sssd-users September 2022

sssd-users@lists.fedorahosted.org

6 participants
9 discussions

Starting SSSD without root
by Tero Saarni 20 Jan '26

20 Jan '26

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 21

SSSD.Service not starting
by Manjot Singh 12 Feb '25

12 Feb '25

● sssd.service - System Security Services Daemon Loaded: loaded (/lib/systemd/system/sssd.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Wed 2020-01-29 14:12:32 EST; 9s ago Process: 23217 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=4) Main PID: 23217 (code=exited, status=4) Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Service RestartSec=100ms expired, scheduling restart. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Scheduled restart job, restart counter is at 5. Jan 29 14:12:32 pop-os systemd[1]: Stopped System Security Services Daemon. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Start request repeated too quickly. Jan 29 14:12:32 pop-os systemd[1]: sssd.service: Failed with result 'exit-code'. Jan 29 14:12:32 pop-os systemd[1]: Failed to start System Security Services Daemon.

3 2

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell 22 Jul '23

22 Jul '23

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

2 3

Re: AD refresh GPO to Ubuntu22.04
by Gregory Carter 25 Dec '22

25 Dec '22

There is no such thing as a GPO for a LINUX box. That being said I use Puppet to do basically the same thing. (i.e. Bring LINUX, MAC, Windows to bear on a common LDAP policy schema I created to enforce machine configurations, authentication and security policies.) On Fri, Sep 9, 2022 at 12:56 AM 任昭翰 <zhaohan.ren(a)hotmail.com> wrote: > Hi guys > > I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server > by sssd + realm, in the AD I have a customized GPO, is it possible that the > AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client > that also joined this AD, the win10 client could receive the GPO update > successfully from the AD. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

4 5

SSH with KbdInteractiveAuthentication - pam_sssd activates wrong credentials cache on login
by Sam Morris 12 Oct '22

12 Oct '22

Posting this here before I file a bug because there are a few similar bugs which have been closed, and so I don't know if I'm seeing one of them or whether this is a new one. On the server, before I SSH in, my credentials cache collection looks like this: $ printenv KRB5CCNAME KCM: $ klist -l Principal name Cache name -------------- ---------- user(a)EXAMPLE.COM KCM:1011:48623 (Expired) user(a)EXAMPLE.COM KCM:1011:1518 (Expired) user(a)EXAMPLE.COM KCM:1011:12525 (Expired) user(a)EXAMPLE.COM KCM:1011:95695 (Expired) user(a)EXAMPLE.COM KCM:1011:19607 (Expired) user(a)EXAMPLE.COM KCM:1011:25261 (Expired) $ klist Ticket cache: KCM:1011:95695 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 06/22/22 00:03:52 06/23/22 00:01:49 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM The TGT in the primary credentials cache is an old one that expired a few days ago. Now I SSH into the server, using keyboard-interactive authentication, so sshd calls into pam_sss to authenticate me with Kerberos. $ ssh -v -l user server.example.com debug1: Next authentication method: keyboard-interactive (user(a)server.example.com) First Factor: (user(a)server.example.com) Second Factor: Authenticated to server.example.com (via proxy) using "keyboard-interactive". $ klist Ticket cache: KCM:1011:48623 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 05/24/22 23:39:09 05/25/22 23:16:16 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM 05/25/22 19:31:42 05/25/22 23:16:16 HTTP/server.example.com(a)EXAMPLE.COM The primary credential cache has been changed to a different cache, that contains an old, expired ticket. So the I can't use my TGT to access network services. If I then list the contents of the original primary credential cache: $ klist -c KCM:1011:95695 Ticket cache: KCM:1011:95695 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 09/28/22 09:37:09 09/29/22 09:36:36 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM SSSD put the new TGT into the former primary credential cache, and then changed the primary credential cache to one of the other caches within the collection. I expected that, regardless of whether the new TGT goes into a new credential cache or an existing one, the destination credential cache is set as the primary so that it can be used by the user. In particular this looks like <https://github.com/SSSD/sssd/issues/4988>, but a comment says that that has been fixed in RHEL 8 some time ago, nonetheless I'm seeing this problem on both RHEL 9.0 (sssd-common-2.6.2-4.el9_0.1.x86_64) and RHEL 8.6 (sssd-common-2.6.2-4.el8_6.1.x86_64). The workaround is to identify the credential cache that contains non-expired credentials and then make it the primary: $ klist -l Principal name Cache name -------------- ---------- user(a)EXAMPLE.COM KCM:1011:48623 (Expired) user(a)EXAMPLE.COM KCM:1011:1518 (Expired) user(a)EXAMPLE.COM KCM:1011:12525 (Expired) user(a)EXAMPLE.COM KCM:1011:19607 (Expired) user(a)EXAMPLE.COM KCM:1011:95695 $ kswitch -c KCM:1011:95695 If I perform the same test but using gssapi-with-mic authentication in combination with GSSAPIDelegateCredentials, then I see that the TGT is stored in a new credentials cache, which is then set as the primary, e.g. everything works! I also think that sssd should be cleaning up these old credential caches. AFAIK, there's no perfect forward secrecy with Kerberos, so can these old tickets can be used to decrypt captured network traffic? Regards, -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 1

