November 2021 - Sssd-maintainers - Fedora mailing-lists

[Bug 1965818] New: sssd - failing on "dotted"languages (Example turkish language)
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=1965818 Bug ID: 1965818 Summary: sssd - failing on "dotted"languages (Example turkish language) Product: Fedora Version: 34 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: thunderbirdtr(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, luk.claes(a)gmail.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: Hello, SSSD Service isn't starting If we use dotted language in our system. For example, adding "LANG=tr_TR" into "/etc/sysconfig/sssd" makes sssd fails on start. If anyone install Fedora with "turkish" or other dotted language in their pc/laptop, that makes sssd fails on start. After I made little bit research, I notice this issue has been addressed multiple times around RHEL[0] and samba[1] and github[2] as well. So for that reason at least can we add "english" locale setting into rpm spec with "language" check as a workaround has been suggest in github link.That is at least gives us "working" package in dotted languge, and If anyone wants change setting, they can change it. At least for normal users, we can have working sssd service and not complain about fails all the times. I know this isn't the cleanest solution (proper solution is patching libldb package which causing this issue, but at least we can have a "quick&dirty" solution avoid on new installs. Thank you. [0] : https://bugzilla.redhat.com/show_bug.cgi?id=1743531 [1] : https://lists.samba.org/archive/samba-technical/2019-December/134659.html [2] : https://github.com/SSSD/sssd/issues/5285 Version-Release number of selected component (if applicable): sssd-2.5.0-2.fc34.x86_64 libldb-2.3.0-2.fc34.x86_64 How reproducible: Steps to Reproduce: 1. Install Fedora or change language into dotted or change "LANG" env into dotted langauge 2. reset sssd counter 3. start sssd Actual results: sssd fails Expected results: sssd should start clean in default config. Additional info: SSSD Systemctl errors systemd[1]: Starting System Security Services Daemon... sssd[760632]: Starting up systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION systemd[1]: sssd.service: Failed with result 'exit-code'. systemd[1]: Failed to start System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' systemd[1]: sssd.service: Scheduled restart job, restart counter is at 1. systemd[1]: Stopped System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' systemd[1]: Starting System Security Services Daemon... sssd[760633]: Starting up systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION systemd[1]: sssd.service: Failed with result 'exit-code'. systemd[1]: Failed to start System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' systemd[1]: sssd.service: Scheduled restart job, restart counter is at 2. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' systemd[1]: Stopped System Security Services Daemon. systemd[1]: Starting System Security Services Daemon... sssd[760636]: Starting up systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION systemd[1]: sssd.service: Failed with result 'exit-code'. systemd[1]: Failed to start System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' systemd[1]: sssd.service: Scheduled restart job, restart counter is at 3. systemd[1]: Stopped System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' systemd[1]: Starting System Security Services Daemon... sssd[760637]: Starting up systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION systemd[1]: sssd.service: Failed with result 'exit-code'. systemd[1]: Failed to start System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' systemd[1]: sssd.service: Scheduled restart job, restart counter is at 4. systemd[1]: Stopped System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' systemd[1]: Starting System Security Services Daemon... sssd[760639]: Starting up systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION systemd[1]: sssd.service: Failed with result 'exit-code'. systemd[1]: Failed to start System Security Services Daemon. audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' ----------- /var/log/sssd/sssd.log (last error with LANG setting is tr_TR (LANG=tr_TR) ) ----------- ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2021-05-30 15:46:52): [sssd] [check_file] (0x0400): lstat for [/run/sssd.pid] failed: [2][No such file or directory]. * (2021-05-30 15:46:52): [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed: [2][No such file or directory]. * (2021-05-30 15:46:52): [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! * (2021-05-30 15:46:52): [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf. * (2021-05-30 15:46:52): [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf does not exist. * (2021-05-30 15:46:52): [sssd] [confdb_ldif_from_ini_file] (0x0100): Value of config_file_version option not found. Assumed to be version 2. * (2021-05-30 15:46:52): [sssd] [sss_confdb_create_ldif] (0x0400): Processing config section [sssd] * (2021-05-30 15:46:52): [sssd] [sss_confdb_create_ldif] (0x0400): Processing attribute [services] * (2021-05-30 15:46:52): [sssd] [sss_confdb_create_ldif] (0x4000): services: nss * (2021-05-30 15:46:52): [sssd] [sss_confdb_create_ldif] (0x4000): Section dn dn: cn=sssd,cn=config cn: sssd services: nss * (2021-05-30 15:46:52): [sssd] [confdb_init_db] (0x0100): LDIF file to import: dn: cn=config version: 2 dn: cn=sssd,cn=config cn: sssd services: nss * (2021-05-30 15:46:52): [sssd] [add_implicit_services] (0x0040): No domains configured! * (2021-05-30 15:46:52): [sssd] [get_monitor_config] (0x0040): Failed to add implicit configured services. Some functionality might be missing * (2021-05-30 15:46:53): [sssd] [confdb_expand_app_domains] (0x2000): implicit_files is not an app domain * (2021-05-30 15:46:53): [sssd] [confdb_get_domain_internal] (0x0400): No enumeration for [implicit_files]! * (2021-05-30 15:46:53): [sssd] [confdb_get_domain_internal] (0x0400): Please note that when enumeration is disabled `getent passwd` does not return all users by design. See sssd.conf man page for more detailed information * (2021-05-30 15:46:53): [sssd] [confdb_get_domain_internal] (0x1000): pwd_expiration_warning is -1 * (2021-05-30 15:46:53): [sssd] [server_setup] (0x0080): Failed setting process group: Operation not permitted[1]. We might leak processes in case of failure * (2021-05-30 15:46:53): [sssd] [become_user] (0x0200): Trying to become user [0][0]. * (2021-05-30 15:46:53): [sssd] [become_user] (0x0200): Already user [0]. * (2021-05-30 15:46:53): [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse! * (2021-05-30 15:46:53): [sssd] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb * (2021-05-30 15:46:53): [sssd] [confdb_get_enabled_domain_list] (0x0040): Failed to get [domains] from [sssd], error [2] (Böyle bir dosya ya da dizin yok) ********************** BACKTRACE DUMP ENDS HERE ********************************* (2021-05-30 15:46:53): [sssd] [main] (0x0010): No domains configured. ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2021-05-30 15:46:53): [sssd] [confdb_get_domains] (0x0080): No domains configured, fatal error! * (2021-05-30 15:46:53): [sssd] [main] (0x0010): No domains configured. ********************** BACKTRACE DUMP ENDS HERE ********************************* -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 8

