Starting SSSD without root
by Tero Saarni
Hi,
I'm trying to run SSSD inside docker container without root user. The
container is executed in OpenShift cluster which does not allow running as root
inside container.
SSSD requires root and checks for this specifically.
Is there any workaround for this?
I believe the limitation is implemented for security reasons, in order to have
most critical parts executed as root and have it drop privileges for other
parts but this now completely blocks using SSSD in the above environment.
--
Tero
2 weeks, 3 days
sssd-pac.service fails to start after Debian 12 upgrade (fatal error setting up backend connector)
by Adam Cecile
Hello,
I am not sure to understand what is going on but all my servers being upgraded
from Debian 11 to Debian 12 with MS Active Directory integration using SSSD
starts reporting systemctl issues with sssd-pac service/socket failing to
start.
When being started manually with "/usr/libexec/sssd/sssd_pac --logger=stderr
--socket-activated --debug-level=8":
[pac] [ldb] (0x0400): server_sort:Unable to register control with rootdse!
(2023-06-14 15:21:20): [pac] [server_setup] (0x3f7c0): Starting with debug
level = 0x37f0
(2023-06-14 15:21:20): [pac] [server_setup] (0x0400): CONFDB:
/var/lib/sss/db/config.ldb
(2023-06-14 15:21:20): [pac] [schedule_responder_idle_timer] (0x2000): Re-
scheduling the idle timeout [responder_idle_timeout] for the responder
[0x55892f921550]
(2023-06-14 15:21:20): [pac] [setup_responder_idle_timer] (0x2000): Setting up
the idle timeout [responder_idle_timeout] for the responder [0x55892f921550]
(2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400):
No enumeration for [ad.domain.com]!
(2023-06-14 15:21:20): [pac] [confdb_init_domain_provider_and_enum] (0x0400):
Please note that when enumeration is disabled `getent passwd` does not return
all users by design. See sssd.conf man page for more detailed information
(2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x1000):
pwd_expiration_warning is 21
(2023-06-14 15:21:20): [pac] [confdb_init_domain_pwd_expire] (0x0100): Setting
domain password expiration warning to 21 days
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell /bin/sh
in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/bin/bash in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/usr/bin/bash in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/bin/rbash in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/usr/bin/rbash in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/bin/dash in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/usr/bin/dash in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/usr/bin/screen in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_get_etc_shells] (0x0400): Found shell
/usr/bin/sh in /etc/shells
(2023-06-14 15:21:20): [pac] [sss_names_init_from_args] (0x0100): Using re
[(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>.+)@(?P<domain>[^@]+$))|(^(?P<name>[^@\\]+)$))].
(2023-06-14 15:21:20): [pac] [sss_fqnames_init] (0x0100): Using fq format
[%1$s@%2$s].
(2023-06-14 15:21:20): [pac] [sbus_dbus_request_name] (0x0020): Unable to
request name on the system bus [3]
(2023-06-14 15:21:20): [pac] [sss_dp_init] (0x0010): Failed to connect to
backend server.
(2023-06-14 15:21:20): [pac] [sss_process_init] (0x0010): fatal error setting
up backend connector
(2023-06-14 15:21:20): [pac] [sss_responder_ctx_destructor] (0x0400): Responder
is being shut down
(2023-06-14 15:21:20): [pac] [pac_process_init] (0x0010): sss_process_init()
failed
Such error does not occurs on Debian 11.
Sadly Internet is not really helping on this one so I have no idea of what to
look for. Everything seems to be working correctly despite the failing service.
Any idea ?
Best regards, Adam.
8 months
Doubt about integration between Samba 4 and OpenLDAP
by Cairo Campos
I need to continuously synchronize OpenLDAP users and passwords with a Samba 4 DC. However, this doesn't seem to be a good idea due to incompatibilities.
Searching the internet, I saw some pages mentioning SSSD, so that I can use OpenLDAP as the basis of authentication for Samba 4.
Currently, my production Samba 4 domain uses internal LDAP and DNS.
I wanted material or documentation that showed me how to make the switch to using SSSD robustly.
Can you help me?
8 months, 2 weeks
best practice, using machine-account keytab for service SPNs
by Stefan Bauer
Dear Users,
i really love SSSD and also the auto-renewal of the host-keytab file.
On many hosts we add the SPNs
HTTP/
SQL/...
directly to the machine-account in Active-Directory. This is all fine and
works.
However i have a bad feeling about letting services read the keytab file as
it gives access to the machine-account.
Opinions?
How do you handle service keytabs and it's rotation?
Thank you.
Stefan
8 months, 3 weeks