auto_private_groups = hybrid - not working
by Francis Augusto Medeiros-Logeay 21 Sep '22

21 Sep '22

Hi, I recently have been aware of the option "hybrid" for auto_private_groups, and it would really help us to solve a problem where our AD server has a gidNumber set up for users, but no primary group name assigned. When set to `true`, it works fine, though we don't want to set it to true because the uid might have been used as a gid for another user. Therefore hybrid is a better solution for us. Can you help me to debug this? I see on the log, and get no errors. But when logging in, my user gets this: /usr/bin/id: cannot find name for group ID 2558757. Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 3

Re: 回复: Re: AD refresh GPO to Ubuntu22.04
by Gregory Carter 14 Sep '22

14 Sep '22

Good Luck...If you need to unify your security models in your organization I would suggest Puppet. I use a GIT server to check in each puppet security model to version control the security and push it to puppet clients with native settings for each operating system environment. Works great for the BSD, LINUX, Windows 10/11 and Windows 2019 servers I have. On Tue, Sep 13, 2022 at 7:57 PM 昭翰任 <zhaohan.ren(a)hotmail.com> wrote: > Thanks guys for your clarification, I will find other method. > ------------------------------ > *From:* Tomas Halman <thalman(a)redhat.com> > *Sent:* Tuesday, September 13, 2022 9:19 > *To:* End-user discussions about the System Security Services Daemon < > sssd-users(a)lists.fedorahosted.org> > *Subject:* [SSSD-users]Re: 回复: Re: AD refresh GPO to Ubuntu22.04 > > In that case Gregory is right, SSSD cares about the access control. > I thought that you were looking for this kind of functionality. Sorry for > misunderstanding... > > Tom > > On Tue, Sep 13, 2022 at 6:11 AM Gregory Carter <gjcarter2(a)gmail.com> > wrote: > > I wanted to point out exactly what sssd support is provided with regards > to Active Directory. Windows workstation/server management is not one of > them and I think it is important people understand that. > > Most of the questions I get are around Windows configuration questions and > due to that confusion people think sssd magically translates windows > setting into compatible Linux equivalents. > > That is not the case. > > On Mon, Sep 12, 2022 at 5:54 PM 昭翰任 <zhaohan.ren(a)hotmail.com> wrote: > > Thanks Tomáš & Gregory for your response > > You are right, sssd has some GPO related > settings(e.g. ad_gpo_access_control/ad_gpo_implicit_deny/ad_gpo_cache_timeout/...), > however there are for access control, not what I want. What I want is a > customized GPO settings that AD could refresh/push to all the client side, > for example: > > I have an AD(winserver2012) and some clients(Win10, Ubuntu22.04), there is > an ADMX policy which defines the max DPI that could be used when printing a > document, this ADMX policy has been deployed correctly on the AD, what I > expect is when I change the max DPI value on the AD, both Win10 and > Ubuntu(maybe stored at somewhere on the disk?) could get the latest max DPI > I setup on AD. > > However I found Win10 could get the latest DPI value, but the Linux system > doesn't get any update. > > Does sssd support the scenario I described above? > > BRs > > > ------------------------------ > *From:* Gregory Carter <gjcarter2(a)gmail.com> > *Sent:* Monday, September 12, 2022 16:44 > *To:* End-user discussions about the System Security Services Daemon < > sssd-users(a)lists.fedorahosted.org> > *Subject:* [SSSD-users] Re: AD refresh GPO to Ubuntu22.04 > > Excellent, so please share with the list what windows settings I can use > GPO on from my Linux box. > > On Mon, Sep 12, 2022 at 2:44 AM Tomas Halman <thalman(a)redhat.com> wrote: > > There actually is GPO support in SSSD. > > Looking at the man page (sssd-ad), you have to use "ad" provider and tune > few options regarding gpo, particularly ad_gpo_access_control and > ad_gpo_implicit_deny. > > If it is not working for you, can you share the sssd.conf? Eventually you > can increase the SSSD debug_level and look into logs if there is something > wrong with GPO evaluation. > > HTH > Tomáš > > On Sat, Sep 10, 2022 at 2:53 AM Gregory Carter <gjcarter2(a)gmail.com> > wrote: > > There is no such thing as a GPO for a LINUX box. > > That being said I use Puppet to do basically the same thing. (i.e. Bring > LINUX, MAC, Windows to bear on a common LDAP policy schema I created to > enforce machine configurations, authentication and security policies.) > > On Fri, Sep 9, 2022 at 12:56 AM 任昭翰 <zhaohan.ren(a)hotmail.com> wrote: > > Hi guys > > I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server > by sssd + realm, in the AD I have a customized GPO, is it possible that the > AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client > that also joined this AD, the win10 client could receive the GPO update > successfully from the AD. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > > > -- > Tomáš Halman > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > > > -- > Tomáš Halman > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

