sssd-users

sssd-users@lists.fedorahosted.org

1 participants
1832 discussions

password and otp validation in SSSD offline authentication mode
by seojeong kim 22 Nov '24

22 Nov '24

If I enable multi factor prompt for SSSD offline authentication, I see like below. First Factor: Second Factor: but i have a question about the following case. When I put input like below, it also authenticates user. First Factor: pwd+otp Second Factor: pwd+otp So, I can tell if it's working normally?

2 7

In which PAM phase are the UID/GID in AD required?
by Spike White 20 Nov '24

20 Nov '24

Sssd experts, We have an app that’s having AD users connect to their app -- users that don’t have UIDs and GIDs stored in AD. They’re allowing these remote connections for DB queries and our cybersecurity team wants to see the username/ip addresses from which these queries originate. That is, the app team has this. In /etc/pam.d/krb5 file: auth sufficient /usr/lib64/security/pam_krb5.so no_user_check realm= APAC.COMPANY.COM try_first_pass auth sufficient /usr/lib64/security/pam_krb5.so no_user_check realm= EMEA.COMPANY.COM try_first_pass auth sufficient /usr/lib64/security/pam_krb5.so no_user_check realm= AMER.COMPANY.COM use_first_pass Our company has 3 regional AD domains. AMER, EMEA, APAC. Here’s the logs from /var/log/secure. Cybersecurity is happy with these logs, because they give the incoming AD account and the remote IP address. Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:auth): unknown option no_user_check Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:auth): authentication failure; logname=karunakanti_chiranje uid=7202893 euid=7202893 tty= ruser= rhost=10.107.18.78 Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:auth): unknown option no_user_check Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:auth): authentication failure; logname=karunakanti_chiranje uid=7202893 euid=7202893 tty= ruser= rhost=10.107.18.78 Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:auth): unknown option no_user_check Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:auth): user karunakanti_chiranje authenticated as karunakanti_chiranje(a)AMER.COMPANY.COM Nov 19 07:17:26 cepnlmemf01 memsqld[159234]: pam_krb5(krb5:account): unknown option no_user_check This approach is functional, but has several drawbacks. 1. If the incoming user is in AMER, this login will fail twice (APAC, EMEA), then finally succeed for user(a)AMER.COMPANY.COM 2. Pam_krb5 has no caching, so every DB query results in hitting the AD domain controllers. (Multiple times, if user in EMEA or AMER). We’re using pam_sss successfully for ssh logins. It works great! With the caveat that all AD users and groups have to have a UID and GID. Otherwise the AD user cannot login via ssh. They have to be realm permitted also (usually by group). Can the above pam file be replaced by similar pam_sss.so invocations? I.e., at which PAM phase is the UID and GID required? Is it required in the auth phase? Account phase? Or only in the session phase? Spike

2 1

sssd - ssh prompt
by seojeong kim 19 Nov '24

19 Nov '24

seojeong.kim is a 2fa user. so, I can see prompt is like below. but the current max failure attempt is 4. so after I have 4 times failed attempts, ssh prompt changes to Password : Is this normal working? Can I keep First Factor/Second Factor prompt for 2fa user even when failure attempts reach to the max count ? (seojeong.kim@myhost) First Factor: (seojeong.kim@myhost) Second Factor: (seojeong.kim@myhost) First Factor: (seojeong.kim@myhost) Second Factor: (seojeong.kim@myhost) First Factor: (seojeong.kim@myhost) Second Factor: (seojeong.kim@myhost) First Factor: (seojeong.kim@myhost) Second Factor: (seojeong.kim@myhost) First Factor: (seojeong.kim@myhost) Password : /etc/sssd/sssd.conf is like below. [prompting/password] password_prompt = Password : [prompting/2fa] single_prompt = False first_prompt = First Factor: second_prompt = Second Factor:

2 2

Should ad_use_ldaps need additional work/settings to support LDAPS?
by Kodiak Firesmith 14 Nov '24

