realmd_tags = manages-system joined-with-samba cache_credentials = true id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u@%d access_provider = simple simple_allow_groups = <AD group allowing logins> krb5_use_kdc_info = False entry_cache_timeout = 300 debug_level = 0x0080 ad_server = <active directory server> As I've said - this works really well. We did have some stability issues initially, but they've been fixed by defining the 'ad_server' rather than using autodiscovery. Logins work fine, kerberos TGTs are issued on login, and password changes are honoured correctly. However, in general day to day use, we have noticed a few anomalies, that we just can't track down. Firstly (this has happened a few times), a user will change their AD password (via a Windows PC). Subsequent logins - sometimes with specific client software - fail with pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=<remote PC name> user=<username> pam_sss(sshd:auth): received for user <username>: 17 (failure setting user credentials) So in this example, the person concerned has changed their AD password. Further attempts to access this system via SSH work fine. However, using SFTP doesn't work (the above is output into /var/log/secure). There are no local controls on sftp logins, and the user concerned was working fine (using both sftp and ssh) until they updated their password. There is no separate sftp daemon running, and it only affects one individual currently (but we have seen some very similar instances before) The second issue we have is around phantom groups in AD. Hadoop uses an id -Gn command to see group membership for authorisation. With some users - we've seen 6 currently - we see certain groups failing to be looked up: id -Gn <username> id: cannot find name for group ID xxxxyyyyy <group name> <group name> <group name> <group name> <etc...> The xxxxyyyyy indicates: xxxx = hashed realm name yyyyy = RID from group in AD We can't find any group with that number on the AD side! We can work around this by adding a local group (into /etc/group) for the GIDs affected. This means the id -Gn runs correctly, and the hadoop namenode can function correctly - but this is a workaround and we'd like to get to the bottom of the issue. Rather than flooding this post now with logfiles, just thought I'd see if this looked familiar to anyone. Happy to upload any logs, amend logging levels, etc. Many thanks Simon

4 7

sssd[be[1320]: Backend is offline
by Harald Dunkel 10 May '19

10 May '19

Hi folks, sssd 1.16.3-1 (rebuilt for Debian 9), systemd At boot time sssd_nss fails to initialize. systemctl status sssd shows root@srvl061:~# systemctl status sssd * sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: active (running) since Thu 2018-11-22 11:57:30 CET; 46s ago Main PID: 1312 (sssd) Tasks: 5 (limit: 7372) CGroup: /system.slice/sssd.service |-1312 /usr/sbin/sssd -i --logger=files |-1345 /usr/lib/x86_64-linux-gnu/sssd/sssd_be --domain example.com --uid 0 --gid 0 --logger=files |-1533 /usr/lib/x86_64-linux-gnu/sssd/sssd_nss --uid 0 --gid 0 --logger=files |-1534 /usr/lib/x86_64-linux-gnu/sssd/sssd_pam --uid 0 --gid 0 --logger=files `-1535 /usr/lib/x86_64-linux-gnu/sssd/sssd_pac --uid 0 --gid 0 --logger=files Nov 22 11:57:25 srvl061.ac.example.com systemd[1]: Starting System Security Services Daemon... Nov 22 11:57:25 srvl061.ac.example.com sssd[1312]: Starting up Nov 22 11:57:25 srvl061.ac.example.com sssd[be[1345]: Starting up Nov 22 11:57:30 srvl061.ac.example.com sssd[1533]: Starting up Nov 22 11:57:30 srvl061.ac.example.com sssd[1534]: Starting up Nov 22 11:57:30 srvl061.ac.example.com sssd[1535]: Starting up Nov 22 11:57:30 srvl061.ac.example.com systemd[1]: Started System Security Services Daemon. Nov 22 11:57:45 srvl061.ac.example.com sssd[be[1345]: Backend is offline Apparently this is a problem of resolvconf generating /etc/\ resolv.conf at boot time. If I replace it by a static file, then the problem is gone. Question is, how can I tell systemd to wait for resolv.conf? Is there some timeout in the backend I could adjust? Does it wait for the network at all? Every helpful comment is highly appreciated Regards Harri