[Bug 1995608] New: sssd logging verbose by default results in huge log files
by bugzilla＠redhat.com 14 Mar '22

14 Mar '22

https://bugzilla.redhat.com/show_bug.cgi?id=1995608 Bug ID: 1995608 Summary: sssd logging verbose by default results in huge log files Product: Fedora Version: 34 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Severity: urgent Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: brian(a)interlinx.bc.ca QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, luk.claes(a)gmail.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Created attachment 1815664 --> https://bugzilla.redhat.com/attachment.cgi?id=1815664&action=edit Example log spew Description of problem: My /var/log/sssd/sssd_$domain.log grows huge. Version-Release number of selected component (if applicable): sssd-2.5.2-2.fc34.x86_64 How reproducible: 100% Steps to Reproduce: Should pretty obvious. Actual results: Log grows large with useless debug info. Expected results: Log should not grow as quick and large as it does. Additional info: Every minute a spew similar to the attachment is added to the log. I can squelch this log spam with: # sssctl debug-level 0 Neither the words debug or log even appear in my configuration: # grep -ri -e debug -e log /etc/sssd/ [nothing] so this is appearing to be a rather verbose default setting. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 11

[Bug 1927907] New: Latest release sssd 2.4.1 hard requires Python 3
by bugzilla＠redhat.com 14 Mar '22

14 Mar '22

https://bugzilla.redhat.com/show_bug.cgi?id=1927907 Bug ID: 1927907 Summary: Latest release sssd 2.4.1 hard requires Python 3 Product: Fedora Version: 34 Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: jlebon(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: It seems since the 2.4.1 rebase (https://src.fedoraproject.org/rpms/sssd/c/9e5dd4b66572aeb348f3cc854ce7fca9f…), sssd now pulls in python3 because it changed python3-sssdconfig from a "Suggests" to a "Requires". In Fedora CoreOS, we're trying to avoid shipping Python entirely to encourage containerizing user workloads and to keep the OS minimal. In a rawhide and f34 build, this package was identified as pulling it back in. Would it be possible to make it a weak dep again? This would also be useful in other environments like containers and custom OS builds which value minimalism. We can help with that if there's agreement. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 10

[Bug 1964333] New: Running scriptlet: sssd-common-2.4.2-2.fc33.x86_64 during update results in failed service restart messages
by bugzilla＠redhat.com 25 Feb '22

25 Feb '22

https://bugzilla.redhat.com/show_bug.cgi?id=1964333 Bug ID: 1964333 Summary: Running scriptlet: sssd-common-2.4.2-2.fc33.x86_64 during update results in failed service restart messages Product: Fedora Version: 33 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: setha45(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, luk.claes(a)gmail.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: dnf update of ssd-common resulted in errors from service restarts Version-Release number of selected component (if applicable): 2.4.2-2.fc33.x86_64 How reproducible: unknown if it happens again; presumeably the next dnf update would have similar results Steps to Reproduce: 1. dnf update 2. watch output 3. Actual results: I get the following messages Running scriptlet: sssd-common-2.4.2-2.fc33.x86_64 207/307 Failed to try-restart sssd-autofs.service: Operation refused, unit sssd-autofs.service may be requested by dependency only (it is configured to refuse manual start/stop). See system logs and 'systemctl status sssd-autofs.service' for details. Failed to try-restart sssd-nss.service: Operation refused, unit sssd-nss.service may be requested by dependency only (it is configured to refuse manual start/stop). See system logs and 'systemctl status sssd-nss.service' for details. Failed to try-restart sssd-pac.service: Operation refused, unit sssd-pac.service may be requested by dependency only (it is configured to refuse manual start/stop). See system logs and 'systemctl status sssd-pac.service' for details. Failed to try-restart sssd-pam.service: Operation refused, unit sssd-pam.service may be requested by dependency only (it is configured to refuse manual start/stop). See system logs and 'systemctl status sssd-pam.service' for details. Failed to try-restart sssd-ssh.service: Operation refused, unit sssd-ssh.service may be requested by dependency only (it is configured to refuse manual start/stop). See system logs and 'systemctl status sssd-ssh.service' for details. Failed to try-restart sssd-sudo.service: Operation refused, unit sssd-sudo.service may be requested by dependency only (it is configured to refuse manual start/stop). See system logs and 'systemctl status sssd-sudo.service' for details. I followed the suggestion for a couple of these failures. Here's what it said: ● sssd-autofs.service - SSSD AutoFS Service responder Loaded: loaded (/usr/lib/systemd/system/sssd-autofs.service; indirect; vendor preset: disabled) Active: inactive (dead) Docs: man:sssd.conf(5) ● sssd-sudo.service - SSSD Sudo Service responder Loaded: loaded (/usr/lib/systemd/system/sssd-sudo.service; indirect; vendor preset: disabled) Active: inactive (dead) Docs: man:sssd.conf(5) man:sssd-sudo(5) Expected results: update of sssd-common happens without extra messages Additional info: -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 2

