June 2020 - Sssd-maintainers - Fedora mailing-lists

[Bug 1850548] New: sssd not renewing/obtaining krb ticket at login
by bugzilla＠redhat.com 30 Jul '20

30 Jul '20

https://bugzilla.redhat.com/show_bug.cgi?id=1850548 Bug ID: 1850548 Summary: sssd not renewing/obtaining krb ticket at login Product: Fedora Version: 32 Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: gwync(a)protonmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Prior to f32, my sssd/krb5 setup allowed login and ensured a current krb5 ticket at login. With f32 it allows login but doesn't obtain or renew a ticket. Manual kinit works fine after login. The only error I see in the logs at the moment at login time is: [dp_target_run_constructor] (0x0010): Target [resolver] constructor failed [95]: Operation not supported -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 14

[Bug 1648521] Regression: sssd sssd-2.0.0-4 slows down autofs - 'getautomntent_r: Invalid argument'
by bugzilla＠redhat.com 19 Jun '20

19 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1648521 --- Comment #29 from W. Michael Petullo <mike(a)flyn.org> --- I found this fixed with Fedora 32. I use Kerberos for authentication and LDAP/NFS/autofs for home directories. Has anyone else had luck? I configured my host with `authselect select sssd --force`. The result, which seems to work fine, follows: # Generated by authselect on Fri Jun 19 16:36:27 2020 # Do not modify this file manually. # If you want to make changes to nsswitch.conf please modify # /etc/authselect/user-nsswitch.conf and run 'authselect apply-changes'. # # Note that your changes may not be applied as they may be # overwritten by selected profile. Maps set in the authselect # profile takes always precedence and overwrites the same maps # set in the user file. Only maps that are not set by the profile # are applied from the user file. # # For example, if the profile sets: # passwd: sss files # and /etc/authselect/user-nsswitch.conf contains: # passwd: files # hosts: files dns # the resulting generated nsswitch.conf will be: # passwd: sss files # from profile # hosts: files dns # from user file passwd: sss files systemd group: sss files systemd netgroup: sss files automount: sss files services: sss files # Included from /etc/authselect/user-nsswitch.conf # # /etc/nsswitch.conf # # Name Service Switch config file. This file should be # sorted with the most-used services at the beginning. # # Valid databases are: aliases, ethers, group, gshadow, hosts, # initgroups, netgroup, networks, passwd, protocols, publickey, # rpc, services, and shadow. # # Valid service provider entries include (in alphabetical order): # # compat Use /etc files plus *_compat pseudo-db # db Use the pre-processed /var/db files # dns Use DNS (Domain Name Service) # files Use the local files in /etc # hesiod Use Hesiod (DNS) for user lookups # nis Use NIS (NIS version 2), also called YP # nisplus Use NIS+ (NIS version 3) # # See `info libc 'NSS Basics'` for more information. # # Commonly used alternative service providers (may need installation): # # ldap Use LDAP directory server # myhostname Use systemd host names # mymachines Use systemd machine names # mdns*, mdns*_minimal Use Avahi mDNS/DNS-SD # resolve Use systemd resolved resolver # sss Use System Security Services Daemon (sssd) # systemd Use systemd for dynamic user option # winbind Use Samba winbind support # wins Use Samba wins support # wrapper Use wrapper module for testing # # Notes: # # 'sssd' performs its own 'files'-based caching, so it should generally # come before 'files'. # # WARNING: Running nscd with a secondary caching service like sssd may # lead to unexpected behaviour, especially with how long # entries are cached. # # Installation instructions: # # To use 'db', install the appropriate package(s) (provide 'makedb' and # libnss_db.so.*), and place the 'db' in front of 'files' for entries # you want to be looked up first in the databases, like this: # # passwd: db files # shadow: db files # group: db files # In order of likelihood of use to accelerate lookup. shadow: files sss hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname aliases: files ethers: files gshadow: files # Allow initgroups to default to the setting for group. # initgroups: files networks: files dns protocols: files publickey: files rpc: files -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1849109] New: 'System error' on login with domain account after system update (online login only)
by bugzilla＠redhat.com 19 Jun '20