5 7

How to keep the password in sync with AD?
by Ian Puleston 28 Feb '19

28 Feb '19

Hi, I have a laptop running F28 and which is set up with "Enterprise Login" to authenticate against my company's Active Directory domain network using realmd & SSSD. When we set this up a few months back and joined the laptop to the Windows domain it worked great, letting me log in with my AD user name (name(a)x.y.com) and password. It still works great generally, except that my AD password expired and I changed it, but I can't get the laptop to update to the new password. It just goes on requiring me to enter the old AD account password that it has cached. That is fine when I'm offline and away from work, but when I'm in the office and plugged into the corporate network then I'd expect it to update itself with the new password from the domain server, which just isn't happening. Is there some way to force SSSD to re-sync its cached password with the domain server? Some more detail: After logging out and then back in while connected to the corporate AD domain (and using the old cached password) I checked the logs in /var/log/sssd: sssd_<domain>.log: (Thu Jan 24 17:43:30 2019) [sssd[be[sv.us.sonicwall.com]]] [id_callback] (0x0010): The Monitor returned an error [org.freedesktop.DBus.Error.NoReply] sssd_nss.log has a bunch of these: (Thu Jan 24 17:38:04 2019) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] (Thu Jan 24 17:44:27 2019) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] and sssd_pam.log a bunch of the same: (Thu Jan 24 17:38:07 2019) [sssd[pam]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] (Thu Jan 24 17:44:27 2019) [sssd[pam]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] And also, while using sudo to view those I got this error a couple of times: sudo: PAM account management error: Authentication service cannot retrieve authentication info But I've verified that I can ping the sv.us.sonicwall.com domain server from the laptop after logging in, so network connectivity is not the issue. With more detailed logging enabled, I can see that it successfully pulls a list of 12 domain controllers from the LDAP server, then tries to kinit with each in turn. A couple don't respond, but those that do all fail as follows: (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [sdap_kinit_send] (0x0400): Attempting kinit (default, IAN-LAPTOP$, SV.US.SONICWALL.COM, 86400) (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [be_resolve_server_process] (0x0200): Found address for server stc4svdc01.sv.us.sonicwall.com: [10.50.129.149] TTL 3600 (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [create_tgt_req_send_buffer] (0x0400): buffer size: 54 (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for TGT child ... (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [sdap_get_tgt_recv] (0x0400): Child responded: 14 [Preauthentication failed], expired on [0] (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [sdap_kinit_done] (0x0100): Could not get TGT: 14 [Bad address] (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [sdap_cli_kinit_done] (0x0400): Cannot get a TGT: ret [1432158226](Authentication Failed) (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [13]: Permission denied (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'stc4svdc01.sv.us.sonicwall.com' as 'not working' (Thu Jan 24 18:51:27 2019) [sssd[be[sv.us.sonicwall.com]]] [fo_set_port_status] (0x0400): Marking port 389 of duplicate server 'stc4svdc01.sv.us.sonicwall.com' as 'not working' I don't really know this stuff, but that looks like the Kerberos ticket has expired? What I've read says that renewing an expired ticket should happen automatically when I use the password, but that doesn't seem to be happening. Ideas?

