sssd-users March 2015

sssd-users@lists.fedorahosted.org

24 participants
19 discussions

sssd many ccache-files
by Sebastian.Gumprich＠t-systems.com 25 Mar '15

25 Mar '15

Hi sssd users, sssd creates many ccache-files under /var/lib/sss/db/. They become so much, that the maximum number of inodes (default: 32768) for the partition is reached. This results in several other problems (failed logins, processes can't create sockets, etc). Why are so many files created? Is there a way to limit the maximum number of created files? Right now I'm running a daily Cronjob that deletes the sssd-cache (sss_cache -E). I'm running RHEL6.6 and sssd 1.11.6 with AD as backend. Linux 2.6.32-504.el6.x86_64 #1 SMP Tue Sep 16 01:56:35 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux Thanks Sebastian

3 3

autofs support
by Paul B. Henson 19 Mar '15

19 Mar '15

Not too long back, we noticed a mention in a RHEL6 release note that sssd supported autofs now. We currently run autofs directly against ldap, but just for fun we thought we'd see how well it played with sssd, which is using the same ldap system for users/groups. Unfortunately, our initial try was unsuccessful. Based on reviewing the code, it looks like sssd wants to download the *entire* autofs map, including all entries, from ldap in order it serve it to autofs? We have something like 120000 users/groups, so that's not really feasible or desirable 8-/. Am I understanding the operation correctly? Or is there some way to get it to look up map entries as necessary like it does for users/groups? It doesn't try to suck all of the users or all of the groups out of ldap at initialization, I'm not sure why it wants to do so for autofs maps. Thanks...

4 27

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

Re: [SSSD-users] simple_allow_groups does not work: 4 (system error )
by Domenico Viggiani 18 Mar '15

18 Mar '15

> -----Original Message----- > From: Domenico Viggiani [mailto:dviggiani@tiscali.it] > > > -----Original Message----- > > > > Then I'm 100% sure we have a bug. The group shouldn't have the non- > > posix flag after it was updated. > > > > Can you tell us anything about this group: > > (Mon Mar 16 16:57:52 2015) [sssd[be[MYDOMAIN.COM]]] [sdap_save_group] > > (0x1000): Mapping group [Organigramma] objectSID [S-1-5-21- > 2248061571- > > 2151176789-1472819363-28039] to unix ID > > > > Is it from the same domain? What type does the group have? > > Searching for name "Organigramma", I get three results: > > dn: OU=Organigramma,OU=Liste di Distribuzione,DC=mydomain,DC=COM > ... Jakub, sorry for disturbance: had you a chance to review this problem? We are currently forced to allow login to all users on Red Hat 7 boxes. Do you suggest to open a 'parallel' ticket with Red Hat? Thanks --

2 1

autofs for different audiences or device types
by Brendan Kearney 17 Mar '15

17 Mar '15

i want to run different automounts for users on workstations or laptops vs users logging into servers. also, i would like certain processes to have different automounts. say i have a user, and the user automounts server:/directory under /home/user/localdir when logged into their daily-driver device. when that user logs into a server, i dont want that user to get the automount. how are people differentiating automounts for a given audience? i figure i could create different automountMaps and point the particular devices to specific maps, but is there a way to have all configs be the same and have the differentiation done in LDAP? say all devices point to one auto.master and get direct and/or indirect mappings from one place. is there a way to add criteria for which mappings are returned? you only get these keys if you are in this ip range or you only get those keys if the DNS name of the client machine is "host.domain.tld"? is it just easier to have different auto.masters for the different devices or audience i want to manage? thank you, brendan