[Bug 1886841] New: Pinpad card reader for login authentication yet you are asked also enter pin on pc keyboard
by bugzilla＠redhat.com 03 Feb '22

03 Feb '22

https://bugzilla.redhat.com/show_bug.cgi?id=1886841 Bug ID: 1886841 Summary: Pinpad card reader for login authentication yet you are asked also enter pin on pc keyboard Product: Fedora Version: 32 Hardware: x86_64 URL: https://lists.fedoraproject.org/archives/list/freeipa- users(a)lists.fedorahosted.org/thread/FLLIA5RLHT3MO4NI2F 3MJNMBBNGGZA4Z/ OS: Linux Status: NEW Component: sssd Severity: high Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: peter(a)unix-edu.se QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Build Identifier: Hello Folks! We are working on getting smart card authentication working using pinpad card readers for improved security. To do this we use: FreeIPA Server is running on Fedora 32 with latest updates. FreeIPA Clients is Fedora 32 Workstation installed on pc with latest updates with connected usb card reader. The card reader is Gemalto CT700 with pinpad, we use several user individual SmartCard HSM 4K with FreeIPA signed certificates on them. FreeIPA Clients run OpenSC and are configured to use smartcard certificate based authentication, setup per Smartare HSM best practice. Further clients are using SSSD and not PAM_PKCS#11. All working great using smartcard for authentication, as long not enabling the pinpad in opensc. If doing so we are prompted for the PIN not only in the pinpad reader but also GDM prompts you to enter PIN on keyboard. Expected result is to be logged in directly after entering correct PIN code on pinpad reader, not being prompted by GDM to enter PIN on keyboard as well. If enabling pinpad in opensc, login gets a bit odd: 1. Fedora 32 Workstation GDM menu prompts a few users that can login. 2. Smartcard is inserted in reader. 3. GDM blanks out the screen and smartcard reader prompts to enter PIN in its lcd display. 4. Entering pin on smartcard reader followed by pressing ok button on smartcard reader at getting result Pin OK in reader display. 5. GDM now prompts for entering PIN on keyboard, this is unexpected, instead of directly being logged in to the window manager, here Gnome (or xfce, whatever window manager you selected to use). 6. You have to enter the PIN now on keyboard, followed by hitting enter. 7. Once again smartcard reader now prompts for PIN in its lcd display. 8. Entering PIN on the smartcard pinpad reader followed by pressing pinpad ok button. 9. You are now logged in, and all is normal. If ripping out the smartcard from reader the screen locks, as expected. Sometimes, but not always, you are logged in to window manager directly after step 5. What could this be, anyone who have seen this before or know how to set it up ? Reproducible: Always Steps to Reproduce: 1. Install and setup FreeIPA server and client on Fedora32 latest updates to use smartcard authentication for login. Work on IPA Server: ------------------- Install Fedora 32 server minimal installation all excluded, update to latest version (dnf update -y), set hostname, enter server hostname (ipaserver.mydomain.com) and ip in /etc/hosts, enable and start chrony, reboot. (As root user) dnf install ipa-server bind-dyndb-ldap ipa-server-dns -y for SERVICES in ntp http https ldap ldaps kerberos kpasswd dns; do firewall-cmd --permanent --add-service=$SERVICES; done ipa-server-install --setup-dns . . . Add one secondary DNS in /etc/NetworkManager/conf.d/zzz-ipa.conf klist kinit admin authselect select sssd with-sudo with-mkhomedir ipa user-add user3 --first=user3 --last=test --email=user3(a)mydomain.com --shell=/bin/bash --password id user3 ipa user-find user3 ssh user3(a)ipaserver.mydomain.com (change password) reboot (As root user) klist kinit admin ipa-advise config-server-for-smart-card-auth > config-server-for-smart-card-auth.sh chmod u+x config-server-for-smart-card-auth.sh ./config-server-for-smart-card-auth.sh /etc/ipa/ca.crt . . reboot ipa-advise config-client-for-smart-card-auth > /tmp/config-client-for-smart-card-auth.sh chmod a+r /tmp/config-client-for-smart-card-auth.sh Work on Fedora 32 workstation: ------------------------------ Install Fedora 32 Workstation from live dvd to PC, update to latest version (dnf update -y), set hostname, enter server hostname (workstation.mydomain.com) and ip in /etc/hosts, enable and start chrony. change/add to /etc/sysconfig/network-scripts/reboot, so IPA server becomes primary DNS for the Fedora 32 Workstation: PEERDNS=no DNS1=<ipa server ip address> DNS2=<second dns server> SEARCH=mydomain.com DOMAIN=mydomain.com Then reboot Login and check that DNS is working. (as root user) dnf install freeipa-client.x86_64 -y ipa-client-install --mkhomedir id user3 reboot Connect gemalto CT700 card reader to pc/Fedora Workstation. lsusb dnf install opensc ccid pcsc-tools -y systemctl enable pcscd systemctl start pcscd scp user3@ipaserver:/tmp/config-client-for-smart-card-auth.sh . chmod +x config-client-for-smart-card-auth.sh ./config-client-for-smart-card-auth.sh /etc/ipa/ca.crt . . . In /etc/opensc.conf enable pinpad by uncommenting enable_pinpad = true; Ensure pam_cert_auth is true in sssd.conf: grep ^pam_cert_auth /etc/sssd/sssd.conf pam_cert_auth = True authselect select sssd with-mkhomedir with-sudo with-smartcard with-smartcard-lock-on-removal --force authselect current reboot 2. Prepare smartcard-hsm with user3 certificate using (as root user) kinit admin Insert smartcard-hsm in gemalto ct700 card reader! pcsc_scan Using reader plug'n play mechanism Scanning present readers... 