sssd-users September 2012

sssd-users@lists.fedorahosted.org

16 participants
16 discussions

Re: [SSSD-users] Kerberos principal > canonicalization is not available!
by John Thomas 10 Sep '12

10 Sep '12

I just figured it out. The problem was in my /etc/krb5. My encryption types listed are as follows: default_tgs_enctypes = aes256-cts rc4-hmac des-cbc-crc des-cdc-md5 default_tkt_enctypes = aes256-cts rc4-hmac des-cbc-crc des-cdc-md5 permitted_enctypes = aes256-cts rc4-hmac des-cbc-crc des-cbc-md5 However my keytab did not have entries for aes256-cts. So I removed these entries for each of the above parameters, and it worked. Thanks! > Date: Fri, 07 Sep 2012 19:23:44 -0400 > From: Dmitri Pal <dpal(a)redhat.com> > To: sssd-users(a)lists.fedorahosted.org > Subject: Re: [SSSD-users] Kerberos principal > canonicalization is not > available! > Message-ID: <504A8200.7000704(a)redhat.com> > Content-Type: text/plain; charset=UTF-8 > > On 09/07/2012 05:08 PM, John Thomas wrote: > > Hello, > > > > I am having problems trying to get SSSD to work with > RHEL 5 to authenticate against a Microsoft AD 2008. I > did a manual complile/install of Kerberos 1.9.4 to use with > SSSD 1.8.2., because I understand that the kerberos must be > greater than 1.7. A "getent passwd username" is > unsuccessful. This is the output is the > /var/log/sssd/ldap_child.log. > > > > > > > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [main] (0x0400): ldap_child > started. > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): total > buffer size: 67 > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): > realm_str size: 12 > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): got > realm_str: REALM.COM > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): > princ_str size: 23 > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): got > princ_str: HOSTNAME$(a)REALM.COM > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): > keytab_name size: 16 > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): got > keytab_name: /etc/krb5.keytab > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): > lifetime: 86400 > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [ldap_child_get_tgt_sync] > (0x0100): Principal name is: [HOSTNAME$(a)REALM.COM] > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] > [sss_krb5_get_init_creds_opt_set_canonicalize] (0x0040): > Kerberos principal canonicalization is not available! > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [ldap_child_get_tgt_sync] > (0x0010): Failed to init credentials: Key table entry not > found > > (Fri Sep 7 16:49:39 2012) > [[sssd[ldap_child[9473]]]] [main] (0x0020): > ldap_child_get_tgt_sync failed. > > > > > > Haven't been able to figure out what is wrong so > far. Can someone help? > > > Please provide sssd.conf and krb5.conf files. > > Based on the information above the name of the host > principal did not > match the name of the principal in the keytab. > Did you provision host keytab from the KDC manually? Please > see what > host principals you have in the keytab and verify that it > matches the > host name of the system. > Also the host principal is usually "host/<host > FQDN>@<REALM IN CAPS>" > http://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-user/What-is-a-Ker… > > It seems that the principal that has been looked up is > different but it > is sanitized to be sure what the issue is. > > > John > > > > > > _______________________________________________ > > sssd-users mailing list > > sssd-users(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/sssd-users > > > -- > Thank you, > Dmitri Pal > > Sr. Engineering Manager for IdM portfolio > Red Hat Inc. > > > ------------------------------- > Looking to carve out IT costs? > www.redhat.com/carveoutcosts/ > > > > > > ------------------------------ > > _______________________________________________ > sssd-users mailing list > sssd-users(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/sssd-users > > > End of sssd-users Digest, Vol 5, Issue 4 > **************************************** >

2 1

pam_sss returns PAM_SYSTEM_ERR when entering wrong Kerberos password
by Joschi Brauchle 09 Sep '12

09 Sep '12

Hello, I noticed a problem when using pam_sss (1.8.3) under OpenSUSE 12.2 + KDE and filed a bugreport there: https://bugzilla.novell.com/show_bug.cgi?id=779246 When a Kerberos user enters a wrong password, a KDM "Critical error" message pops up (see link above for a screenshot). In /var/log/messages, there is ------ Sep 7 11:34:03 test-os122 [sssd[krb5_child[1102]]]: Decrypt integrity check failed Sep 7 11:34:03 test-os122 [sssd[krb5_child[1102]]]: Decrypt integrity check failed Sep 7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth): system info: [Decrypt integrity check failed] Sep 7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=testuser Sep 7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth): received for user testuser: 4 (System error) ------ As far as I know, "decrypt integrity fails" is the default Kerberos error message for a wrong password. Hence, this is not a "System error", but rather an authentication error. When looking at the code of "krb5_child.c", it seems like the default return code when checking the Kerberos TGT is "PAM_SYSTEM_ERR", which also gets returned in the event of a simply wrong password. I guess, pam_sss should instead return "PAM_AUTH_ERR", is that correct? Has this been fixed in versions > 1.8.3? Best regards, Joschi Brauchle