14 Nov '24

Hi Folks, We need to start using LDAPS rather than non-TLS LDAP in our SSSD AD environment. I only have a single AD domain so I can't test with other domains to see if the problem is on the SSSD client side or AD server side. When we set ad_use_ldaps = True, we lose enumeration, and regardless of debug level, all we see related to the issue is the following: Nov 13 14:28:37 u20-test.college.edu sssd_be[125884]: Could not start TLS encryption. Error in the pull function. Nov 13 14:28:37 u20-test.college.edu sssd_be[125884]: Could not start TLS encryption. Error in the pull function. Nov 13 14:28:37 u20-test.college.edu sssd_be[125884]: Backend is offline Documentation is a bit scant, which led me to believe that this would be a simple matter of setting a single setting, but this didn't work out. After that I poked around on the internet and ended up trying the following additional sssd.conf settings: ldap_id_use_start_tls = False ldap_uri = ldaps://ad1.college.edu,ldaps://ad2.college.edu ldap_tls_cacert = /etc/sssd/certs/ad_ca.pem Unfortunately this resulted in the same error. When googling around for the specific error, there were no exact matches which makes me think I've encountered something sort of rare. I've been able to infer from searching that Error in the pull function. is an error message from GnuTLS which I assume SSSD wraps for LDAPS, but there are no hits for the full error message above with the sssd_be syslog label. The AD environment is 2016, the client is a Ubuntu 20.04 LTS system. The versions in use are requirements of the environment and I am unable to test against newer releases. I hesitate to mention it in case it creates false leads, but the system is largely compliant with the DoD MAC-1 Classified STIG, with all of the controls that brings over. Surprisingly there were no controls that directly affected SSSD or any LDAP libraries, and we're not enforcing FIPS validated cryptographic modules so it's unlikely due to STIG controls IMO. Questions: - Under normal circumstances, should the ad_use_ldaps setting be all we need for this to "just work"? - Any ideas what we might be able to try in order to further root out the issue? Thanks! - Kodiak Sent with [Proton Mail](https://proton.me/mail/home) secure email.

3 3

Nuisance-level extraneous logging in /var/log/sssd/krb5_child.log file. How to suppress?
by Spike White 24 Oct '24