19 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1849109 Bug ID: 1849109 Summary: 'System error' on login with domain account after system update (online login only) Product: Fedora Version: 32 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: vargax(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com Target Milestone: --- Group: private Classification: Fedora Created attachment 1698118 --> https://bugzilla.redhat.com/attachment.cgi?id=1698118&action=edit update logs and journalctl output Description of problem: Online login with a domain account is broken after a full update on a Fedora 32 system joined to an Active Directory domain using realm. Offline login (using cached credentials) works. kinit also works. Version-Release number of selected component (if applicable): How reproducible: Allways Steps to Reproduce: 1. Install Fedora 32 2. Join system to AD domain using realm 3. Login with a domain account > Login works 4. Full update the system 5. Try to login with a domain account > Login Fails > System Error 6. Disconnect network 7. Try to login with domain account > Login works Actual results: Online login with domain account fails Expected results: Online login with domain account should works Additional info: Full update log and journalctl logs attached Steps ran on a vanilla Fedora 32 Workstation VM: [ws@localhost-live ~]$ sudo su We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for ws: [root@localhost-live ws]# cd [root@localhost-live ~]# hostnamectl set-hostname --static test-f32-wrks [root@localhost-live ~]# realm join -v --user=cvargasc ad.activarsas.co * Resolving: _ldap._tcp.ad.activarsas.co * Performing LDAP DSE lookup on: 10.11.11.98 * Successfully discovered: ad.activarsas.co Password for cvargasc: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli * LANG=C /usr/sbin/adcli join --verbose --domain ad.activarsas.co --domain-realm AD.ACTIVARSAS.CO --domain-controller 10.11.11.98 --login-type user --login-user cvargasc --stdin-password * Using domain name: ad.activarsas.co * Calculated computer account name from fqdn: TEST-F32-WRKS * Using domain realm: ad.activarsas.co * Sending NetLogon ping to domain controller: 10.11.11.98 * Received NetLogon info from: scandelaria.ad.activarsas.co * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-MkTsc9/krb5.d/adcli-krb5-conf-IqiLw8 * Authenticated as user: cvargasc(a)AD.ACTIVARSAS.CO * Using GSS-SPNEGO for SASL bind * Looked up short domain name: AD * Looked up domain SID: S-1-5-21-490755958-958459292-2945111038 * Using fully qualified name: test-f32-wrks * Using domain name: ad.activarsas.co * Using computer account name: TEST-F32-WRKS * Using domain realm: ad.activarsas.co * Calculated computer account name from fqdn: TEST-F32-WRKS * Generated 120 character computer password * Using keytab: FILE:/etc/krb5.keytab * Found computer account for TEST-F32-WRKS$ at: CN=TEST-F32-WRKS,CN=Computers,DC=ad,DC=activarsas,DC=co * Sending NetLogon ping to domain controller: 10.11.11.98 * Received NetLogon info from: scandelaria.ad.activarsas.co * Set computer password * Retrieved kvno '3' for computer account in directory: CN=TEST-F32-WRKS,CN=Computers,DC=ad,DC=activarsas,DC=co * Checking host/TEST-F32-WRKS * Added host/TEST-F32-WRKS * Checking RestrictedKrbHost/TEST-F32-WRKS * Added RestrictedKrbHost/TEST-F32-WRKS * Discovered which keytab salt to use * Added the entries to the keytab: TEST-F32-WRKS$(a)AD.ACTIVARSAS.CO: FILE:/etc/krb5.keytab * Added the entries to the keytab: host/TEST-F32-WRKS(a)AD.ACTIVARSAS.CO: FILE:/etc/krb5.keytab * Added the entries to the keytab: RestrictedKrbHost/TEST-F32-WRKS(a)AD.ACTIVARSAS.CO: FILE:/etc/krb5.keytab * /usr/bin/systemctl enable sssd.service * /usr/bin/systemctl restart sssd.service * /usr/bin/sh -c /usr/bin/authselect select sssd with-mkhomedir --force && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service Backup stored at /var/lib/authselect/backups/2020-06-19-15-17-49.nmhfmX Profile "sssd" was selected. The following nsswitch maps are overwritten by the profile: - passwd - group - netgroup - automount - services Make sure that SSSD service is configured and enabled. See SSSD documentation for more information. - with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module is present and oddjobd service is enabled and active - systemctl enable --now oddjobd.service Created symlink /etc/systemd/system/multi-user.target.wants/oddjobd.service → /usr/lib/systemd/system/oddjobd.service. * Successfully enrolled machine in realm [root@localhost-live ~]# sed -i 's&%u@%d&%u&g' /etc/sssd/sssd.conf [root@localhost-live ~]# sed -i 's&use_fully_qualified_names = True&use_fully_qualified_names = False&g' /etc/sssd/sssd.conf [root@localhost-live ~]# cat >> /etc/sssd/sssd.conf <<EOF > auto_private_groups = true > EOF [root@localhost-live ~]# systemctl restart sssd.service [root@localhost-live ~]# echo "%domain\ admins ALL=(ALL) ALL" > /etc/sudoers.d/domain-admins [root@localhost-live ~]# exit exit [ws@localhost-live ~]$ su cvargasc Password: [cvargasc@test-f32-wrks ws]$ cd [cvargasc@test-f32-wrks ~]$ sudo dnf update We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for cvargasc: (...full update log attached...) Complete! [cvargasc@test-f32-wrks ~]$ exit exit [ws@localhost-live ~]$ su cvargasc Password: su: System error [ws@localhost-live ~]$ nmcli connection down Wired\ connection\ 1 Connection 'Wired connection 1' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1) [ws@localhost-live ~]$ su cvargasc Password: [cvargasc@test-f32-wrks ws]$ exit [ws@localhost-live ~]$ nmcli connection up Wired\ connection\ 1 Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/2) [ws@localhost-live ~]$ su lpguerreroj Password: su: System error [ws@localhost-live ~]$ nmcli connection down Wired\ connection\ 1 Connection 'Wired connection 1' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1) [ws@localhost-live ~]$ su lpguerreroj Password: [lpguerreroj@test-f32-wrks ws]$ -- You are receiving this mail because: You are the assignee for the bug.