0: Gemalto Ezio Shield (I<some number>) 00 00 Wed Sep 23 14:12:27 2020 Reader 0: Gemalto Ezio Shield (I<some number>) 00 00 . . . Possibly identified card (using /usr/share/pcsc/smartcard_list.txt): <some hex number> Smartcard-HSM http://www.cardcontact.de/products/sc-hsm.html pensc-tool --list-readers # Detected readers (pcsc) Nr. Card Features Name 0 Yes PIN pad Gemalto Ezio Shield (I<some number>) 00 00 pkcs11-tool --list-slots Available slots: Slot 0 (0x0): Gemalto Ezio Shield (I<some number>) 00 00 token label : UserPIN (SmartCard-HSM) token manufacturer : www.CardContact.de token model : PKCS#15 emulated token flags : login required, PIN pad present, rng, token initialized, PIN initialized hardware version : 24.13 firmware version : 2.5 serial num : DECM<some number> pin min/max : 6/15 sc-hsm-tool --create-dkek-share dkek-share-1.pbe . . . sc-hsm-tool --initialize --so-pin <long pincode> --pin <pincode> --dkek-shares 1 sc-hsm-tool . . . DKEK shares : 1 DKEK import pending, 1 share(s) still missing sc-hsm-tool --import-dkek-share dkek-share-1.pbe . . . Enter password to decrypt DKEK share : <pincode> sc-hsm-tool . . . DKEK shares : 1 DKEK key check value : <some hex code> # generate keypair pkcs11-tool --module opensc-pkcs11.so --login --pin <pincode> --keypairgen --key-type rsa:2048 --id 10 --label "HSM RSA Key user3" pkcs11-tool --list-objects . . . pkcs11-tool --test --login --pin <pincode> . . . # Backup DKEK sc-hsm-tool --wrap-key wrap-key-1.bin --key-reference 1 --pin <pincode> # Extract card public key for slot 10 pkcs15-tool --read-public-key 10 > user3.pub # Prepping for and Create CSR to sign by IPA for user3 # Create a file hsm.conf with the content below cat hsm.conf # PKCS11 engine config openssl_conf = openssl_def [openssl_def] engines = engine_section [req] distinguished_name = req_distinguished_name [req_distinguished_name] # empty. [engine_section] pkcs11 = pkcs11_section [pkcs11_section] engine_id = pkcs11 PIN = init = 0 # Test that hsm.conf is working, and find pkcs11 engine OPENSSL_CONF=./hsm.conf openssl engine (rdrand) Intel RDRAND engine (dynamic) Dynamic engine loading support (pkcs11) pkcs11 engine # Create CSR to sign by IPA for user3 OPENSSL_CONF=./hsm.conf openssl req -engine pkcs11 -keyform engine -new -key 10 -sha256 -out user3.csr -subj "/CN=user3" Login to IPA server using the web interface https://ipaserver.mydomain.com (this can be performed from command line as well, but we did use the web interface to IPA) user user3 Actions -> new certificate select profile IECuserRoles copy "user3.csr" from above and paste it in and click "issue" (IPA now sign the CSR) To retrieve the signed certificate for user3: user user3 by Certificates click Actions -> Download and save as. (it downloads as cert.pem) Copy the downloaded cerificate (cert.pem) to host with card reader (Fedora 32 Workstation) Rename it: mv cert.pem user3.pem # convert to der format: openssl x509 -in user3.pem -out user3.der -outform der # write it to the card in slot 10 pkcs11-tool --module opensc-pkcs11.so --login --pin <pincode> --write-object user36.der --type cert --id 10 # check that it is there: pkcs11-tool --list-objects Using slot 0 with a present token (0x0) Certificate Object; type = X.509 cert label: Certificate subject: DN: O=MYDOMAIN.COM, CN=user3 ID: 10 Public Key Object; RSA 2048 bits label: Certificate ID: 10 Usage: encrypt, verify Smartcard should now be ready for use with IPA. 3. Now try login to workstation.mydomain.com using GDM using the smartcard issued for user3 Note! user3 password must not have been expired, it should be fixed by the initial login test above. As per details above: 1. Fedora 32 Workstation GDM menu prompts a few users that can login. 2. Smartcard is inserted in reader. 3. GDM blanks out the screen and smartcard reader prompts to enter PIN in its lcd display. 4. Entering pin on smartcard reader followed by pressing ok button on smartcard reader at getting result Pin OK in reader display. 5. GDM now prompts for entering PIN on keyboard, this is unexpected, instead of directly being logged in to the window manager, here Gnome (or xfce, whatever window manager you selected to use). 6. You have to enter the PIN now on keyboard, followed by hitting enter. 7. Once again smartcard reader now prompts for PIN in its lcd display. 8. Entering PIN on the smartcard pinpad reader followed by pressing pinpad ok button. 9. You are now logged in, and all is normal. If ripping out the smartcard from reader the screen locks, as expected. Sometimes, but not always, you are logged in to window manager directly after step 5. Actual Results: You are asked to enter PIN using pinpad on card reader followed by enter PIN using the keyboard, then you are logged in. Sometimes you need to enter PIN on pinpad once more after entering PIN using the keyboard. Expected Results: Directly after entering correct PIN using pinpad on card reader you should be logged in. Versions: Fedora32 with latest updates per Oct 9 2020. freeipa-server-4.8.10-5.fc32.x86_64 freeipa-client-4.8.10-5.fc32.x86_64 sssd-client-2.3.1-2.fc32.x86_64 opensc-0.20.0-6.fc32.x86_64 pcsc-lite-libs-1.9.0-1.fc32.x86_64 -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 6