3 7

AD multiple domains - login failed for child domain
by Jeremy Monnet 08 Feb '19

08 Feb '19

Hello, I never fixed issues I had last year https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… but I did made a new test on a brand new ubuntu up to date, and the result is far better, though everything is not working. As a reminder, I have an AD with a parent and a child domain, let's say example.com and child.example.com. For the new server I set up, I used system provided utilities realm join example.com -U 'user(a)EXAMPLE.COM' which pretty much generates root@ubuntu:/var/log/sssd# cat /etc/sssd/sssd.conf [sssd] domains = example.com config_file_version = 2 services = nss, pam [domain/example.com] ad_domain = example.com krb5_realm = EXAMPLE.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = False fallback_homedir = /home/%u@%d debug_level=9 access_provider = ad Now, everything is OK with the main domain, AFAIK, I can login, sudo based on groups, etc. But for the child domain, most work, I can id a user@child (that resolves the user and the groups associated), I can "su - user@child" from root, BUT I can not login with that user@child. Sanitized logs follow : sssd_example.com.log (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'AD' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server '<ad>' is 'working' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_port_status] (0x1000): Port status of port 389 for server '<ad>' is 'working' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6 seconds (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [get_server_status] (0x1000): Status of server '<ad>' is 'working' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [be_resolve_server_process] (0x1000): Saving the first resolved server (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [be_resolve_server_process] (0x0200): Found address for server <ad>: [IP] TTL 3600 (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [ad_resolve_callback] (0x0100): Constructed uri 'ldap://<ad>' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [ad_resolve_callback] (0x0100): Constructed GC uri 'ldap://<ad>' (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_ivIwhy] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/pubconf/.krb5info_dummy_ivIwhy] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [sss_domain_get_state] (0x1000): Domain child.example.com is Active (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [30303] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [30303] (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Thu Jan 31 16:05:24 2019) [sssd[be[example.com]]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information krb5_child.log (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393070: Sending TCP request to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393071: Received answer (317 bytes) from stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393072: Terminating TCP connection to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393073: Response was from master KDC (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393074: Decoding FAST response (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393075: TGS request result: -1765328377/Server not found in Kerberos database (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393076: Requesting tickets for RestrictedKrbHost/ubuntu(a)EXAMPLE.COM, referrals off (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393077: Generated subkey for TGS request: rc4-hmac/1624 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393078: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393080: Encoding request body and padata into FAST request (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393081: Sending request (1719 bytes) to EXAMPLE.COM (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393082: Initiating TCP connection to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393083: Sending TCP request to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393084: Received answer (317 bytes) from stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393085: Terminating TCP connection to stream <IP>:88 (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393086: Response was from master KDC (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393087: Decoding FAST response (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393088: TGS request result: -1765328377/Server not found in Kerberos database (Thu Jan 31 16:05:24 2019) [[sssd[krb5_child[30303]]]] [sss_child_krb5_trace_cb] (0x4000): [30303] 1548947124.393089: Destroying ccache MEMORY:xwkvpg9 Do you have any idea why the server is not found in the child domain ? Could that be because the wrong server principal may be used ? Thanks for your help ! Jeremy

3 5

SSSD for keycloak intergration
by sheetalmane4 29 Jan '19

29 Jan '19

Hi, Is there an any possibility to use keycloak as a user management and SSSD for linux user authentication ? something similar to sssd_ad, sssd_ldap Thanks and regards, Sheetal

2 1

Understanding sssd cache
by Maupertuis Philippe 28 Jan '19

28 Jan '19

Hi I am trying to find out how th sssd cache is being populated. I couldn't find much about it so I did some tests. It seems that with enumerate = true, the cache holds all the information needed as soon as sssd is started. With enumerate = false, the cache holds information about someone only after his first connection. Is that right ? I would like to be sure that user's passwords are stored in the cache but couldn't find any way to verify this With sssctl user-show I can find if a user is in the cache but with no details. With sssctl user-checks I get some information about the user but nothing about the password. By examining directly the cache with ldbsearch I don't find any password information either, only maybe shadowLastChange: with a number which I don't understand. Is there any documentation about the cache management ? Regards Philippe !!!************************************************************************************* "Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"

5 9

id mapping
by vadud3＠gmail.com 25 Jan '19

25 Jan '19

Looking for suggestion on ID mapping. I need to point to a ID provider over proxy I have not found a concrete solution or some hint about how to setup a proxy to a ID provider and how sssd can point to that proxy for ID mapping. All my servers are CentOS 7. -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

3 12

Simplify ldap `memberOf` searches
by Sean Roberts 18 Jan '19

18 Jan '19

SSSD experts - Is it possible to simplify ldap searches like the one below to specify the group name without it's full path: ``` ldap_user_search_base="DC=example,DC=internal?subtree?(|(memberOf=CN=project-users,OU=2,OU=1,DC=example,DC=internal)(memberOf=CN=project-admins,OU=2,OU=1,DC=example,DC=internal)) ``` Doing so would simplify configurations and prevent issues when objects are moved within the directory: *p.s. for access_provider, the following has worked to simplify part of our config. Likely means less load on LDAP. I'm assuming it's safe.* ```` id_provider=ldap access_provider=simple simple_allow_groups=group1, group2 ``` -- Sean Roberts

2 3

Re: Intermittent SSH authentication failures: SSSD+AD+PAM+Duo
by Jordan Castillo 18 Jan '19

18 Jan '19

Here are my log files for both the good and bad attempts.

