sssd-users December 2021

sssd-users@lists.fedorahosted.org

12 participants
14 discussions

Building sssd RPMs from source for RHEL8....
by Spike White 08 Dec '21

08 Dec '21

All, I have reviewed: https://github.com/SSSD/sssd https://sssd.io/ And most especially: https://sssd.io/contrib/building-sssd.html In an attempt to build RHEL8 sssd RPMs from github.com:SSSD/sssd.git. In the past, I have attempted to build RHEL8 RPMs on RHEL8. That is a fool's errand! I realize that now, because RHEL is not self-hosting. (I have loads of test RHEL & OL 7 & 8 servers available, no Fedora.) So I have to stand up a Fedora server to build the RHEL 8 RPMs. Currently, Fedora is at Fedora 35 and RHEL8 is based on Fed 28. Is that ok, or do I have to find Fed 28? I've reviewed the RHEL9 beta (which is based on Fed 35). Doesn't seem that different than RHEL8. Spike

2 2

How to kindly, gently expire bogus cached auto-discovered AD domains?
by Spike White 06 Dec '21

06 Dec '21

All, This new sssd version for RHEL7 (sssd-1.16.5-10.el7_9.11) fixes a bug we’ve seen in sssd. This bug: https://bugzilla.redhat.com/show_bug.cgi?id=1984591 . (Thanks, Sumit!) We’ve verified this bugfix – that it only auto-discovers the expected domains now, not the extra domains that it shouldn’t discover. So how best to roll out this new bugfixed sssd version? (We do “no downtime” OS patching + kernel splicing monthly, so we try to be gentle in our monthly patching.) Right now, the following domains have been auto-discovered: [root@spikeol73canbo yum.repos.d]# sssctl domain-list amer.company.com company.com emea.company.com apac.company.com japn.company.com EMEAICMD.geodll.company.com geocompany.company.com EMEAICM.GEOCOMPANY.COMPANY.COM alienware.com corp.svcs perotsystems.net companyservices.dmz Beer.Town production.online.company.com jp-poclab.companypoc.com emea-poclab.companypoc.com oldev.preol.company.com olqa.preol.company.com ap-poclab.companypoc.com [root@spikeol73canbo yum.repos.d]# Only the top 5 AD domains are good domains that should be discovered. When I yum upgrade to this new good sssd version all the above domains are still cached. Even if I do ‘sssctl cache-expire -E’, these cached bogus domains still are not cleaned up. If I aggressively clear the sssd cache as so: systemctl stop sssd cd /var/lib/sss rm -rf db/* rm -f /mc/* systemctl start sssd that clears the cache. But that’s pretty invasive to push out as part of monthly patching. 1. Is there a kinder, gentler way to expire these bogus cached AD domains? Along the lines of sssctl cache-expire -E or sssctl cache-expire -d <bogus domain>? 2. If we let this new sssd version sit for 1-2 days, will these bogus auto-discovered AD domains auto-expire from cache on their own? Spike

1 0

SSSD keeps retrieving LDAP groups while online, degrading performance (no matter what settings I try)
by Robert Wagensveld 02 Dec '21

02 Dec '21

Hi all, We've been using SSSD for a while successfully in our Kerberos over LDAP enterprise environment. However, our SSSD online query time, especially over VPN, is very poor, usually each login request or sudo requests takes about 1 minute. There does not seem to be a way around it, not even forcing SSSD to use the cache for a while even when online again. entry_cache_timeout does not help. Is there anything I'm missing? Some configuration options I do not know about yet? [sssd] config_file_version = 2 services = nss, pam, ifp domains = company.nl debug_level = 9 [nss] entry_cache_nowait_percentage = 5 filter_groups = root filter_users = root debug_level = 9 [pam] offline_failed_login_attempts = 3 offline_failed_login_delay = 30 debug_level = 9 [domain/company.nl] debug_level = 9 id_provider = ldap ignore_group_members = true auth_provider = krb5 chpass_provider = krb5 access_provider = permit cache_credentials = true min_id = 1000 entry_cache_timeout = 28800 krb5_realm = COMPANY.NL krb5_canonicalize = false krb5_renewable_lifetime = 24h krb5_renew_interval = 6h krb5_server = dc03.company.nl krb5_store_password_if_offline = true krb5_ccname_template = FILE:%d/krb5cc_%U ldap_uri = ldap://dc03.company.nl ldap_search_base = DC=Company,DC=nl ldap_user_search_base = OU=CompanyCompany,DC=nl ldap_group_search_base = OU=Company,DC=Company,DC=nl?? ldap_referrals = false enumerate = false ldap_force_upper_case_realm = true ldap_schema = rfc2307bis ldap_id_use_start_tls = false ldap_tls_reqcert = demand ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt ldap_sasl_canonicalize = true ldap_sasl_mech = GSSAPI ldap_user_object_class = user ldap_user_name = sAMAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_gecos = gecos ldap_user_shell = loginShell ldap_user_home_directory = unixHomeDirectory ldap_user_principal = nonExistingAttribute ldap_group_object_class = group ldap_group_name = cn ldap_group_gid_number = gidNumber ldap_group_member = member

4 4

Samba filesharing, ssh and sssd
by Harald 11 01 Dec '21

01 Dec '21

Hello! I am using sssd 2.4 with Debian 11. I try to setup a samba server within a samba ads domain. I did several approches, sssd with ad and ldap configuration and samba with ad, sss and nss backend. Basic setup with sssd went good, login via ssh works. UID and GID are well too But I do not get samba run well. Either my user can't access server and see shares, nor I can access shares but UID and GID are wrong. Which way is best to get ssh and samba running with sssd?

4 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users December 2021