sssd-users December 2022

sssd-users@lists.fedorahosted.org

14 participants
13 discussions

Starting SSSD without root
by Tero Saarni 09 Apr '24

09 Apr '24

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 20

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell 22 Jul '23

22 Jul '23

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

2 3

filter_users using user id
by Francois Rigault 09 Jan '23

09 Jan '23

Greetings, we run some podman containers that come with their own local users, such as this one: ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent: (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461] I would hope to get rid of these requests against the domain. unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users. I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion. I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better. Thank you!

4 3

Re: AD refresh GPO to Ubuntu22.04
by Gregory Carter 25 Dec '22

25 Dec '22

There is no such thing as a GPO for a LINUX box. That being said I use Puppet to do basically the same thing. (i.e. Bring LINUX, MAC, Windows to bear on a common LDAP policy schema I created to enforce machine configurations, authentication and security policies.) On Fri, Sep 9, 2022 at 12:56 AM 任昭翰 <zhaohan.ren(a)hotmail.com> wrote: > Hi guys > > I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server > by sssd + realm, in the AD I have a customized GPO, is it possible that the > AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client > that also joined this AD, the win10 client could receive the GPO update > successfully from the AD. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

4 5

missing secondary groups that have Global scope
by Jeffrey Chung 23 Dec '22

23 Dec '22

Hello all. We’re noticing an issue where at times the id command does not return a complete list of the user’s secondary groups. In our Linux environment we use both Universal and Global groups and it’s always only the Global groups that are missing. From troubleshooting we’re certain this issue comes up when a Global Catalog that is not in the same domain of the missing Global groups is used to query for group membership. From my understanding, in Active Directory only Universal group memberships are replicated to every Global Catalog. We have a single forest with multiple domains. The forest root domain is empty and only use for administration. We have a child domain for resource like users, groups and computers. contoso.com – empty forest root corp.contoso.com – child domain of root, users, groups and computer objects live here. SSSD Linux are joined to this domain. Every Domain Controller in the forest are Global Catalogs, so we have GCs in both contoso.com and corp.contoso.com. Here’s an example of when secondary groups are missing. We have a user john(a)corp.contoso.com and is a direct member of the following corp.contoso.com groups. group1 (Universal scope) group2 (Global scope) On the SSSD host we run the following command. % id john Only john’s primary group and group1 are returned. From the SSSD debug logs, we only see this happen when the query is hitting a Global Catalog (port 3268) in the root domain contoso.com. If the query hits a GC in corp.contoso.com the correct groups are returned. The LDAP filter we see from the logs is this. (&(member=CN=john,CN=Users,DC=corp,DC=contoso,DC=com)(objectClass=posixgroup)(cn=*)) Which will not return Global groups because the Global Catalog Domain Controllers in contoso.com only have membership data for Universal groups. We noticed this issue on sssd-1.16.1, we have hosts running an older version sssd-1.11.5.1 that don’t have this issue because the group membership query is using the LDAP port 389 not GC port 3268. On both versions we have “ad_enable_gc” set to true. Is this a bug we’re hitting, or we have SSSD configured incorrectly? Should SSSD be group scope aware and handle this situation correctly? We can think of a couple work-arounds, but rather not implement it if possible. 1. Set “ad_enable_gc” to false – this will probably cause some inefficiencies for SSSD 2. Convert the Global groups to Universal – we have a lot of groups and this will take some time to vette out to avoid any negative impact to our environment Here is an example of our sssd.conf. [sssd] config_file_version = 2 debug_level = 9 services = nss,pam domains = corp.contoso.com [nss] debug_level = 9 filter_users = root filter_groups = root filter_users_in_groups = false timeout = 60 [pam] debug_level = 9 reconnection_retries = 3 timeout = 60 [domain/corp.contoso.com] ad_gpo_access_control = disabled debug_level = 9 ldap_user_object_class = posixaccount ldap_user_home_directory = unixhomedirectory ldap_group_object_class = posixgroup ldap_group_name = cn ldap_group_member = member ldap_group_nesting_level = 0 ldap_use_tokengroups = false cache_credentials = true id_provider = ad auth_provider = ad chpass_provider = ad access_provider = ad dns_discovery_domain = corp.contoso.com dyndns_update = false ldap_id_mapping = false ad_enable_gc = true ldap_search_base = dc=corp,dc=contoso,dc=com?subtree? ad_maximum_machine_account_password_age = 0 use_fully_qualified_names = false krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U krb5_renew_interval = 60m timeout = 60 Thanks in advance -Jeff

3 7

Issues using NSS_TACPLUS in Fedora 36's replacement of NSCD with SSSD
by Sundar Vadivelu 22 Dec '22

22 Dec '22

Hi all, I am working on a system which does TACACS+ authentication of users with pam_tacplus and nss_tacplus libraries nss_tacplus: https://github.com/benschumacher/nss_tacplus pam_tacplus: https://github.com/kravietz/pam_tacplus This solution relied on NSCD to be running, since the nss_tacplus only implemented getpwnam_r . For getpwuid_r etc it relied on the cached entries in nscd. It was working fine until fedora removed NSCD from glibc in FC36 ( https://fedoraproject.org/wiki/Changes/RemoveNSCD) The above write up indicates that SSSD could be used to cover all cacheing requirements that was previously provided by NSCD. However I am unable to configure SSSD for my use case. When I tried to link the id_provider as proxy and the proxy_lib_name as tacplus, sssd fails to come up. If fails with this error: (2022-12-19 23:32:35): [be[shadowutils]] [sss_load_nss_symbols] (0x0010): Library 'libnss_tacplus.so.2' did not provide mandatory symbol 'getpwuid_r', error: /lib64/libnss_tacplus.so.2: undefined symbol: _nss_tacplus_getpwuid_r. Is there any way to use sssd with the above mentioned nss_tacplus library? By this I mean can sssd be configured to do getpwnam only using the nss_tacplus, at which time it could cache the passwd details of the user, and use the cache for the other APIs like getpwuid etc? _________________________________________________