2 6

Sssd and gidNumber
by Dmitrij S. Kryzhevich 17 Jan '19

17 Jan '19

I have setup with 3 clients and server. Server runs samba as AD and ldap + kerberos. Clients use sss: 1) fedora with 2.0.0, 2) centos with 1.16.0 and 3) centos with 1.16.2. All clients use 1:1 sssd.conf. I want sss to use primary group id from gidNumber record in ldap and I have no issues with first and second clients. But not third. I don't understand why but primary gid is set equal to uid. Can't see anything relevant in logs. Where to dig? sssd.conf: [domain/default] id_provider = ldap ldap_uri = ldap://pdc.lkkm/ ldap_id_use_start_tls = True ldap_tls_cacertdir = /etc/openldap/cacerts ldap_search_base = dc=pdc,dc=lkkm ldap_default_bind_dn = <DN> ldap_default_authtok_type = password ldap_default_authtok = <password> ldap_user_search_base = cn=Users,dc=pdc,dc=lkkm ldap_user_home_directory = unixHomeDirectory ldap_user_object_class = person ldap_group_search_base = dc=PosixGroups,dc=pdc,dc=lkkm ldap_group_object_class = group auth_provider = krb5 chpass_provider = krb5 krb5_server = pdc.lkkm krb5_kpasswd = pdc.lkkm krb5_realm = PDC.LKKM krb5_store_password_if_offline = False krb5_ccname_template = KEYRING:persistent:%{uid} krb5_auth_timeout = 15

2 2

SSSD with Kerberos for SPENGO ( Nginx + pam + sss + sss_krb )
by Eugen Mayer 17 Jan '19

17 Jan '19

Hello, i am really struggling to understand if what i am trying to do is actually something that is supported by SSD in that terms. I have a lab setup with a Windows Server 2012 with a konfigured KDC, DNS, NTP .. keytab, spn. This setup already works for apache+mod_kerb_auth for both cases, auto-negotiation of existing tickets. So i can do kinit + curl --negotiate on a client and get pass the authentication. Now i am trying to replace apache with nginx with this case. I want to use nginx_pam, and then forward this to sssd using pam_sss. My id_provider is ad, auth_provider is krb5, realm is KWTEST.LOCAL I see that the AD access works using GSSAPI authentication using the provided keytab file, but when a client request though nginx is handled, i see something that sssd is trying to lookup www-data(a)KWTEST.LOCAL out of any reason. I would have expected that it uses the HOST requested by the client, like HTTP/mywebservice.lan(a)KWTEST.LOCAL - in mod_auth_kerb one can set the SPN to use, i am not sure how this is intended in sssd and that is my actual question. - Can SSSD offer "negotiation" through pam ... nginx at all? (reusing active client krb tokens) - What SPN is used when pam calls SSSD? I hope i could explain this at least a little ;/ Thank you Eugen

2 3

Intermittent SSH authentication failures: SSSD+AD+PAM+Duo
by Jordan Thomas 16 Jan '19

