June 2023 - sssd-users - Fedora Mailing-Lists

by Tero Saarni

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

1 week, 3 days

5
20
0 / 0

sssd-pac.service fails to start after Debian 12 upgrade (fatal error setting up backend connector)

by Adam Cecile

Hello, I am not sure to understand what is going on but all my servers being upgraded from Debian 11 to Debian 12 with MS Active Directory integration using SSSD starts reporting systemctl issues with sssd-pac service/socket failing to start. When being started manually with "/usr/libexec/sssd/sssd_pac --logger=stderr --socket-activated --debug-level=8": [pac] [ldb] (0x0400): server_sort:Unable to register control with rootdse! (2023-06-14 15:21:20): [pac] [server_setup] (0x3f7c0): Starting with debug level = 0x37f0 (2023-06-14 15:21:20): [pac] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb (2023-06-14 15:21:20): [pac] [schedule_responder_idle_timer] (0x2000): Re- scheduling the idle timeout [responder_idle_timeout] for the responder [0x55892f921550] (2023-06-14 15:21:20): [pac] [setup_responder_idle_timer] (0x2000): Setting up the idle timeout [responder_idle_timeout] for the responder [0x55892f921550] (2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400): No enumeration for [ad.domain.com]! (2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information (2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x1000): pwd_expiration_warning is 21 (2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x0100): Setting domain password expiration warning to 21 days (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/sh in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/bash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/bash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/rbash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/rbash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/dash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/dash in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/screen in /etc/shells (2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /usr/bin/sh in /etc/shells (2023-06-14 15:21:20): [pac] [sss_names_init_from_args] (0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>.+)@(?P<domain>[^@]+$))|(^(?P<name>[^@\\]+)$))]. (2023-06-14 15:21:20): [pac] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. (2023-06-14 15:21:20): [pac] [sbus_dbus_request_name] (0x0020): Unable to request name on the system bus [3] (2023-06-14 15:21:20): [pac] [sss_dp_init] (0x0010): Failed to connect to backend server. (2023-06-14 15:21:20): [pac] [sss_process_init] (0x0010): fatal error setting up backend connector (2023-06-14 15:21:20): [pac] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down (2023-06-14 15:21:20): [pac] [pac_process_init] (0x0010): sss_process_init() failed Such error does not occurs on Debian 11. Sadly Internet is not really helping on this one so I have no idea of what to look for. Everything seems to be working correctly despite the failing service. Any idea ? Best regards, Adam.

7 months, 3 weeks

5
9
0 / 0

Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN

by Brian J. Murrell

On my dual-stack network where some machines actually don't have IPv4 connectivity I am finding that whatever is writing IP addresses into /var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses and not the KDC's IPv6 addresses. The result is that such an IPv6 machine cannot reach a KDC until I remove that file. It ends up being recreated at some subsequent point again with only the KDC's IPv4 addresses. Is this a bug or a problem with my configuration? Cheers, b.

9 months

2
3
0 / 0

Is there a way to restrict nss group membership searches for local users to only /etc/group?

by Spike White

All, Successful sssd consumer here. Have an app team running Hadoop. They're getting these performance errors in their app. This is from their app logs. ddlflhdm201.us.company.com WARN June 15, 2023 10:08 AM Groups Potential performance problem: getGroups(user=hbase) took 58022 milliseconds ddlflhdm304.us.company.com WARN June 15, 2023 8:38 AM Groups Potential performance problem: getGroups(user=mapred) took 39962 milliseconds ddlplhdm505.us.company.com WARN June 16, 2023 5:37 AM Groups Potential performance problem: getGroups(user=hdfs) took 62437 milliseconds. ddlplhdm305.us.company.com WARN June 15, 2023 9:36 PM Groups Potential performance problem: getGroups(user=hdfs) took 58017 milliseconds ddlplhdm505.us.company.com WARN June 10, 2023 8:01 AM Groups Potential performance problem: getGroups(user=yarn) took 58017 milliseconds. Interestingly, all these users are local users created by the Hadoop package installation. (hbase, mapred, hdfs, yarn are all local users). These local users are members only of local groups. So theoretically the search for group memberships should be lightning quick as the groups are found only in /etc/group. But since my /etc/nsswitch.conf looks like this: passwd: files systemd sss group: files systemd sss netgroup: files sss automount: files sss services: files shadow: files sss hosts: files dns myhostname It not only searches local files for group membership, it searches AD as well. And doesn't find it, as there is no such AD user or uid. Eventually timing out. In /var/log/messages we see this around the same time frame as Jun 15 10:08:09 ddlflhdm201 sssd[be[amer.company.com]]: GSSAPI Error: An invalid name was supplied (Success) Is there a way to restrict these particular local app accounts from having their group memberships looked up in AD? I.e., my [nss] section looks like this today: [nss] #debug_level = 9 filter_groups = root filter_users = root #override_homedir = /home/%u Can I do this? [nss] filter_users = root, hbase, mapred, hdfs, yarn And would I want to set filter_users_in_groups = false? Spike White

9 months, 2 weeks

2
5
0 / 0

Group caching issue

by vivianne＠chinstrap.org

Hello, I'm using SSSD with LDAP and NSS enabled for user/group information. Originally, groups besides the primary group would be "forgotten"/no longer be present. Invalidating the cache with sss_cache -u (username) temporarily fixes it, and through testing I found it'd reoccur 5 minutes after forced cache invalidation. I realized NIS was mistakenly in our nsswitch.conf and removed it, and now it seems to happen about every 45 minutes consistently. If you leave the machine for a while and come back then they'll be present again. I've set debug_log=10 under all our conf sections but don't really see anything relevant in the logs watching them with tail while checking group presence. I'm not experienced with SSSD administration, so I'd appreciate any tips on triaging this further. Thanks all. Vivianne

9 months, 3 weeks

2
1
0 / 0

Override an attribute for all users?

by Gökçe Aydos

Due to historical reasons I have different parent directories for `homeDirectory`, e.g., ``` /home/u1 /home-xx/u2 ``` I want to map all of them to `home`. In `nslcd` it is possible by using: ``` map passwd homeDirectory "/home/$uid" ``` Is it possible to override an attribute for all users in sssd?

9 months, 3 weeks

1
1
0 / 0

[SSSD] Announcing SSSD 2.9.1

by Pavel Březina

# SSSD 2.9.1 The SSSD team is announcing the release of version 2.9.1 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.1 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.1.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * Passkey: added option to write key mapping data to file. ### Important fixes * A regression was fixed that prevented autofs lookups to function correctly when cache_first is set to True. Since this was set as a new default value in sssd-2.9.1, it is considered as a regression. * A regression where SSSD failed to properly watch for changes in '/etc/resolv.conf' when it was a symbolic link or was a relative path, was fixed.

10 months

1
0
0 / 0

id_provider from AD but groups from LDAP

by Francis Augusto Medeiros-Logeay

Hi, Is it possible to have groups fetched from LDAP while still having `ad` as the id_provider? The reason to do this is the following: Historically, our organization has had all linux machines to get its id data from LDAP. But now with NFSv4, we are joining the machines to AD, while still using id_provider=ldap and getting our groups from our ldap server. This works well. The challenge came when now we have to use certificate-based authentication. The certificates are in AD, and so far it has only worked when I had id_provider=ad. If I could still fetch the groups from ldap, that would be a win-win, as we still could use NFSv4 while being able to use certificate-based authentication. Any tips here? Best, Francis

10 months, 2 weeks

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2023