24 Oct '24

All, This is not a problem. But it is annoying; how do I make it go away? Every time any user logs into any of our Linux servers, we get these messages in the /var/log/sssd/krb5_child.log file: (2024-07-23 11:20:44): [krb5_child[947088]] [main] (0x3f7c0): [RID#26239] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x3f7c0): [RID#27336] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] krb5_child started. * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x1000): [RID#27336] total buffer size: [92] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] cmd [249 (pre-auth)] uid [2025431] gid [2025431] validate [false] enterprise principal [true] offline [false] UPN [ AdmSpike_White(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [unpack_buffer] (0x0100): [RID#27336] ccname: [KCM:] old_ccname: [KCM:] keytab: [not set] * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] Missing krb5_keytab option for domain, looking for default one * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_kt_default_name() returned: FILE:/etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_keytab_name] (0x0400): [RID#27336] krb5_child will default to: /etc/krb5.keytab * (2024-07-23 14:14:10): [krb5_child[970533]] [check_use_fast] (0x0100): [RID#27336] Not using FAST. * (2024-07-23 14:14:10): [krb5_child[970533]] [become_user] (0x0200): [RID#27336] Trying to become user [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x2000): [RID#27336] Running as [2025431][2025431]. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific renewable lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_lifetime_options] (0x0100): [RID#27336] No specific lifetime requested. * (2024-07-23 14:14:10): [krb5_child[970533]] [set_canonicalize_option] (0x0100): [RID#27336] Canonicalization is set to [true] * (2024-07-23 14:14:10): [krb5_child[970533]] [main] (0x0400): [RID#27336] Will perform pre-auth * (2024-07-23 14:14:10): [krb5_child[970533]] [tgt_req_child] (0x1000): [RID#27336] Attempting to get a TGT * (2024-07-23 14:14:10): [krb5_child[970533]] [get_and_save_tgt] (0x0400): [RID#27336] Attempting kinit for realm [AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_responder] (0x4000): [RID#27336] Got question [password]. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] sss_krb5_prompter name [(null)] banner [(null)] num_prompts [1] EINVAL. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x4000): [RID#27336] Prompt [0][Password for AdmSpike_White\@ AMER.COMPANY.COM(a)AMER.COMPANY.COM] * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_prompter] (0x0200): [RID#27336] Prompter interface isn't used for password prompts by SSSD. * (2024-07-23 14:14:10): [krb5_child[970533]] [sss_krb5_get_init_creds_password] (0x0020): [RID#27336] 2193: [-1765328174][Pre-authentication failed: Cannot read password] ********************** BACKTRACE DUMP ENDS HERE ********************************* (2024-07-23 14:14:10): [krb5_child[970534]] [main] (0x3f7c0): [RID#27337] PAC check is requested but krb5_validate is set to false. PAC checks will be skipped. We’re ok with the krb5_validate message. We set: krb5_validate = False in /etc/sssd/sssd.conf file because KVNO of host principal gets out of sync between AD and /etc/krb5.keytab file frequently. So we’re comfortable with that one line of logging. It’s all the rest of the logging that we’d prefer not to see. How do we suppress them or eradicate the underlying condition that leads to them appearing? Here is our sssd.conf file. [nss] debug_backtrace_enabled = false #debug_level = 9 filter_groups = root mfe bladelogic_linux_users(a)amer.company.com bladelogic_linux_users(a)emea.company.com bladelogic_linux_users(a)apac.company.com bladelogic_linux_users(a)japn.company.com bladelogic_linux_users(a)company.com oracle filter_users = root mfe oracle [sssd] debug_backtrace_enabled = false #debug_level = 9 domains = amer.company.com domain_resolution_order = amer.company.com, emea.company.com, apac.company.com, japn.company.com, company.com config_file_version = 2 services = nss,pam,ifp reconnection_retries = 3 full_name_format = %1$s [pam] pam_verbosity = 3 #debug_level = 9 offline_credentials_expiration = 3 [ifp] #debug_level = 9 [domain/amer.company.com] filter_groups = root mfe bladelogic_linux_users oracle sudo_provider = none debug_backtrace_enabled = false #debug_level = 9 ad_enabled_domains = company.com, amer.company.com, apac.company.com, emea.company.com, japn.company.com ad_enabled_domains = amer.company.com, apac.company.com, emea.company.com, japn.company.com, company.com # If you enable ignore_group_members, it gives a small perf win, but then # "getent group XXX" shows no members. Perf win not worth the lack of # diagnostics. #ignore_group_members = true id_provider = ad access_provider = simple auth_provider = ad default_shell = /bin/bash ldap_id_mapping = False auto_private_groups = True realmd_tags = joined-with-adcli cache_credentials = True # Not set to true; Passwords stored in this way are kept in plaintext in the kernel keyring and are potentially accessible by the root user (with difficulty). #krb5_store_password_if_offline = True fallback_homedir = /home/%u ldap_sasl_authid = host/austgcore17.us.company.com(a)AMER.COMPANY.COM dyndns_update = False # Using tokengroups is usually a speed optimization #ldap_use_tokengroups = False ldap_search_base = dc=AMER,dc=COMPANY,dc=COM ldap_force_upper_case_realm = True # Set to False, because KVNO of host principal gets out of sync between # AD and /etc/krb5.keytab file frequently. krb5_validate = False simple_allow_groups = amerlinuxsup(a)amer.company.com, amerlinuxeng(a)amer.company.com, emealinuxsup(a)emea.company.com, emealinuxeng(a)emea.company.com, apaclinuxsup(a)apac.company.com, apaclinuxeng(a)apac.company.com, gbllinuxsuppw(a)amer.company.com, bladelogic_linux_users(a)amer.company.com, PRD-1004873-AMER-DBSPOTUNIX(a)amer.company.com, pptsupportpac(a)amer.company.com, unv_legato_admins(a)amer.company.com, scheduling_global(a)amer.company.com, engit-ebpa(a)amer.company.com, amerlinuxengtfssupt(a)amer.company.com, amerlnxsvcdelauttfs(a)apac.company.com, iasnprod(a)amer.company.com, fnms_ops(a)amer.company.com, zabbix-support(a)amer.company.com, globalinfosecopsadm(a)amer.company.com, prd-amer-fnmsopspac(a)amer.company.com, amerlinuxeng simple_allow_users = processehcprofiler(a)amer.company.com, svc_prdautovm(a)amer.company.com, processfoglight(a)amer.company.com, svc_prdprofoglight01(a)amer.company.com, service_ome_linux(a)amer.company.com, svc_prdesquadscounix(a)apac.company.com, serviceunixinstall(a)amer.company.com, admspike_white, oracle # look at https://docs.pagure.org/SSSD.sssd/design_pages/subdomain_configuration.html [domain/amer.company.com/company.com] ldap_search_base = dc=COMPANY,dc=COM [domain/amer.company.com/apac.company.com] ldap_search_base = dc=APAC,dc=COMPANY,dc=COM [domain/amer.company.com/emea.company.com] ldap_search_base = dc=EMEA,dc=COMPANY,dc=COM [domain/amer.company.com/japn.company.com] ldap_search_base = dc=JAPN,dc=COMPANY,dc=COM

2 11

How to notice/check SSSD is currently offline.
by seojeong kim 23 Oct '24

23 Oct '24

I didn't applied debug_level in sssd. so I can't get the status of SSSD from sssd_mydomain.log. Instead, I'm checking if SSSD is offline or not by the following command. netstat -nap | grep 389 | grep ESTABLISHED | wc -l if it's 0 then SSSD is currently offline. I wonder this way is right to check if SSSD is offline or not.. Is there any other port related to SSSD offline ? or any command to check SSSD offline ?