16 Jan '19

Hello, I am facing a very confounding issue with my SSSD/AD integration on CentOS 7. I am configured to use SSSD and Active Directory to authenticate SSH logins. Users use an SSH key stored in an Active Directory attribute to log in, followed by a Duo 2FA prompt. SSH is configured to check the key, then provide the Duo prompt via PAM. About 80% of the time this works correctly. The other 20% of the time, users see a long hang (approx 1-2 minutes) after the Duo prompt, followed by a generic "Authentication failure" error. This with login attempts from the same user, on the same host, logging in to the same server, authenticating against the same AD DC. I am having a hard time discovering the underlying issue causing this problem. From my sshd logs, the best error I seem to have found is this: Jan 16 11:33:49 cerberusvm sshd[4201]: debug3: PAM: do_pam_account pam_acct_mgmt = 9 (Authentication service cannot retrieve authentication info) Jan 16 11:33:49 cerberusvm sshd[4201]: debug3: ssh_msg_send: type 13 Jan 16 11:33:49 cerberusvm sshd[4197]: debug3: PAM: User account has expired Here is my relevant sshd_config: PasswordAuthentication no PubkeyAuthentication yes # Change to no to disable s/key passwords ChallengeResponseAuthentication yes AuthenticationMethods publickey,keyboard-interactive AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys AuthorizedKeysCommandUser root UseDNS no UsePAM yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no #KerberosUseKuserok yes # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials no Here is my current sssd.conf file (I have been frequently experimenting with config changes here. Logins work, but the occasional failure occurs for reasons I cannot determine): [sssd] domains = mydomain.com config_file_version = 2 services = nss, pam, ssh [ssh] debug_level = 3 [domain/mydomain.com] debug_level = 3 ad_domain = mydomain.com ad_server = prodad1.mydomain.com ad_hostname = cerberusvm.mydomain.com dyndns_update = false krb5_realm = MYDOMAIN.COM realmd_tags = manages-system joined-with-samba cache_credentials = False krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = False fallback_homedir = /home/%u access_provider = ad id_provider = ad auth_provider = ad ldap_user_ssh_public_key = sshPublicKeys Here is my pam.d/system-auth: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so Here is my pam.d/sshd: #%PAM-1.0 auth required pam_sepermit.so auth required pam_env.so auth sufficient pam_duo.so auth required pam_deny.so auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare From sssd's side, here is the error I tend to see that does not appear in a log from a working login: (Wed Jan 16 11:32:20 2019) [sssd[be[mydomain.com]]] [ad_check_gc_usability_search_done] (0x0080): Cannot get isMemberOfPartialAttributeSet(Wed Jan 16 11:32:20 2019) [sssd[be[mydomain.com]]] [ad_check_gc_usability_search_done] (0x0080): Cannot get isMemberOfPartialAttributeSet(Wed Jan 16 11:32:20 2019) [sssd[be[mydomain.com]]] [ad_disable_gc] (0x0040): POSIX attributes were requested but are not present on the server side. Global Catalog lookups will be disabled I have found this (https://bugzilla.redhat.com/show_bug.cgi?id=1583725) related patch to the above error, but we are running the errata that is supposed to be an upstream fix for it, so I am not sure if this is a new or different issue. I have sssd_ssh.log, sssd_mydomain.com.log, and sshd logs for both working and non-working login flows and will gladly attach them but do not see a way to do that when creating a thread. Here is my environment: SSH: OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017 SSD 1.16.2 PAM pam-1.1.8-22 duo_unix-1.11.1

1 0

Samba 4.8, Winbind and SSSD
by Carwyn Edwards 15 Jan '19

15 Jan '19

We've just been bitten by the Samba 4.8 rebase in CentOS/RHEL 7.6, specifically this bit from the RHEL 7.6 release notes: "The smbd service no longer queries user and group information from Active Directory domain controllers and NT4 primary domain controllers directly. Installations with the security parameter set to ads or domain now require that the winbindd service is running." Which stems from the Samba 4.8 release notes: "Domain member setups require winbindd - Setups with "security = domain" or "security = ads" require a running 'winbindd' now. The fallback that smbd directly contacts domain controllers is gone." The RHEL 7 Systems Administration Guide now states: "Red Hat only supports running Samba as a server with the winbindd service to provide domain users and groups to the local system. Due to certain limitations, such as missing Windows access control list (ACL) support and NT LAN Manager (NTLM) fallback, the System Security Services Daemon (SSSD) is not supported." Now in RHEL 7.5 we were managing to use SSSD with Samba, the only real glitch (we think) was that SIDs rather than names showing up in the share ACLs. Unfortunately Red Hat support are sticking to the above like glue so far. My question to this list is, given the changes to Samba from 4.8, is there a way to get RHEL 7.6 winbind (for Samba) to use SSSD for the lookups that works? I noticed that the package sssd-winbind-idmap that ships in RHEL 7.6 contains the library /usr/lib64/samba/idmap/sss.so which from the idmap_sss man page states: "The idmap_sss module provides a way to call SSSD to map UIDs/GIDs and SIDs." With a config example: [global] ... idmap config * : backend = sss (There an open bugzilla and pagure bug about this example being wrong as sss is read only). There's also the following file in the package sssd-client /usr/lib64/cifs-utils/cifs_idmap_sss.so Which is controlled via the alternatives system. I'm not entirely sure how these differ yet but I get the impression that the intention somewhere is to re-enable Samba to Winbind to SSSD lookups? Am I on the right track? Could this be made to work with the versions in RHEL 7.6 if so? The alternative we're facing is to reset ownership on many millions of files as a side effect of swapping from sssd to winbind and many open questions as to whether winbind will handle our active directory (University context, messy). We'd tuned SSSD to finally work well for us here. Carwyn