3 4

Kerberos principal canonicalization is not available!
by John Thomas 07 Sep '12

07 Sep '12

Hello, I am having problems trying to get SSSD to work with RHEL 5 to authenticate against a Microsoft AD 2008. I did a manual complile/install of Kerberos 1.9.4 to use with SSSD 1.8.2., because I understand that the kerberos must be greater than 1.7. A "getent passwd username" is unsuccessful. This is the output is the /var/log/sssd/ldap_child.log. (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [main] (0x0400): ldap_child started. (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): total buffer size: 67 (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): realm_str size: 12 (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): got realm_str: REALM.COM (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): princ_str size: 23 (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): got princ_str: HOSTNAME$(a)REALM.COM (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): keytab_name size: 16 (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): got keytab_name: /etc/krb5.keytab (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [unpack_buffer] (0x1000): lifetime: 86400 (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [HOSTNAME$(a)REALM.COM] (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [sss_krb5_get_init_creds_opt_set_canonicalize] (0x0040): Kerberos principal canonicalization is not available! (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [ldap_child_get_tgt_sync] (0x0010): Failed to init credentials: Key table entry not found (Fri Sep 7 16:49:39 2012) [[sssd[ldap_child[9473]]]] [main] (0x0020): ldap_child_get_tgt_sync failed. Haven't been able to figure out what is wrong so far. Can someone help? John

