sssd-users October 2017

sssd-users@lists.fedorahosted.org

33 participants
34 discussions

Re: [Freeipa-interest] Announcing SSSD 1.16.0
by Michael Ströder 23 Oct '17

23 Oct '17

HI! Has anything changed with building the man pages? I'm asking because I now get formatting markup in the output of man (see below). Ciao, Michael. SSSD-LDAP(5) File Formats and Conventions SSSD-LDAP(5) .SH "NAME" sssd-ldap - SSSD LDAP provider .SH "DESCRIPTION" .PP This manual page describes the configuration of LDAP domains for sssd(8). Refer to the “FILE FORMAT” section of the sssd.conf(5) manual page for detailed syntax information. .PP You can configure SSSD to use more than one LDAP domain.

1 0

Kerberos Ticket renewal within Samba AD Domain
by Michael Löffler 21 Oct '17

21 Oct '17

Dear SSSD Users, I have a question regarding the renewal of Kerberos tickets within a Samba AD. All servers and clients are running Ubuntu 16.04. We have a lot of Windows clients too; therefore we're using Samba. First of all, I'll summarize our setup: - One server acts as the Samba AD Host (and Kerberos (integrated in Samba) principal) - One server acts as a file server; all directories (the users' home directories as well) are exported via kerberized NFS - The clients mount the directories; login auth is realized using sssd (with id_provider = ad, auth_provider = ad and access_provider = ad) When a user logs in at a client, he gets a Kerberos ticket and is therefore granted access to his home directory. If he locks the screen and logs in again, the ticket is renewed. However, if the user keeps the client locked for a time greater than the ticket lifetime, the ticket expires and the user is not able to write to his home directory any more. That's a problem if the user is, for example, running a process which takes a long time (in our case mostly simulations which are usually run overnight). The same things happens if a user connects to a client via ssh. Then, the ticket is never renewed automatically. Is it somehow possible to configure that sssd renews the krb5 ticket if the user has active processes running? Regards Michael

3 6

shortnames for 2 realms in Centos6
by Hampus Lundqvist 21 Oct '17

21 Oct '17

Hello Im searching for a solution to use shortnames for users from both FreeIPA(4.5) realm and a from a Trusted AD realm, I'm using Centos6.9 which has sssd 1.13. I’m doing it for the centos7’s using domain resolution order in the IPA server. Anyone has any suggestion on how to accomplish this on centos6? BR Hampus

4 5

SSSD trusted domain in forest
by Andreas Hauffe 21 Oct '17

21 Oct '17

Hi, I try to configure a client that is member of active directory domain s2dom.d1dom.dom.example.com which is a subdomain of d1dom.dom.example.com which itself is a subdomain of dom.example.com. Now I try to to login with users from user(a)dom.example.com and user1(a)s2dom.d1dom.dom.example.com. The last one works without problems. But I'm not able to get a user(a)dom.example.com working. my sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = s2dom.d1dom.dom.example.com [nss] default_shell=/bin/bash override_homedir = /home/%u [pam] [domain/s2dom.d1dom.dom.example.com] id_provider = ad access_provider = ad ldap_schema = ad ldap_id_mapping=true ldap_idmap_range_min=1000000 ldap_idmap_range_max=2000000 ldap_idmap_range_size=1000000 use_fully_qualified_names = true Regards Andreas

2 1

pam_sss force smartcard for TTY logins
by Winberg, Adam 20 Oct '17

20 Oct '17

Using pam_pkcs11 we can use the parameter 'wait_for_card' to halt the pam process until a smart card is inserted. Is there any feature like that with pam_sss? Use case is to require smart card for logins. With GDM this is configured via dconf, but with console/tty logins there is no such configuration available as I know of. So with pam_sss you can freely logon to a TTY without using smartcard. Or maybe there is a solution out there I'm missing? Regards Adam

2 3

p11_child showing certificate on smart card not valid
by Winberg, Adam 20 Oct '17