[Bug 1857104] New: Using FreeIPA breaks IPv4/IPv6 flags for SSH
by bugzilla＠redhat.com 03 Feb '22

03 Feb '22

https://bugzilla.redhat.com/show_bug.cgi?id=1857104 Bug ID: 1857104 Summary: Using FreeIPA breaks IPv4/IPv6 flags for SSH Product: Fedora Version: 32 Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: ossman(a)cendio.se QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: If a client is configured using ipa-client-install then the -4 and -6 flags stop working for ssh. Version-Release number of selected component (if applicable): Doesn't matter. Seen on RHEL 6 through 8, and on current Fedora. How reproducible: 100% Steps to Reproduce: 1. ipa-client-install 2. ssh -4 host.example.com Actual results: Connected via IPv6 Expected results: Connected via IPv4 Additional info: The bug is that sss_ssh_knownhostsproxy is configured on the client and that command doesn't respect the flags given to ssh. The issue affects all hosts, not just those part of the same FreeIPA domain. A practical effect of this is that connections get rejected or misbehave because of IP based rules in place for this connection. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 17

[Bug 1902670] Cannot authenticate against Active Directory
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1902670 Ben Cotton <bcotton(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL Last Closed| |2021-11-30 19:12:33 --- Comment #7 from Ben Cotton <bcotton(a)redhat.com> --- Fedora 33 changed to end-of-life (EOL) status on 2021-11-30. Fedora 33 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1902670

1 0

[Bug 1886816] New: [abrt] sssd-common: sss_mmap_cache_pw_store(): sssd_nss killed by SIGBUS
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1886816 Bug ID: 1886816 Summary: [abrt] sssd-common: sss_mmap_cache_pw_store(): sssd_nss killed by SIGBUS Product: Fedora Version: 33 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:cd13c552f85949e67c1f8b9066dc4393eee0ce85;VAR IANT_ID=workstation; Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: kparal(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Version-Release number of selected component: sssd-common-2.3.1-4.fc33 Additional info: reporter: libreport-2.14.0 backtrace_rating: 4 cgroup: 0::/system.slice/sssd.service cmdline: /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files crash_function: sss_mmap_cache_pw_store executable: /usr/libexec/sssd/sssd_nss journald_cursor: s=b2e7c0583c004ae8bd317a4440255076;i=2ee4a7;b=7c261537394f4d169971a59cd1761dfe;m=55626889;t=5b13c2149d0cf;x=8fed0b78d48ecd6c kernel: 5.8.14-300.fc33.x86_64 rootdir: / runlevel: N 5 type: CCpp uid: 0 Truncated backtrace: Thread no. 1 (10 frames) #0 sss_mmap_cache_pw_store at src/responder/nss/nsssrv_mmap_cache.c:769 #1 nss_protocol_fill_pwent at src/responder/nss/nss_protocol_pwent.c:308 #2 nss_protocol_reply at src/responder/nss/nss_protocol.c:91 #3 nss_getby_done at src/responder/nss/nss_cmd.c:626 #4 tevent_common_invoke_immediate_handler at ../../tevent_immediate.c:166 #5 tevent_common_loop_immediate at ../../tevent_immediate.c:203 #6 epoll_event_loop_once at ../../tevent_epoll.c:917 #7 std_event_loop_once at ../../tevent_standard.c:110 #8 _tevent_loop_once at ../../tevent.c:772 #9 tevent_common_loop_wait at ../../tevent.c:895 -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 13

[Bug 1853261] New: sssd fails to start on read-only filesystem
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1853261 Bug ID: 1853261 Summary: sssd fails to start on read-only filesystem Product: Fedora Version: rawhide Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: zbyszek(a)in.waw.pl QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, rharwood(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: sssd refuses to start when /var/log is read-only. It is obviously a problem when trying to recover from a file system issue. Since logging is non-essential, sssd should just continue. At most is should emit a warning. $ touch /var/tmp/foo touch: cannot touch '/var/tmp/foo': Read-only file system $ sudo systemctl start sssd.service Job for sssd.service failed because the control process exited with error code. See "systemctl status sssd.service" and "journalctl -xe" for details. [fedora@workstation-uefi ~]$ Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02 11:16:46 CEST): sssd[900]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only file system] Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02 11:16:47 CEST): sssd[903]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only file system] Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02 11:16:47 CEST): sssd[905]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only file system] Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02 11:16:47 CEST): sssd[906]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only file system] Broadcast message from systemd-journald@workstation-uefi (Thu 2020-07-02 11:16:47 CEST): sssd[907]: Could not open file [/var/log/sssd/sssd.log]. Error: [30][Read-only file system] We see multiple issues here: - the main one is that sssd should not fail to start as described above - but also, why is sssd not just logging to the journal? Why is it spamming with broadcast messages? If sssd would just log to the journal like any modern service, all those problems would be avoided. Version-Release number of selected component (if applicable): sssd-2.3.0-2.fc33.x86_64 How reproducible: Deterministic Steps to Reproduce: 1. Make /var/log read-only, either by not remounting the filesystems rw, or by using udev.blockdev-read-only with systemd-246+ 2. Try to start sssd -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug.