2 1

Announcing SSSD 1.9.0 beta 7
by Jakub Hrozek 05 Sep '12

05 Sep '12

The SSSD team is proud to announce the seventh beta release of version 1.9 of the System Security Services Daemon. This is a bugfix release only, no new features were added in this version. This release was originally planned to be a Release Candidate, however we are still actively working on fixing several crasher bugs. A proper Release Candidate will be released once we fix the known crashes. We will be focusing on more stabilizing after that point until the final 1.9.0 release which is tentatively scheduled for September 13, although that release date will probably slip a couple of days. As always, you can download the latest sources at https://fedorahosted.org/sssd/ == Highlights == * Fixed security bug CVE-2012-3462 - HBAC rules were ignored when the SELinux login context support was enabled * Mutexes in the nss_sss module are now released correctly if one thread in a multithreaded application is cancelled while the mutex is locked * The fail over code works correctly when the IPA provider is not able to establish a GSSAPI-encrypted connection to an IPA server * The SSSD correctly accepts -1 as a valid value of the shadow attributes * When the SSSD is unable to resolve a host name, it tries the next configured server now instead of going offline * The default SELinux login context for IPA users was changed to unconfined_t when there are no rules on the server * A file descriptor leak in cases the SSSD was unable to establish SSL connection to an LDAP server was fixed == Packaging Changes == * A new Python wrapper around the murmur hash library has been introduced. It is only useful to the FreeIPA server at the moment. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/734 on reconnect we need to detect that a ipa/ds server has been reinitialized https://fedorahosted.org/sssd/ticket/1156 Do not use "goto" to jump backwards in the proxy code https://fedorahosted.org/sssd/ticket/1194 when nesting limit is reached, the LDAP provider tries to establish link to members outside the nesting limit https://fedorahosted.org/sssd/ticket/1345 sssd does not warn into sssd.log for broken configurations https://fedorahosted.org/sssd/ticket/1365 ipv6 address with square brackets doesn't work for krb5_server https://fedorahosted.org/sssd/ticket/1388 domain.remove_provider() does not work https://fedorahosted.org/sssd/ticket/1390 Add support for nested automount maps https://fedorahosted.org/sssd/ticket/1393 shadow attributes should accept -1 https://fedorahosted.org/sssd/ticket/1396 Kerberos validation algorithm is insufficient for cross-realm trusts https://fedorahosted.org/sssd/ticket/1415 Group lookups no longer work when fastcache cannot be initialized https://fedorahosted.org/sssd/ticket/1416 sssd_be crashes on using inappropriate keytab file https://fedorahosted.org/sssd/ticket/1430 Password change prompt doesn't appear when "User must change password on next logon" is set for a AD user. https://fedorahosted.org/sssd/ticket/1436 LOCAL domain lookups don't work https://fedorahosted.org/sssd/ticket/1446 sssd does not try another server when unable to resolve hostname https://fedorahosted.org/sssd/ticket/1447 Fail over does not work correctly when IPA server is establishing a GSSAPI-encrypted LDAP connection https://fedorahosted.org/sssd/ticket/1453 proxy provider: value stored to status is never read in get_pw_name https://fedorahosted.org/sssd/ticket/1455 SELinux code must fall back to default only if there are no rules on the server https://fedorahosted.org/sssd/ticket/1456 Attempt to close the same file stream twice https://fedorahosted.org/sssd/ticket/1457 Insecure temporary file in IPA subdomain provider https://fedorahosted.org/sssd/ticket/1459 SRV servers are always marked as back up https://fedorahosted.org/sssd/ticket/1460 SSSD thread issue can cause the application to not get any identity information https://fedorahosted.org/sssd/ticket/1470 FreeIPA HBAC rules ignored when FreeIPA and SSSD are configured to set SELinux user context https://fedorahosted.org/sssd/ticket/1472 Duplicate detection in fail over does not work https://fedorahosted.org/sssd/ticket/1478 ldap_autofs_* options missing from /usr/share/sssd/sssd.api.d/sssd-ldap.conf https://fedorahosted.org/sssd/ticket/1480 1.9.0b6 does not build with SELinux disabled https://fedorahosted.org/sssd/ticket/1488 Segfault in IPA subdomain provider https://fedorahosted.org/sssd/ticket/1490 SSSD does not close TCP connections when SSL fails https://fedorahosted.org/sssd/ticket/1491 Consolidate functions that make a realm upper-case https://fedorahosted.org/sssd/ticket/1492 There is no /etc/selinux/targeted/logins on RHEL5 https://fedorahosted.org/sssd/ticket/1500 SSSD's default ccache location needs to be updated (again), and the man pages should reflect it == Detailed Changelog == Ariel Barria (1): * SIGUSR2 should force SSSD to reread resolv.conf as well Jakub Hrozek (32): * Bumping version for the 1.9.0 release * Don't call fo_set_{server,port}_status for SRV servers * Fix the version number * SYSDB: Check the return value * SYSDB: Use ldb_msg_add_string for simple string additions * Failover: Return last tried server if it's still being tried * Subdomains: Send the DP reply in the correct format * Always mark SRV servers as primary * Allocate on top of a talloc context, not NULL * Abort PAM access phase if HBAC does not return PAM_SUCCESS * Change default for ldap_idmap_range_min to 200000 * Don't use server after SRV data collapsed * Document entry_cache_autofs_timeout * Add autofs-related options to configAPI * sss_client: Group lookups should work even when fastcache cannot be initialized * FO: Don't retry the same server if it's not working * FO: Return EAGAIN if there are more servers to try * KRB5: Only return PAM error for unreachable kpasswd when performing chpass * Build SELinux code in responder conditionally * Do not try to remove the temp login file if already renamed * Only create the SELinux login file if there are mappings on the server * Fix compilation error in Python murmurhash bindings * Process all groups from a single nesting level * Use PTHREAD_MUTEX_ROBUST to avoid deadlock in the client * RPM: Switch the default ccache location * RPM: Always include the patch file * Check if the SELinux login directory exists * SYSDB: Commit transaction in sysdb_store_user * SYSDB: Abort unit test if sysdb_getpwnam fails * Retry the next server if bind during LDAP auth times out * Don't terminate the same connection twice * Update translations for 1.9.0 beta 7 release Jan Cholasta (3): * SSH: Return error code in SSH utility functions * SSH: Simplify public key formatting function * SSH: Add support for OpenSSH-style public keys Michal Zidek (10): * Return value of fread in src/tools/sss_debuglevel.c no longer ignored. * Change default value of ldap_sasl_string to host/hostname@REALM in man page. * SRV resolution for backup servers should not be permitted. * When ldap_group_nesting_level was reached, the LDAP provider tried to link group members with groups outside nesting limit. * Duplicate detection in fail over did not work. * Typo in debug message (SSSd -> SSSD). * Unify usage of sysdb transactions * Fix: IPv6 address with square brackets doesn't work. * Adding -std=gnu99 flag. * Unify usage of sysdb transactions (part 2). Nick Guay (1): * remove duplicate sss_obfuscate reference in seealso manpage section Ondrej Kos (5): * Removed unused variable assignment * Replaced "id_max" & "id_min" * Backward GOTOs rewritten into do-while loops. * AD context was set to null due to type mismatch * Consolidation of functions that make realm upper-case Pavel Březina (12): * tests: build sysdb ssh tests conditionally * shadow attributes can contain -1 * Add end of line to debug message * monitor: set debug level when unable to load configuration * Remove redefinition of some SYSDB_* macros * Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OC * Remove SYSDB_SUDO_CACHE_OC from attribute lists * Fix LOCAL domain lookups * Close LDAP connection when unable to install TLS * Unbreak build on RHEL5: replace ldap_destroy() with ldap_unbind_ext() * Remove compilation warning: ret may be uninitialized * Clean up cache on server reinitialization Stephen Gallagher (6): * SSSDConfig: Fix nonfunctional SSSDDomain.remove_provider() * IPA: Do not attempt to close the same file twice * IPA: Securely set umask for mkstemp in subdomain provider * MAN: Fix minor typo in ldap_search_base section * MAN: Improve description of ldap_*_search_base options * SYSDB: Make sysdb_attrs_get_el_int() public Sumit Bose (5): * Add python bindings for murmurhash3 * accept_fd_handler: add missing return * Fix fallback in validate_tgt() * Use new debug levels in validate_tgt() * Check flat names when searching for sub-domains as well Yuri Chornoivan (1): * Fix various typos in documentation.