3 2

New sssd-related message this week in /var/log/messages
by Spike White 21 Dec '22

21 Dec '22

Sssd experts, We have been running sssd to AD integrate to a cross-domain AD forest for ~2 years now. With RHEL 7, 8 and (now) 9 servers. Has worked great. Just this week, we have a new message appearing in /var/log/messages related to sssd that we’ve never seen before: *Dec 10 06:11:19 pshnldur01.amer.company.com <http://pshnldur01.amer.company.com> sssd_be[343144]: PAC check is requested but krb5_validate is set to false. PAC checks will be skipped.* This is a RHEL8 server, running sssd 2.7.3-4.0.1.el8_7.1 -- installed Fri 02 Dec 2022. We notice a new sssd_pac process running, even though in /etc/sssd/sssd.conf, we did not explicitly define any “pac” service. In RHEL7 servers, we do not see any such sssd_pac process. We do see this process in RHEL9 servers. In the change log for this new RHEL8 sssd version, I notice this recent entry: [2.7.3-4.1] - Resolves: rhbz#2128902 - Cannot SSH with AD user to ipa-client (krb5_validate and pac_check settings conflict) [rhel-9.1.0.z] Yes, in our /etc/sssd/sssd.conf file we set: krb5_validate = False All seems to be behaving. The server appears to be able to communicate fine with this local domain. All expected logins appear to work. 1. Can we ignore these messages? 2. Are they due to this new sssd version? 3. Why does a pac service start up if we do not explicitly define it in our list of services? Spike White

3 3

Issues using NSS_TACPLUS in Fedora 36's replacement of NSCD with SSSD
by Sundar Vadivelu 20 Dec '22

20 Dec '22

Hi all, I am working on a system which does TACACS+ authentication of users with pam_tacplus and nss_tacplus libraries nss_tacplus: https://github.com/benschumacher/nss_tacplus pam_tacplus: https://github.com/kravietz/pam_tacplus This solution relied on NSCD to be running, since the nss_tacplus only implemented getpwnam_r . For getpwuid_r etc it relied on the cached entries in nscd. It was working fine until fedora removed NSCD from glibc in FC36 (https://fedoraproject.org/wiki/Changes/RemoveNSCD) The above write up indicates that SSSD could be used to cover all cacheing requirements that was previously provided by NSCD. However I am unable to configure SSSD for my use case. When I tried to link the id_provider as proxy and the proxy_lib_name as tacplus, sssd fails to come up. If fails with this error: (2022-12-19 23:32:35): [be[shadowutils]] [sss_load_nss_symbols] (0x0010): Library 'libnss_tacplus.so.2' did not provide mandatory symbol 'getpwuid_r', error: /lib64/libnss_tacplus.so.2: undefined symbol: _nss_tacplus_getpwuid_r. Is there any way to use sssd with the above mentioned nss_tacplus library? By this I mean can sssd be configured to do getpwnam only using the nss_tacplus, at which time it could cache the passwd details of the user, and use the cache for the other APIs like getpwuid etc?

1 0

[SSSD] Announcing SSSD 2.8.2
by Pavel Březina 09 Dec '22

09 Dec '22

# SSSD 2.8.2 The SSSD team is announcing the release of version 2.8.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.8.2 See the full release notes at: https://sssd.io/release-notes/sssd-2.8.2.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * SSSD can be configured not to perform a DNS search during DNS name resolution. This behavior is governed by the new dns_resolver_use_search_list. This parameter can be used in the domain section. Default value is true - that means that SSSD follows the system settings. * `--enable-files-domain` configure option is deprecated and will be removed in one of the next versions of SSSD. * `sssctl analyze` tool doesn't require anymore to be run under root. ### New features * New mapping template for serial number, subject key id, SID, certificate hashes and DN components are added to libsss_certmap.

1 0

sssd.conf for single ldap id_provider across 2 or more krb5 auth_providers.
by Christian, Mark 08 Dec '22

08 Dec '22

I have a single ldap instance that provides ID for accounts across multiple trusted kerberos realms. I don't see a way to list multiple keberos REALMS under a single domain section. I'm guessing the only way this scheme will work is if I locate the realm1 ldap accounts in one container and the realm2 accounts in another container e.g.: domains = realm1, realm2 [domain/realm1] id_provider = ldap ldap_uri = ldaps://ldap.example.com auth_provider = krb5 krb5_realm = REALM1.COM ldap_user_search_base = ou=realm1,ou=people,dc=example,dc=com [domain/realm2] id_provider = ldap ldap_uri = ldaps://ldap.example.com auth_provider = krb5 krb5_realm = REALM2.COM ldap_user_search_base = ou=realm2,ou=people,dc=example,dc=com Am I correct that I won't be able to place the realm1 and realm2 accounts in the same ldap_user_search_base? I was hoping I might be able to leverage “[domain/realm1/realm2]” but it doesn't look like krb5_realm is an option here, and that the trusted domain section expects to find identity in separate user search bases. Mark

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users December 2022