2 2

How to configure multi prompt even in SSSD offline mode
by seojeong kim 21 Oct '24

21 Oct '24

here is my sssd.conf [domain/mydomain.com] filter_users=root,ubuntu,ec2-user,centos filter_groups=root,ubuntu,ec2-user,centos offline_timeout = 60 ignore_group_members = true cache_credentials = true krb5_store_password_if_offline = True ipa_hbac_refresh = 60 auth_provider = ipa access_provider = ipa chpass_provider = ipa sudo_provider = ipa dns_discovery_domain = mydomain.com ldap_tls_cacert = /etc/ipa/ca.crt ldap_sudo_use_host_filter = false ldap_sudo_refresh_enabled = true ldap_sudo_full_refresh_interval=86400 ldap_sudo_smart_refresh_interval=200 ldap_sudo_search_base = ou=sudoers,dc=mydomain,dc=com?subtree?(|(sudoHost=ip-10-10-247-202-3456.ipa-dev)(sudoHost=+.svc_ipa-dev*)(sudoHost=ALL)) ldap_connection_expire_timeout = 87473 entry_cache_timeout = 172800 krb5_auth_timeout = 30 debug_level = 9 [sssd] reconnection_retries = 3 config_file_version = 2 services = nss, sudo, pam, ssh domains = mydomain.com debug_level = 9 [nss] homedir_substring = /home debug_level = 9 [pam] debug_level = 9 [sudo] debug_level = 9 [autofs] [ssh] debug_level = 9 [pac] [ifp] [secrets] [session_recording] [prompting/password] password_prompt = Password : [prompting/2fa] single_prompt = False first_prompt = First Factor: second_prompt = Second Factor: When SSSD is online, ssh prompt for 2fa user asks like below. First Factor: Second Factor: but if SSSD goes to offline, ssh prompt asks only password like password : How can I configure to get multi prompt asking for 2fa user even in SSSD offline mode? Of course, otp validation will be ignored even though user inputs otp. I just want to keep multi prompt even in both SSSD online and SSSD offline. Is it possible to be configured ?

2 1

[SSSD] Announcing SSSD 2.10.0
by Pavel Březina 15 Oct '24

15 Oct '24

# SSSD 2.10.0-beta2 The SSSD team is announcing the release of version 2.10.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.10.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.10.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.10.0 Release Notes ## Highlights ### General information * **IMPORTANT note for downstream maintainers!** This release features significant improvements of "running with less privileges (under unprivileged service user)" feature. There is still a `./configure` option `--with-sssd-user=` available that allows downstream package maintainers to choose if support of non-root service user should be built. In case such support is built, a preferred way to configure service user is simply by starting SSSD under this user; for example, using `User=/Group=` options of systemd sssd.service file. Upstream defaults are to build `--with-sssd-user=sssd` and to install systemd service with `User=/Group=sssd`. In this case, only several helper processes - `ldap_child`, `krb5_child` and `selinux_child` - are executed with elevated capabilities (that are now granted using fine grained file capabilities instead of SUID bit). All other SSSD components run without any capabilities. In this scenario it's still possible to re-configure SSSD to run under `root` (if needed for some reason): besides changing `User/Group=` options, some other tweaks of systemd service files are required. A legacy method to configure a service user - sssd.conf `user` option - is now deprecated and its support isn’t built by default. It can be enabled using `--with-conf-service-user-support` `./configure` option if needed (for example, due to backward compatibility requirements of stable releases). Further, no matter if SSSD is built `--with-sssd-user=sssd` or `--with-sssd-user=root`, when it's configured to run under `root` (in both cases) it still runs without capabilities, the same way as when it's configured to run under `sssd` user. The only difference is from the DAC perspective. Important note: owner of `/etc/sssd/sssd.conf` file (and snippets) should match the user configured to start SSSD service. Upstream spec file and service files change ownership of existing `sssd.conf` to sssd during package installation and at runtime for seamless upgrades / transition period only. Additionally, this release fixes a large number of issues with "socket activation of responders" feature, making it operable out-of-the-box when the package is built `--with-sssd-user=sssd`. Please take a note, that user configured to run main sssd.service and socket activated responders (if used) should match (i.e. if sssd.service is re-configured from upstream defaults to `root` then responders services also should be re-configured). Downstream package maintainers are advised to carefully inspect changes in `contrib/sssd.spec.in`, `src/sysv/systemd/*` and `./configure` options that this release brings! * sssctl `cache-upgrade` command was removed. SSSD performs automatic upgrades at startup when needed. * Support of `enumeration` feature (i.e. ability to list all users/groups using `getent passwd/group` without argument) for AD/IPA providers is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-extended-enumeration-support` ./configure option. * A number of minor glitches of `sssd-2.10.0-beta1` around building and packaging were fixed. ### New features * The new tool `sss_ssh_knownhosts` can be used with ssh's `KnownHostsCommand` configuration option to retrieve the host's public keys from a remote server (FreeIPA, LDAP, etc.). This new tool, which is more reliable, replaces `sss_ssh_knownhostsproxy`. The latter is no longer built by default, but its build can be forced with the `./configure` option `--with-ssh-known-hosts-proxy`. ### Packaging changes * Building SSSD now unconditionally requires availability of `ucred`/ `SO_PEERCRED` to enforce certain security checks at runtime (see `man 7 unix` for details). * SSSD now requires `libini` not older than v1.3 * Explicit `--with-semanage` ./configure switch was removed, going forward `--with-selinux` includes this. * `sssd_pam` binary lost public `rx` bits and got `cap_dac_read_search=p` file capability to be able to use GSSAPI * Support of OpenSSL older than 1.0.1 was dropped * Support of `--without-infopipe` `./configure` option was dropped. Feature is long time out of experimental state. Since building it doesn't require any additional dependencies, there is not much sense to keep option available. Those who not interested in feature can skip installing sssd-ifp sub-package. ### Configuration changes * Default `ldap_id_use_start_tls` value changed from `false` to `true` for improved security. * Added a `ldap_use_ppolicy` option for backends with broken ppolicy extension handling. * Obsolete `config_file_version` option was removed. * Option `reconnection_retries` was removed since it is no longer used. SSSD switch to a new architecte of internal IPC between SSSD processes where responders do not connect to backend anymore and therefore this option is no longer used.