3 2

SSSD with different AD UPN Suffixes
by Eugene Peregudov 11 Mar '15

11 Mar '15

Hi, I'm trying to authenticate Active Directory users with different UPN suffixes on my Linux machine. As described in article (http://jhrozek.livejournal.com/3019.html) SSSD should support for enterprise logins: "some users in AD might use a different Kerberos Principal suffix than the default one". I have two users with different UPN - user1(a)domain.example.com and user2(a)department.example.com #getent passwd user1(a)domain.example.com returns valid user entry, but #getent passwd user2(a)department.example.com returns nothing... What's wrong? Can anyone help me with this issue? Thanks! Target system: Red Hat Enterprise Linux Server release 7.0 (Maipo) host1.domain.example.com 3.10.0-123.13.2.el7.x86_64 x86_64 x86_64 x86_64 GNU/Linux sssd-1.11.2-68.el7_0.6.x86_64 --------------------------------------------------------------- Active Directory Domain: schema: 2008 R2 tld: domain.example.com --------------------------------------------------------------- Linux machine joined AD using command: #adcli join domain.example.com -U admin -S dc1.domain.example.com -H host1.domain.example.com -v -W --------------------------------------------------------------- sssd.conf: [sssd] config_file_version = 2 services = nss, pam domains = DOMAIN.EXAMPLE.COM [nss] [pam] [domain/DOMAIN.EXAMPLE.COM] debug_level = 10 id_provider = ad auth_provider = ad chpass_provider = ad access_provider = ad ad_domain = domain.example.com ad_server = dc1.domain.example.com,10.0.0.2 ad_hostname = host1.domain.example.com ldap_id_mapping = false ldap_schema = rfc2307 krb5_use_enterprise_principal = true enumerate = false entry_cache_timeout = 60 fallback_homedir = /home/org/users/%u shell_fallback = /bin/false dyndns_update = true --------------------------------------------------------------- krb5.conf: [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = DOMAIN.EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} dns_lookup_kdc = false [realms] DOMAIN.EXAMPLE.COM = { kdc = dc1.domain.example.com kdc = 10.0.0.2 admin_server = dc1.domain.example.com admin_server = 10.0.0.2 default_domain = domain.example.com } [domain_realm] .domain.example.com = DOMAIN.EXAMPLE.COM domain.example.com = DOMAIN.EXAMPLE.COM [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } --------------------------------------------------------------- sssd_DOMAIN.EXAMPLE.COM.log: [sbus_dispatch] (0x4000): dbus conn: 0x7f75d0504770 [sbus_dispatch] (0x4000): Dispatching. [sbus_message_handler] (0x4000): Received SBUS method [ping] [sbus_dispatch] (0x4000): dbus conn: 0x7f75d0519b20 [sbus_dispatch] (0x4000): Dispatching. [sbus_message_handler] (0x4000): Received SBUS method [getDomains] [be_get_subdomains] (0x0400): Got get subdomains [forced][department.example.com] [be_queue_request] (0x4000): Queue is empty, running request immediately. [be_queue_request] (0x4000): Adding request to queue. [sdap_id_op_connect_step] (0x4000): reusing cached connection [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [objectclass=domain][DC=domain,DC=example,DC=com]. [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 11 [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052de50], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] [sdap_parse_entry] (0x4000): OriginalDN: [DC=domain,DC=example,DC=com]. [sdap_parse_range] (0x2000): No sub-attributes for [objectSid] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052de50], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set [ad_master_domain_next_done] (0x0400): Found SID [S-1-5-21-1505972566-2156897661-2636268315]. [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(DnsDomain=domain.example.com)(NtVer=\14\00\00\00))][]. [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [netlogon] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 12 [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d0530150], ldap[0x7f75d0521980] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d0530150], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] [sdap_parse_entry] (0x4000): OriginalDN: []. [sdap_parse_range] (0x2000): No sub-attributes for [netlogon] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d0530150], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set [ad_master_domain_netlogon_done] (0x0400): Found flat name [DOMAIN]. [ad_master_domain_netlogon_done] (0x0400): Found forest [domain.example.com]. [ad_subdomains_master_dom_done] (0x0400): Connected to forest root, looking up child domains.. [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectclass=trustedDomain)(trustType=2)(!(msDS-TrustForestTrustInfo=*)))][DC=domain,DC=example,DC=com]. [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [flatName] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustPartner] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [securityIdentifier] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustType] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [trustAttributes] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 13 [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_REFERENCE] [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[0x7f75d052e870], ldap[0x7f75d0521980] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set [sdap_id_op_done] (0x4000): releasing operation connection [ad_subdomains_get_slave_domain_done] (0x1000): There are no changes [get_subdomains_callback] (0x0400): Backend returned: (0, 0, <NULL>) [Success] [be_queue_next_request] (0x4000): Request queue is empty. [sdap_process_result] (0x2000): Trace: sh[0x7f75d05225d0], connected[1], ops[(nil)], ldap[0x7f75d0521980] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! [be_ptask_execute] (0x0400): Task [Cleanup of DOMAIN.EXAMPLE.COM]: executing task, timeout 10800 seconds --------------------------------------------------------------- -- With best regards, Eugene JONIK Peregudov mailto: eugene.peregudov(a)gmail.com