1 4

[Bug 1648521] Regression: sssd sssd-2.0.0-4 slows down autofs - 'getautomntent_r: Invalid argument'
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1648521 --- Comment #28 from rob.verduijn(a)gmail.com --- Hello all, I've got weird autofs/sssd errors as well. I still have them with a centos8.2 ipa server using a fedora32 ipaclient. I've build a reproducer in vagrant. To use it, install vagrant on a fedora32 host. Configure the host for kvm virtualization. create an empty directory, - mkdir vagrant put the Vagrant script in that dir cd to that dir check the script if the DOMAIN_URI var is ok give the command : vagrant up wait for a long time for the script to finish when the script is finished: log in to the fedoraclient with vagrant: vagrant ssh fedoraclient become root: sudo -i check to see if the home directory is mounted: mount it will claim to be active however a directory listing will show the home folder of the user test is missing: ls -als /home restart autofs: systemctl restart autofs and now the home dir is mounted, list the home dir: ls -als /home and you will see the test user home dir. if for some reason the mount is working the first time, run the reproducer script as root /root/reproducer.sh and try again after the reboot. Cheers Rob -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1648521] Regression: sssd sssd-2.0.0-4 slows down autofs - 'getautomntent_r: Invalid argument'
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1648521 --- Comment #27 from rob.verduijn(a)gmail.com --- Created attachment 1697980 --> https://bugzilla.redhat.com/attachment.cgi?id=1697980&action=edit vagrant script for reproducer -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1644919] First(?) login as FreeIPA domain user takes longer with sssd-2.0.0-4.fc29 (38 seconds vs. 3 seconds)
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1644919 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo | |raproject.org --- Comment #28 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1615701] Authentication failed if I type in the wrong password once
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1615701 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo | |raproject.org --- Comment #12 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1785229] Auth fails with "Could not start TLS encryption. unknown error"
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1785229 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo | |raproject.org --- Comment #19 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1676961] sss_cache ignores effective uid
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1676961 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo | |raproject.org --- Comment #3 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1669607] sssd: sssd-kcm does not appear to expire Kerberos tickets
by bugzilla＠redhat.com 18 Jun '20

18 Jun '20

https://bugzilla.redhat.com/show_bug.cgi?id=1669607 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mzidek(a)redhat.com |sssd-maintainers(a)lists.fedo | |raproject.org --- Comment #9 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug.

1 0

2024

2023

2022

2021

2020

Sssd-maintainers June 2020