1 0

How to tell which AD group membership conferred login?
by Spike White 02 Oct '24

02 Oct '24

All, I know sssctl user-checks <user> will tell you whether this account is conferred login or not. You're looking for line: pam_acct_mgmt: Success Is there a utility (or some verbose output on sssctl user-checks) that tells you membership in which group is conferring you access? I know a commercial product where the equivalent login test outputs something like this: [root@gordita root]# vastool user checkaccess admben_lee Access allowed. (RULE ALLOWING: membership in group gbllinuxsup) Particularly with nested subgroups (bad practice I know) and a user member of 10 - 12 AD groups, it's often a challenge to chase which group membership is allowing login. Do the sssd logs in debug level 9 give this info? I just tried this, running sssctl user-checks against myself. I just checked the sssd logs and it says I'm a member of 110 supplemental AD groups! (Luckily not all are UNIX-enabled, so cannot confer me login access).. I see this in the sssd logs: (2024-10-02 10:22:53): [be[amer.company.com]] [simple_check_groups] (0x4000): [RID#2] Checking against allow list group name [ amerlinuxsup(a)amer.company.com] (2024-10-02 10:22:53): [be[amer.company.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain amer.company.com is Active (2024-10-02 10:22:53): [be[amer.company.com]] [simple_check_groups] (0x4000): [RID#2] Checking against allow list group name [ amerlinuxeng(a)amer.company.com] (2024-10-02 10:22:53): [be[amer.company.com]] [sss_domain_get_state] (0x1000): [RID#2] Domain amer.company.com is Active (2024-10-02 10:22:53): [be[amer.company.com]] [simple_check_groups] (0x1000): [RID#2] Group [AmerLinuxEng(a)amer.company.com] found in allow list, access granted. (2024-10-02 10:22:53): [be[amer.company.com]] [simple_access_check_done] (0x2000): [RID#2] Group check done (2024-10-02 10:22:53): [be[amer.company.com]] [simple_access_check_recv] (0x1000): [RID#2] Access granted So it's in the sssd logs. Is there a simpler command that will give this same info? Spike White

1 0

devcontainer
by Ryan Slominski 01 Oct '24

01 Oct '24

Hi, I'm looking for tips on building sssd in a devcontainer. The simplest naive thing: https://github.com/slominskir/sssd-devcontainer/blob/main/Dockerfile ```Dockerfile FROM fedora:40 RUN dnf install 'dnf-command(builddep)' tini git -y ; dnf builddep sssd -y ENTRYPOINT ["/usr/bin/tini", "--"] CMD ["sleep", "infinity"] ``` Configure step fails with: checking for CAP... no configure: error: libcap is missing Ran with: docker build . -t dev docker run --rm --name dev dev docker exec -it dev bash cd /opt git clone https://github.com/SSSD/sssd cd sssd autoreconf -if ./configure Regards, Ryan

4 7

← Newer
1
2
3
4
5
6
7
...
184
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users