20 Oct '17

I'm trying to get smartcard auth working with sssd on RHEL 7.4. We currently use a pam_pkcs11/pam_krb5 setup and I was hoping to simplify this by using sssd instead. Unfortunately I cant get it to work, sssd does not seem to detect my smartcard certificate. Running p11_child I get the following: $ /usr/libexec/sssd/p11_child --pre -d 10 --debug-fd=2 --nssdb=/etc/pki/nssdb --pin (Thu Oct 19 10:43:19:786759 2017) [[sssd[p11_child[6320]]]] [main] (0x0400): p11_child started. (Thu Oct 19 10:43:19:786836 2017) [[sssd[p11_child[6320]]]] [main] (0x2000): Running in [pre-auth] mode. (Thu Oct 19 10:43:19:786849 2017) [[sssd[p11_child[6320]]]] [main] (0x2000): Running with effective IDs: [0][0]. (Thu Oct 19 10:43:19:786859 2017) [[sssd[p11_child[6320]]]] [main] (0x2000): Running with real IDs [0][0]. (Thu Oct 19 10:43:20:755639 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Default Module List: (Thu Oct 19 10:43:20:755722 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [NSS Internal PKCS #11 Module]. (Thu Oct 19 10:43:20:755753 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [(null)]. (Thu Oct 19 10:43:20:755780 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [p11-kit-trust]. (Thu Oct 19 10:43:20:755864 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [/usr/lib64/pkcs11/p11-kit-trust.so]. (Thu Oct 19 10:43:20:755900 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [OpenSC PKCS #11 Module]. (Thu Oct 19 10:43:20:755958 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [/usr/lib64/pkcs11/opensc-pkcs11.so]. (Thu Oct 19 10:43:20:755992 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Dead Module List: (Thu Oct 19 10:43:20:756025 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): DB Module List: (Thu Oct 19 10:43:20:756057 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [NSS Internal Module]. (Thu Oct 19 10:43:20:756085 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [(null)]. (Thu Oct 19 10:43:20:756112 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): common name: [Policy File]. (Thu Oct 19 10:43:20:756140 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): dll name: [(null)]. (Thu Oct 19 10:43:20:771873 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [NSS User Private Key and Certificate Services Mozilla Foundation ] Manufacturer [Mozilla Foundation ] flags [1]. (Thu Oct 19 10:43:20:771969 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [NSS Internal Cryptographic Services Mozilla Foundation ] Manufacturer [Mozilla Foundation ] flags [1]. (Thu Oct 19 10:43:20:772007 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [/usr/share/pki/ca-trust-source PKCS#11 Kit ] Manufacturer [PKCS#11 Kit ] flags [1]. (Thu Oct 19 10:43:20:772037 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [/etc/pki/ca-trust/source PKCS#11 Kit ] Manufacturer [PKCS#11 Kit ] flags [1]. (Thu Oct 19 10:43:20:772245 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Description [Alcor Micro AU9540 00 00 Generic ] Manufacturer [Generic ] flags [7]. (Thu Oct 19 10:43:20:772290 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Found [identification (Instant EID IP9)] in slot [Alcor Micro AU9540 00 00][0] of module [3][/usr/lib64/pkcs11/opensc-pkcs11.so]. (Thu Oct 19 10:43:20:772320 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Token is NOT friendly. (Thu Oct 19 10:43:20:772346 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Trying to switch to friendly to read certificate. (Thu Oct 19 10:43:20:772372 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Login required. (Thu Oct 19 10:43:20:772397 2017) [[sssd[p11_child[6320]]]] [do_work] (0x0020): Login required but no pin available, continue. (Thu Oct 19 10:43:20:773994 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): found cert[identification (Instant EID IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] (Thu Oct 19 10:43:20:774071 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): Filtered certificates: (Thu Oct 19 10:43:20:774167 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): found cert[identification (Instant EID IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] (Thu Oct 19 10:43:20:804677 2017) [[sssd[p11_child[6320]]]] [do_work] (0x0040): Certificate [identification (Instant EID IP9):user1][CN=user1,OU=People,DC=ad,DC=example,DC=com] not valid [-8062], skipping. (Thu Oct 19 10:43:20:804857 2017) [[sssd[p11_child[6320]]]] [do_work] (0x4000): No certificate found. What does the error code '-8062' mean? Regards, Adam