1 18

[Bug 2016992] New: Updating to 2.6.0 seems to break kdestroy/kinit/klist
by bugzilla＠redhat.com 04 Nov '21

04 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=2016992 Bug ID: 2016992 Summary: Updating to 2.6.0 seems to break kdestroy/kinit/klist Product: Fedora Version: 35 Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: sanjay.ankur(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, jhrozek(a)redhat.com, lslebodn(a)redhat.com, luk.claes(a)gmail.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: Updating to 2.6.0 seems to break kdestoy/kinit/klist Version-Release number of selected component (if applicable): 2.6.0 How reproducible: Always Steps to Reproduce: 1. Update to 2.6.0 packages 2. Run `kdestroy` or `kinit` or `klist` 3. Actual results: Always get "Credentials cache I/O operation failed while resolving ccache" Expected results: Should work. Additional info: Here's the output from a fresh upgrade: (ins)[asinha@ankur ~]$ klist Ticket cache: KCM:1000 Default principal: ankursinha(a)FEDORAPROJECT.ORG Valid starting Expires Service principal 25/10/21 12:15:07 26/10/21 12:15:07 krbtgt/FEDORAPROJECT.ORG(a)FEDORAPROJECT.ORG renew until 01/11/21 11:15:07 (ins)[asinha@ankur ~]$ sudo dnf update sssd\* [sudo] password for asinha: Fedora 35 - x86_64 - Updates 95 kB/s | 25 kB 00:00 Fedora Modular 35 - x86_64 - Updates 161 kB/s | 25 kB 00:00 Fedora 35 - x86_64 - Test Updates 237 kB/s | 16 kB 00:00 Fedora 35 - x86_64 - Test Updates 1.3 MB/s | 1.9 MB 00:01 Dependencies resolved. ======================================================================================================================================== Package Architecture Version Repository Size ======================================================================================================================================== Upgrading: libipa_hbac x86_64 2.6.0-1.fc35 updates-testing 33 k libsss_certmap x86_64 2.6.0-1.fc35 updates-testing 76 k libsss_idmap x86_64 2.6.0-1.fc35 updates-testing 39 k libsss_nss_idmap x86_64 2.6.0-1.fc35 updates-testing 41 k sssd x86_64 2.6.0-1.fc35 updates-testing 25 k sssd-ad x86_64 2.6.0-1.fc35 updates-testing 203 k sssd-client x86_64 2.6.0-1.fc35 updates-testing 141 k sssd-common x86_64 2.6.0-1.fc35 updates-testing 1.5 M sssd-common-pac x86_64 2.6.0-1.fc35 updates-testing 89 k sssd-ipa x86_64 2.6.0-1.fc35 updates-testing 269 k sssd-kcm x86_64 2.6.0-1.fc35 updates-testing 104 k sssd-krb5 x86_64 2.6.0-1.fc35 updates-testing 76 k sssd-krb5-common x86_64 2.6.0-1.fc35 updates-testing 82 k sssd-ldap x86_64 2.6.0-1.fc35 updates-testing 153 k sssd-nfs-idmap x86_64 2.6.0-1.fc35 updates-testing 36 k sssd-proxy x86_64 2.6.0-1.fc35 updates-testing 66 k Transaction Summary ======================================================================================================================================== Upgrade 16 Packages Total download size: 2.9 M Is this ok [y/N]: y Downloading Packages: (1/16): libipa_hbac-2.6.0-1.fc35.x86_64.rpm 396 kB/s | 33 kB 00:00 (2/16): libsss_idmap-2.6.0-1.fc35.x86_64.rpm 439 kB/s | 39 kB 00:00 (3/16): libsss_certmap-2.6.0-1.fc35.x86_64.rpm 786 kB/s | 76 kB 00:00 (4/16): libsss_nss_idmap-2.6.0-1.fc35.x86_64.rpm 1.2 MB/s | 41 kB 00:00 (5/16): sssd-2.6.0-1.fc35.x86_64.rpm 730 kB/s | 25 kB 00:00 (6/16): sssd-client-2.6.0-1.fc35.x86_64.rpm 1.6 MB/s | 141 kB 00:00 (7/16): sssd-ad-2.6.0-1.fc35.x86_64.rpm 1.7 MB/s | 203 kB 00:00 (8/16): sssd-common-pac-2.6.0-1.fc35.x86_64.rpm 1.8 MB/s | 89 kB 00:00 (9/16): sssd-kcm-2.6.0-1.fc35.x86_64.rpm 2.0 MB/s | 104 kB 00:00 (10/16): sssd-krb5-2.6.0-1.fc35.x86_64.rpm 1.3 MB/s | 76 kB 00:00 (11/16): sssd-krb5-common-2.6.0-1.fc35.x86_64.rpm 1.7 MB/s | 82 kB 00:00 (12/16): sssd-ipa-2.6.0-1.fc35.x86_64.rpm 1.2 MB/s | 269 kB 00:00 (13/16): sssd-nfs-idmap-2.6.0-1.fc35.x86_64.rpm 725 kB/s | 36 kB 00:00 (14/16): sssd-proxy-2.6.0-1.fc35.x86_64.rpm 968 kB/s | 66 kB 00:00 (15/16): sssd-ldap-2.6.0-1.fc35.x86_64.rpm 508 kB/s | 153 kB 00:00 (16/16): sssd-common-2.6.0-1.fc35.x86_64.rpm 1.4 MB/s | 1.5 MB 00:01 ---------------------------------------------------------------------------------------------------------------------------------------- Total 2.3 MB/s | 2.9 MB 00:01 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Upgrading : libsss_idmap-2.6.0-1.fc35.x86_64 1/32 Upgrading : libsss_certmap-2.6.0-1.fc35.x86_64 2/32 Upgrading : sssd-nfs-idmap-2.6.0-1.fc35.x86_64 3/32 Upgrading : libsss_nss_idmap-2.6.0-1.fc35.x86_64 4/32 Upgrading : sssd-client-2.6.0-1.fc35.x86_64 5/32 Running scriptlet: sssd-client-2.6.0-1.fc35.x86_64 5/32 Upgrading : sssd-common-2.6.0-1.fc35.x86_64 6/32 Running scriptlet: sssd-common-2.6.0-1.fc35.x86_64 6/32 Upgrading : sssd-krb5-common-2.6.0-1.fc35.x86_64 7/32 Upgrading : sssd-common-pac-2.6.0-1.fc35.x86_64 8/32 Upgrading : sssd-ad-2.6.0-1.fc35.x86_64 9/32 Upgrading : sssd-krb5-2.6.0-1.fc35.x86_64 10/32 Upgrading : sssd-ldap-2.6.0-1.fc35.x86_64 11/32 Upgrading : sssd-proxy-2.6.0-1.fc35.x86_64 12/32 Upgrading : libipa_hbac-2.6.0-1.fc35.x86_64 13/32 Upgrading : sssd-ipa-2.6.0-1.fc35.x86_64 14/32 Upgrading : sssd-2.6.0-1.fc35.x86_64 15/32 Upgrading : sssd-kcm-2.6.0-1.fc35.x86_64 16/32 Running scriptlet: sssd-kcm-2.6.0-1.fc35.x86_64 16/32 Cleanup : sssd-2.5.2-5.fc35.x86_64 17/32 Cleanup : sssd-ipa-2.5.2-5.fc35.x86_64 18/32 Cleanup : sssd-ad-2.5.2-5.fc35.x86_64 19/32 Cleanup : sssd-ldap-2.5.2-5.fc35.x86_64 20/32 Cleanup : sssd-common-pac-2.5.2-5.fc35.x86_64 21/32 Cleanup : sssd-krb5-2.5.2-5.fc35.x86_64 22/32 Cleanup : sssd-proxy-2.5.2-5.fc35.x86_64 23/32 Running scriptlet: sssd-kcm-2.5.2-5.fc35.x86_64 24/32 Cleanup : sssd-kcm-2.5.2-5.fc35.x86_64 24/32 Running scriptlet: sssd-kcm-2.5.2-5.fc35.x86_64 24/32 Cleanup : sssd-krb5-common-2.5.2-5.fc35.x86_64 25/32 Running scriptlet: sssd-common-2.5.2-5.fc35.x86_64 26/32 Cleanup : sssd-common-2.5.2-5.fc35.x86_64 26/32 Running scriptlet: sssd-common-2.5.2-5.fc35.x86_64 26/32 Running scriptlet: sssd-client-2.5.2-5.fc35.x86_64 27/32 Cleanup : sssd-client-2.5.2-5.fc35.x86_64 27/32 Cleanup : libsss_idmap-2.5.2-5.fc35.x86_64 28/32 Cleanup : libsss_nss_idmap-2.5.2-5.fc35.x86_64 29/32 Cleanup : libsss_certmap-2.5.2-5.fc35.x86_64 30/32 Cleanup : sssd-nfs-idmap-2.5.2-5.fc35.x86_64 31/32 Cleanup : libipa_hbac-2.5.2-5.fc35.x86_64 32/32 Running scriptlet: sssd-common-2.6.0-1.fc35.x86_64 32/32 Running scriptlet: libipa_hbac-2.5.2-5.fc35.x86_64 32/32 Verifying : libipa_hbac-2.6.0-1.fc35.x86_64 1/32 Verifying : libipa_hbac-2.5.2-5.fc35.x86_64 2/32 Verifying : libsss_certmap-2.6.0-1.fc35.x86_64 3/32 Verifying : libsss_certmap-2.5.2-5.fc35.x86_64 4/32 Verifying : libsss_idmap-2.6.0-1.fc35.x86_64 5/32 Verifying : libsss_idmap-2.5.2-5.fc35.x86_64 6/32 Verifying : libsss_nss_idmap-2.6.0-1.fc35.x86_64 7/32 Verifying : libsss_nss_idmap-2.5.2-5.fc35.x86_64 8/32 Verifying : sssd-2.6.0-1.fc35.x86_64 9/32 Verifying : sssd-2.5.2-5.fc35.x86_64 10/32 Verifying : sssd-ad-2.6.0-1.fc35.x86_64 11/32 Verifying : sssd-ad-2.5.2-5.fc35.x86_64 12/32 Verifying : sssd-client-2.6.0-1.fc35.x86_64 13/32 Verifying : sssd-client-2.5.2-5.fc35.x86_64 14/32 Verifying : sssd-common-2.6.0-1.fc35.x86_64 15/32 Verifying : sssd-common-2.5.2-5.fc35.x86_64 16/32 Verifying : sssd-common-pac-2.6.0-1.fc35.x86_64 17/32 Verifying : sssd-common-pac-2.5.2-5.fc35.x86_64 18/32 Verifying : sssd-ipa-2.6.0-1.fc35.x86_64 19/32 Verifying : sssd-ipa-2.5.2-5.fc35.x86_64 20/32 Verifying : sssd-kcm-2.6.0-1.fc35.x86_64 21/32 Verifying : sssd-kcm-2.5.2-5.fc35.x86_64 22/32 Verifying : sssd-krb5-2.6.0-1.fc35.x86_64 23/32 Verifying : sssd-krb5-2.5.2-5.fc35.x86_64 24/32 Verifying : sssd-krb5-common-2.6.0-1.fc35.x86_64 25/32 Verifying : sssd-krb5-common-2.5.2-5.fc35.x86_64 26/32 Verifying : sssd-ldap-2.6.0-1.fc35.x86_64 27/32 Verifying : sssd-ldap-2.5.2-5.fc35.x86_64 28/32 Verifying : sssd-nfs-idmap-2.6.0-1.fc35.x86_64 29/32 Verifying : sssd-nfs-idmap-2.5.2-5.fc35.x86_64 30/32 Verifying : sssd-proxy-2.6.0-1.fc35.x86_64 31/32 Verifying : sssd-proxy-2.5.2-5.fc35.x86_64 32/32 You should restart: * Some applications using: dropbox stop; dropbox start killall -3 gnome-shell sudo systemctl restart NetworkManager sudo systemctl restart abrt-journal-core sudo systemctl restart abrt-oops sudo systemctl restart abrt-xorg sudo systemctl restart abrtd sudo systemctl restart accounts-daemon sudo systemctl restart atd sudo systemctl restart auditd sudo systemctl restart avahi-daemon sudo systemctl restart chronyd sudo systemctl restart colord sudo systemctl restart crond sudo systemctl