1 0

Re: 回复: Re: AD refresh GPO to Ubuntu22.04
by Gregory Carter 13 Sep '22

13 Sep '22

I wanted to point out exactly what sssd support is provided with regards to Active Directory. Windows workstation/server management is not one of them and I think it is important people understand that. Most of the questions I get are around Windows configuration questions and due to that confusion people think sssd magically translates windows setting into compatible Linux equivalents. That is not the case. On Mon, Sep 12, 2022 at 5:54 PM 昭翰任 <zhaohan.ren(a)hotmail.com> wrote: > Thanks Tomáš & Gregory for your response > > You are right, sssd has some GPO related > settings(e.g. ad_gpo_access_control/ad_gpo_implicit_deny/ad_gpo_cache_timeout/...), > however there are for access control, not what I want. What I want is a > customized GPO settings that AD could refresh/push to all the client side, > for example: > > I have an AD(winserver2012) and some clients(Win10, Ubuntu22.04), there is > an ADMX policy which defines the max DPI that could be used when printing a > document, this ADMX policy has been deployed correctly on the AD, what I > expect is when I change the max DPI value on the AD, both Win10 and > Ubuntu(maybe stored at somewhere on the disk?) could get the latest max DPI > I setup on AD. > > However I found Win10 could get the latest DPI value, but the Linux system > doesn't get any update. > > Does sssd support the scenario I described above? > > BRs > > > ------------------------------ > *From:* Gregory Carter <gjcarter2(a)gmail.com> > *Sent:* Monday, September 12, 2022 16:44 > *To:* End-user discussions about the System Security Services Daemon < > sssd-users(a)lists.fedorahosted.org> > *Subject:* [SSSD-users] Re: AD refresh GPO to Ubuntu22.04 > > Excellent, so please share with the list what windows settings I can use > GPO on from my Linux box. > > On Mon, Sep 12, 2022 at 2:44 AM Tomas Halman <thalman(a)redhat.com> wrote: > > There actually is GPO support in SSSD. > > Looking at the man page (sssd-ad), you have to use "ad" provider and tune > few options regarding gpo, particularly ad_gpo_access_control and > ad_gpo_implicit_deny. > > If it is not working for you, can you share the sssd.conf? Eventually you > can increase the SSSD debug_level and look into logs if there is something > wrong with GPO evaluation. > > HTH > Tomáš > > On Sat, Sep 10, 2022 at 2:53 AM Gregory Carter <gjcarter2(a)gmail.com> > wrote: > > There is no such thing as a GPO for a LINUX box. > > That being said I use Puppet to do basically the same thing. (i.e. Bring > LINUX, MAC, Windows to bear on a common LDAP policy schema I created to > enforce machine configurations, authentication and security policies.) > > On Fri, Sep 9, 2022 at 12:56 AM 任昭翰 <zhaohan.ren(a)hotmail.com> wrote: > > Hi guys > > I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server > by sssd + realm, in the AD I have a customized GPO, is it possible that the > AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client > that also joined this AD, the win10 client could receive the GPO update > successfully from the AD. > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > > > -- > Tomáš Halman > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

3 2

AD refresh GPO to Ubuntu22.04
by 任昭翰 09 Sep '22

09 Sep '22

Hi guys I have a Ubuntu22.04 client which joined to an AD(winserver 2012) server by sssd + realm, in the AD I have a customized GPO, is it possible that the AD refresh/push the GPO to the Ubuntu machine? I also have a win10 client that also joined this AD, the win10 client could receive the GPO update successfully from the AD.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users September 2022