1 0

Encoded Packet Size Too Big
by Wojtak, Greg (Superfly) 04 Sep '12

04 Sep '12

Every once in a while with SSSD, we run into a problem where we aren't able to get user information or authenticate users. We are using ldap/kerberos against an Active Directory set up over SSL (LDAPS) and we see the following message in the logs: encoded packet size too big (813957100 > 16777215) >From what I've been able to gather, this is something to do with the cyrus-sasl package. I've also seen this error pop up when doing operations with the openldap-clients (ldapsearch, ldapmodify). I've found that by specifying the minssf and maxssf values in the ldap* operations that the operations would then succeed. I'm wondering if the same type of fix would work for SSSD? Is there a way to specify the SSF of the SASL operations that SSSD uses? Is there another workaround for this? Greg Wojtak Sr. Unix Systems Engineer Office: (313) 373-4306 Cell: (734) 718-8472

4 9

sssd ldap bind timeout
by Olaf Gellert 04 Sep '12

04 Sep '12

Hi there, we do see some timeouts when sssd tries to bind to the LDAP server: (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [be_resolve_server_done] (4): Found address for server xxx1.domain.de: [10.11.12.13] TTL 21600 (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [fo_set_port_status] (4): Marking port 636 of server 'xxx1.domain.de' as 'working' (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [set_server_common_status] (4): Marking server 'xxx1.domain.de' as 'working' (Mon Aug 27 10:35:54 2012) [sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=abcdefg,ou=People,o=ldap,o=root (Mon Aug 27 10:35:59 2012) [sssd[be[LDAP]]] [be_run_offline_cb] (3): Going offline. Running callbacks. (Mon Aug 27 10:35:59 2012) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (1, 9, <NULL>) [Provider is Offline (Authentication service cannot retrieve authentication info)] In this case sssd seems to not ask the second ldap server? We ser the "ldap_search_timeout" option to 120 seconds (default is 6 seconds), but this does change the behaviour. We are running sssd 1.5.1 (as distributed with CentOS 5.X). Looking at all the different ldap timeout values, I guess that "ldap_network_timeout" is not the right thing (because network connect does work), could "ldap_opt_timeout" provide some solution (as I do not really understand what it does)? Cheers, Olaf -- Olaf Gellert email gellert(a)dkrz.de Deutsches Klimarechenzentrum GmbH phone +49 (0)40 460094 214 Bundesstrasse 45a fax +49 (0)40 460094 270 D-20146 Hamburg, Germany www http://www.dkrz.de Sitz der Gesellschaft: Hamburg Geschäftsführer: Prof. Dr. Thomas Ludwig Registergericht: Amtsgericht Hamburg, HRB 39784

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users September 2012