3 11

GSSAPI Errors with AD Trust
by Baird, Josh 11 Mar '15

11 Mar '15

Hi, I'm having an issue with IPA/sssd (RHEL 7.1) when accessing resources through an AD trust. The following is logged in ldap_child.log (debug_level=10): (Tue Mar 10 12:31:12 2015) [sssd[be[unix.domain.com]]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (KDC has no support for encryption type)] This error seems to occur randomly. We have over 40+ DC's in our HUB site for active directory forest/domain. All of these DC's are running either Windows 2008 R2/Windows 2012/Windows 2012 R2. The domain/forest level is still Windows 2003. The trust is established between IPA (unix.domain.com) and the forest root AD domain (domain.com). The AD users actually exist in a child domain (ad.domain.com). I conducted a test where I deleted the sssd server cache (in /var/lib/sss/db/), restarted sssd, and then did a 'getent passwd user(a)domain.com.' There were several instances where sssd was successfully using one of the AD DC's, and then after clearing the cache and restarting failed on the same AD DC with the "KDC has no support for encryption type" error. Nothing is being logged to /var/log/sssd/krb5_child.log. We are running the following versions: ipa-server-4.1.0-18.el7.x86_64 ipa-server-trust-ad-4.1.0-18.el7.x86_64 sssd-1.12.2-58.el7.x86_64 Does anyone have an idea of what may be happening here? Thanks, Josh

2 1

How to purge sssd cache
by Varun Mittal3 08 Mar '15

08 Mar '15

Hi We are using sssd available on RHEL 7 and have a query on purging sssd cache incase domain goes offline. We are using just the UID/GID and group membership for users. And netgroups (both LDAP and NIS proxy) in some cases As I understand, sss_cache utility only invalidates the records, which marks them expired. Whenever the domain is online, these will be refreshed. But if the domain is offline, those expired records will still be returned as valid. - Please reconfirm if this understanding is correct - And if this is correct, then is there a way to purge the records to return users/group queries invalid if domain is offline Thanx & Regards, Varun Mittal

4 6

FreeIPA/SSSD LDAP cross-forest trust slow queries
by Aviolat Romain 06 Mar '15

06 Mar '15

Hi, We have setup FreeIPA (VERSION: 4.1.2, API_VERSION: 2.109) in our realm (IPA.DOMAIN1.COM), with trust to an AD forest (DOMAIN2.NET, which itself has trust to AD.DOMAIN2.NET, where the corporate users are). Everything works fine when using Kerberos, we can obtain tickets from AD.DOMAIN2.NET and authenticate to services in IPA.DOMAIN1.COM. We can also do "getent passwd user(a)ad.domain2.net" on a host enrolled in FreeIPA and quickly get a result. But we have some legacy applications that perform authentication with simple LDAP binds, so we have the compat tree enabled, and while trying to authenticate users in the AD.DOMAIN2.NET realm this way eventually succeeds, it takes an awfully long time (30 seconds or so, sometimes more), with a lot going on between the AD and FreeIPA. We've attached the log file of SSSD (version 1.12.4, we've upgraded based on advice from IRC #sssd, but the problem didn't go away) from the FreeIPA server while running "ldapwhoami -D uid=user(a)ad.domain2.net,cn=users,cn=compat,dc=ipa,dc=domain1,dc=com -W" from a client machine. The debug level was set to 0x07f0. On (rare) occasions, authentication is very fast while running the exact same command on the client machine. We've also attached the SSSD log file when that happens, for comparison. The log files have been sanitized and the slow log output was bit simplified, we removed 25 repeated events where sssd was trying to resolve unknown SIDs, it would have taken too much time to sanitize so we left 5 caching events only (we made a remark on the log file where we removed those lines.) Any advice is more than welcome. Thanks for your help. Cheers, Romain Aviolat Senior System Administrator - R&D and ops Infrastructure Kudelski Security - Kudelski Group rte de Genève 22-24, 1033 Cheseaux, SWITZERLAND +41 21 732 03 79

5 13

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users March 2015