restart cups sudo systemctl restart dbus-:1.16-org.freedesktop.problems@0 sudo systemctl restart dbus-broker sudo systemctl restart firewalld sudo systemctl restart gdm sudo systemctl restart libvirtd sudo systemctl restart mcelog sudo systemctl restart packagekit sudo systemctl restart polkit sudo systemctl restart power-profiles-daemon sudo systemctl restart rtkit-daemon sudo systemctl restart sshd sudo systemctl restart sssd-kcm sudo systemctl restart systemd-logind sudo systemctl restart systemd-resolved sudo systemctl restart systemd-udevd sudo systemctl restart udisks2 * These applications manually: (sd-pam) AuthManagerDaemon Xorg deja-dup dnf evolution-alarm-notify evolution-calendar-factory evolution-source-registry fusermount gdm-session-worker gnome-session-binary gnome-software goa-identity-service gsd-media-keys gsd-power ibus-daemon icasessionmgr pipewire pipewire-pulse qutebrowser wireplumber xdg-desktop-portal xdg-desktop-portal-gnome zoom Additionally, there are: - 3 processes requiring restart of your session (i.e. Logging out & Logging in again) For more information run: sudo tracer -iat 1635160525.9518569 Upgraded: libipa_hbac-2.6.0-1.fc35.x86_64 libsss_certmap-2.6.0-1.fc35.x86_64 libsss_idmap-2.6.0-1.fc35.x86_64 libsss_nss_idmap-2.6.0-1.fc35.x86_64 sssd-2.6.0-1.fc35.x86_64 sssd-ad-2.6.0-1.fc35.x86_64 sssd-client-2.6.0-1.fc35.x86_64 sssd-common-2.6.0-1.fc35.x86_64 sssd-common-pac-2.6.0-1.fc35.x86_64 sssd-ipa-2.6.0-1.fc35.x86_64 sssd-kcm-2.6.0-1.fc35.x86_64 sssd-krb5-2.6.0-1.fc35.x86_64 sssd-krb5-common-2.6.0-1.fc35.x86_64 sssd-ldap-2.6.0-1.fc35.x86_64 sssd-nfs-idmap-2.6.0-1.fc35.x86_64 sssd-proxy-2.6.0-1.fc35.x86_64 Complete! (ins)[asinha@ankur ~]$ klist klist: Credentials cache I/O operation failed while resolving ccache (ins)[asinha@ankur ~]$ kdestroy && knit kdestroy: Credentials cache I/O operation failed while resolving ccache (ins)[asinha@ankur ~]$ export KRB5_TRACE=/dev/stderr (ins)[asinha@ankur ~]$ kdestroy && knit kdestroy: Credentials cache I/O operation failed while resolving ccache (ins)[asinha@ankur ~]$ kdestroy && knit kdestroy: Credentials cache I/O operation failed while resolving ccache (ins)[asinha@ankur ~]$ kdestroy && knit kdestroy: Credentials cache I/O operation failed while resolving ccache (ins)[asinha@ankur ~]$ ls /tmp/ hsperfdata_asinha qtsingleapp-zoom-3e8 qtsingleapp-zoom-3e8-lockfile ssh-XXXXXX68pTNV systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-bluetooth.service-NunzrQ systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-chronyd.service-xAItvY systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-colord.service-Yg5n5c systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-dbus-broker.service-MgWgnx systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-geoclue.service-brjUBc systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-low-memory-monitor.service-kwf3E4 systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-ModemManager.service-9oZuVw systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-power-profiles-daemon.service-MB8Qbq systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-rtkit-daemon.service-FvhCRd systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-switcheroo-control.service-pBS8Gh systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-systemd-logind.service-XddtLu systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-systemd-oomd.service-Apy8Uq systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-systemd-resolved.service-RCxzv5 systemd-private-b71a2c6e3a724e0f8ae3b8403d6a99d7-upower.service-uo9cFd tmux-1000 tracker-extract-3-files.1000 (ins)[asinha@ankur ~]$ (ins)[asinha@ankur ~]$ sudo systemctl restart sssd* [sudo] password for asinha: (ins)[asinha@ankur ~]$ kdestroy && knit kdestroy: Credentials cache I/O operation failed while resolving ccache ---- I'd used `dnf offline-upgrade` the first time and had seen these issues after the reboot also. I'm not well versed enough with these bits to provide more logs. If you can please point me to what logs I can provide, I'll attach them too. Thanks very much, -- You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2016992

1 22

2024

2023

2022

2021

2020

Sssd-maintainers November 2021