3 5

Sudo in a ldap
by Maupertuis Philippe 14 Jan '19

14 Jan '19

Hi, I am new on this mailing list so please forgive me if my question has already been answered. I did read the archive to try find something. My ssssd.conf retrieve the information from a 389ds ldap including sudo rules. Everything is working fine except for one point regarding sudo. For a given user only one entry is fetched from the ldap. Is it working as intended ? What I would like to achieve is basically something as simple as : User => root :some commands User => mysql : ALL This is easily done with a local sudoers, but I failed to have it working with sssd and the ldap. Any help would be greatly appreciated. Philippe !!!************************************************************************************* "Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"

2 2

sssd + AD (samba) id mapping in multi-OS environment
by Zdravko Zdravkov 11 Jan '19

11 Jan '19

I have working AD (Samba) for office with mostly Linux machines and few users on Windows 10. I'm using sssd to join the AD with the following configuration: [sssd] > domains = xxxxx > config_file_version = 2 > services = nss, pam > [domain/xxxxx] > ad_domain = xxxxxx > krb5_realm = XXXXXXX > realmd_tags = manages-system joined-with-samba > cache_credentials = True > id_provider = ad > krb5_store_password_if_offline = True > default_shell = /bin/bash > ldap_id_mapping = True > use_fully_qualified_names = False > fallback_homedir = /home/%u > access_provider = ad We have EMC storage, joined to the AD. Everyone is using it. On Windows it's being mapped via smb, and in Linux via nfs. I'll explain it as simple as I can. If I'm Linux user X and I create folder on the storage then list it to check ownership and permissions, it appears as it should - with owner X, and group domain users. Next, I log on Windows machine with the same user (X), browse the storage and create another folder. Then, on a Linux machine I list it, to check ownership. Now for owner I'm getting bizarre generated uID - "1000043", but the group remains as it should (domain users). Obviously this is a problem, as it messes up access to files/folders which need to be used between different operating systems. Next, from linux machine I check the uid for that particular user: *id X*, so I'm getting result "1115001239" which is OK. This is the uid as Linux understands it. If I copy that uid, then in AD users and computers management tool (in windows) I browse that particular user, and manually add the uid to the shown uidNumber attribute: [image: ad_attrs.PNG] Then clear SSSD cache with *sss_cache -E*. The next file/folder I create from Windows is now successfully shown with correct owner name in Linux. This is kind of a solution, but isn't perfect as it requires a bit of manual interaction. I'm wondering if it has anything to do with SSSD, or it is purely up to Samba? Is there a better way to achieve what I want. Cheers guys

2 1

AD: Get both POSIX and standard AD users
by Sean Roberts 11 Jan '19

11 Jan '19

I'm working on an AD where they've completely separate normal AD users and POSIX users. - AD: All employees have a user. - POSIX: Certain employees get a separate user which is used for POSIX use cases. *(Usernames are prefixed so they never collide). *Their groups are only POSIX groups. How can SSSD get both sets of users and their groups? Could we create a separate [domain/...] for each? Would overrides in [application/...] work? Currently SSSD is only getting the POSIX users and ldap_id_mapping=false is set. We can't really disable that without massive `chown`s across all the systems. -- Sean Roberts

