sssd backend not workin on ubuntu 18.04

[Charles Hedrick]

On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it can’t find any DNS
servers. Restarting sssd fixes it.

/etc/resolv.conf is a symlink to ../run/systemd/resolve/stub-resolv.conf

If I replace that with a hardcoded resolv.conf with the right name server, sssd comes up.
Network Manager replaces the file with a different one pointing to nameserver 127.0.0.53,
but after another reboot with that file it still works.

This happens on 4 identical servers, but not on a VM with the same OS. I assume there’s a
timing issue of some sort.

[Andreas Hasenack]

Hello,

On Tue, Aug 13, 2019 at 1:01 PM Charles Hedrick <hedrick(a)rutgers.edu&gt; wrote:
>  On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it can’t find any DNS
> servers. Restarting sssd fixes it. 
Sounds like https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1723350 ?

[Charles Hedrick]

yes, it’s the same thing. The workaround to add a dependency on network up or
systemd-resolved.service work (either one).

A static /etc/resolv.conf also works, but I’m going to use the extra startup dependency.
Probably systemd-resolved.

We didn’t have the problem on a system with static configuration. The one with the problem
uses DHCP.

There’s one other workaround I considered, but can’t make happen. If you install
libnss-resolve, it should use that library rather than depending upon /etc/resolv.conf.
That should avoid the whole issue with /etc/resolv.conf. I can’t try it, because after the
security update, i have a version of systemd for which there’s no version of
libnss-resolve that will install. 

>  On Aug 13, 2019, at 1:02 PM, Andreas Hasenack
> <andreas(a)canonical.com&gt; wrote:
>  
>  Hello,
>  
>  On Tue, Aug 13, 2019 at 1:01 PM Charles Hedrick <hedrick(a)rutgers.edu&gt; wrote:
> > 
> > On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it can’t find any
> DNS servers. Restarting sssd fixes it.
>  
>  Sounds like https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1723350 ?
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[Goetz, Patrick G]

We run stock sssd on a number of Ubuntu 18.04 servers, and I have not 
seen this problem.  Also, I haven't done anything to the out of box DNS 
configuration.  The issue we run in to regularly is that Kerberos 
tickets are not renewed and the machine falls out of the domain, but we 
now think this might be due to a hostname capitalization problem.

On 8/13/19 11:00 AM, Charles Hedrick wrote:
>  On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it
> can’t find any DNS servers. Restarting sssd fixes it.
>  
>  /etc/resolv.conf is a symlink to ../run/systemd/resolve/stub-resolv.conf
>  
>  If I replace that with a hardcoded resolv.conf with the right name server, sssd comes up.
> Network Manager replaces the file with a different one pointing to nameserver 127.0.0.53,
> but after another reboot with that file it still works.
>  
>  This happens on 4 identical servers, but not on a VM with the same OS. I assume there’s a
> timing issue of some sort.
>  
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> >> This message is from an external sender. Learn more about why this <<
> >> matters at https://links.utexas.edu/rtyclf.                        <<
>

[Charles Hedrick]

We have a separate daemon that renews all credentials that are in use. This requires a pam
module to register credentials for renewal. You’re welcome to use it. It’s part of our
kerberos tools at https://github.com/clhedrick/kerberos.

>  On Aug 14, 2019, at 10:33 AM, Goetz, Patrick G
> <pgoetz(a)math.utexas.edu&gt; wrote:
>  
>  We run stock sssd on a number of Ubuntu 18.04 servers, and I have not 
>  seen this problem.  Also, I haven't done anything to the out of box DNS 
>  configuration.  The issue we run in to regularly is that Kerberos 
>  tickets are not renewed and the machine falls out of the domain, but we 
>  now think this might be due to a hostname capitalization problem.
>  
>  On 8/13/19 11:00 AM, Charles Hedrick wrote:
> > On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it can’t find any
> DNS servers. Restarting sssd fixes it.
> > 
> > /etc/resolv.conf is a symlink to ../run/systemd/resolve/stub-resolv.conf
> > 
> > If I replace that with a hardcoded resolv.conf with the right name server, sssd comes
> up. Network Manager replaces the file with a different one pointing to nameserver
> 127.0.0.53, but after another reboot with that file it still works.
> > 
> > This happens on 4 identical servers, but not on a VM with the same OS. I assume
> there’s a timing issue of some sort.
> > 
> > _______________________________________________
> > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> >>> This message is from an external sender. Learn more about why this <<
> >>> matters at https://links.utexas.edu/rtyclf.                        <<
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[Pavel Březina]

On 8/13/19 6:00 PM, Charles Hedrick wrote:
>  On our Ubuntu 18.04 servers, sssd won’t start. Logging shows that it
> can’t find any DNS servers. Restarting sssd fixes it.
>  
>  /etc/resolv.conf is a symlink to ../run/systemd/resolve/stub-resolv.conf
>  
>  If I replace that with a hardcoded resolv.conf with the right name server, sssd comes up.
> Network Manager replaces the file with a different one pointing to nameserver 127.0.0.53,
> but after another reboot with that file it still works.
>  
>  This happens on 4 identical servers, but not on a VM with the same OS. I assume there’s a
> timing issue of some sort. 
I think this PR might help here: https://github.com/SSSD/sssd/pull/864

SSSD did not watch resolv.conf symlinks for changes so if the original 
file did not contains correct DNS server SSSD wouldn't be able to pick 
up the new one after resolv.conf is updated.