2 3

sssd: AD service discovery and invalidating cache
by R Davies 08 Jan '19

08 Jan '19

(re-sending as I initially sent to ssd-users-owners in error) For an AD environment using service discovery. Periodically sssd will invalidate its cache at unexpected times. Digging around debug logs and sources leads me to understand the following: Every 15 minutes (or as defined by ldap_connection_expire_timeout) sssd re-establishes the connection to LDAP, closing the exiting collection. When sssd is configured to auto discover (via DNS _srv_ records, where the priority is the same for each server); auto-discovery might return a different LDAP server, at which point sssd's stored uSNChanged values are invalid (as these are unique to each server), the cached values are cleared, and enumeration is run - essentially afresh - against the new LDAP server. Is this outcome expected by design? This behaviour is rather unfortunate as sssd_be will become CPU hog as it rebuilds the cache again. It is possible to work around the behaviour e.g.: 1) by not using service discovery, i.e. ad_server = server1 ad_backup = server2 which is fairly tiresome to maintain across an estate - separate configurations for different sites etc, faking load balancing by swapping configurations. 2) having different priorities for each AD server in a given site, losing load balancing - unless DNS gave out different priorities depending on the source of the request, but this seems messy. A better approach might be to patch sssd's auto discovery to "stick" to the previously bound LDAP server, currently the first server in the list of primary servers returned by ad_sort_servers_by_dns(). I have a proof of concept patch that is straight forward, and fairly well contained, the behaviour is controlled by an ad_sticky option in sssd.conf. Is there a better solution to this problem? Would a patch - as vaguely outlined above - likely gain acceptance?

2 3

Latest sssd for rhel 6?
by Tom 08 Jan '19

08 Jan '19

Hey guys, checking the rhel portal, latest version of sssd I see is 1.13. Any chance to get 1.16 or higher for rhel 6? Cheers, Tom Sent from my iPhone

2 1

yubikey-based pkinit stopped working switching from sssd 1.15.2/Ubuntu 16.04 auf sssd 1.16.1/Ubuntu 18.04
by tallinn1960＠yahoo.de 07 Jan '19

07 Jan '19

My client has a working setup of sssd/kerberos/ldap utilizing yubikeys and pkinit as the login mechanism, based on sssd 1.15.2 and Ubuntu 16.04. My client wants to advance from Ubuntu 16.04 LTS to Ubuntu 18.04 LTS. A test installation of the latter with the corresponding sssd-version 1.16.1 does not allow yubikey-based login, although both kinit and p11_child do see the yubikey and the certificate on it. Kinit with yubikey does work. Analysis of log gives that krb5_child behavior has changed. The function answer_pkinit is called with kr->pd->cmd set to SSS_PAM_AUTHENTICATE and kr->pd->authtok set to SSS_AUTHTOK_TYPE_SC_PIN in 1.15.2, but with kr->pd->cmd set to SSS_PAM_PREAUTH and kr->pd->authtok set to 0 in 1.16.1, causing the function to skip all pkinit/smarcard-related prompting and processing. Both installations are using the same sssd.conf,krb5.conf etc. How shall we fix this?

2 5

sssd database backup / restore (or transplant to another client)
by Nikos Zaharioudakis 04 Jan '19

04 Jan '19

Good morning list, I have an idea, which I would like to experiment with, but experts advise may save me lots of time. The scenario I have in mind is like this: (assume OS and vers are latest RHEL/Centos) I join a client to an IPA server. After joining, in the /var/lib/sss/db/ directory, a database per domain is expected. (or perhaps populated after the first request to the IPA server for example id some-username) Now the question is: If I stop the sssd client service, may I copy the content of this directory to another client (which is already registered as well to the same IPA server) and save some time from the initial database population? You may say that this operation is not time-consuming etc, but in my case, I have to spin up some thousands of machines as fast as possible which are practically diskless. Meaning that the whole party has to happen as fast as possible and at the end, I have a ddos attack against my IPA servers and their replicas with a boom of (let's say) 3K clients asking more or less the same things (mostly ldap verification queries). So a first question to address my situation would be: Is the sssd db unique per client or may I "transplant" it to other clients as well? There is also a feature in the sssd.conf file to manipulate the order that the IPA clients will ask specific IPA servers with specific order which I could randomise (say round robin) but I would like to do it as a second experiment Thanks in advance for reading so far. Happy New Year Nikos ########################################3 Zaharioudakis Nikos, RHC{A,DS,E,VA,X,I}, VCP(4,5},VCI, Mentor VCI, Zimbra Instructor https://www.redhat.com/rhtapps/verify/?certId=100-001-262 Public Calendar : https://www.google.com/calendar/embed?src=nzahar%40gmail.com&ctz=Europe/Ath… +30 694 720 40 63 http://zimbra.wikidot.com/zimbra-installations-in-greece

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users January 2019