3 7

p11_child selinux woes
by Winberg, Adam 20 Oct '17

20 Oct '17

I'm running tests with using sssd for smartcard auth as an pam_pkcs11 replacement. I've gotten it to work, but am getting a _lot_ of selinux denials. It seems that p11_child inherits the sssd selinux context and therefore runs in the 'sssd_t' domain. This causes problems since p11_child seems to want access to a whole lot of stuff. Some examples: SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory fs. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /dev/hugepages. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /proc/fs/nfsd. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /boot. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /home. SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory /var/lib/nfs. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /. SELinux is preventing /usr/libexec/sssd/p11_child from execute access on the file /run/user/60483/ffiSOUzGu (deleted). SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /sys/fs/fuse/connections. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /dev. SELinux is preventing /usr/libexec/sssd/p11_child from execute access on the file /dev/shm/ffi8thWCx (deleted). SELinux is preventing /usr/libexec/sssd/p11_child from execute access on the file /run/ffi24njzA (deleted). SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /sys/kernel/config. SELinux is preventing /usr/libexec/sssd/p11_child from write access on the directory /sys/fs/selinux. An Sealert output: SELinux is preventing /usr/libexec/sssd/p11_child from search access on the directory .config. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that p11_child should be allowed search access on the .config directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'p11_child' --raw | audit2allow -M my-p11child # semodule -i my-p11child.pp Additional Information: Source Context system_u:system_r:sssd_t:s0 Target Context unconfined_u:object_r:config_home_t:s0 Target Objects .config [ dir ] Source p11_child Source Path /usr/libexec/sssd/p11_child Port <Unknown> Host c21226.ad.smhi.se Source RPM Packages sssd-krb5-common-1.15.2-50.el7_4.6.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.5.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name c21226.ad.smhi.se Platform Linux c21226.ad.smhi.se 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 13 10:46:25 EDT 2017 x86_64 x86_64 Alert Count 29 First Seen 2017-10-20 08:14:10 CEST Last Seen 2017-10-20 13:21:38 CEST Local ID 17d70bbe-a54d-47c3-8515-985d6646a93f Raw Audit Messages type=AVC msg=audit(1508498498.877:13286): avc: denied { search } for pid=29036 comm="krb5_child" name=".config" dev="sda2" ino=16782181 scontext=system_u:system_r:sssd_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir type=SYSCALL msg=audit(1508498498.877:13286): arch=x86_64 syscall=openat success=no exit=EACCES a0=ffffffffffffff9c a1=56536c43c350 a2=90800 a3=0 items=0 ppid=20098 pid=29036 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=krb5_child exe=/usr/libexec/sssd/krb5_child subj=system_u:system_r:sssd_t:s0 key=(null) Hash: p11_child,sssd_t,config_home_t,dir,search Whats with all the acceses, is that normal? And if so, how's that suppose to work while running in the 'sssd_t' context? Regards Adam

2 2

kerberos/sssd lowercase problem
by Hampus Lundqvist 20 Oct '17

20 Oct '17

Hi Facing an issue where kinit defaults to using realm name in lowercase. Im switching to the user and execute 'kinit' the krb5kdc.log shows that it uses lowercased realm name and kinit gives an e-text error.. if I run as same user: kinit username it will add @REALM.. i did use "su" to become this user. Krb5.conf is running with defaults from ipa-client install, sssd 1.15. Any ideas? BR Hampus

2 1

sssd pam password
by Günther J. Niederwimmer 19 Oct '17

19 Oct '17

Hello, CentOS 7.4 I mean this is a old question :-(. but is it possible to have a password from sssd ? My Problem is, I installed FreeIPA and like to have a Dovecot SASL -> postfix installation? I configured Dovecot to use PAM, but with this I have no password for the postfix! What is the correct way to have a secure authentication for dovecot SASL -> postfix? Have I to do this with LDAP or is it possible with a "normal" way. Thanks for a answer, -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

2 3

sudo trying to use proxy for auth
by Asif Iqbal 18 Oct '17

18 Oct '17

I setup sssd to login with 2 factor auth and it works fine and then I am failing to sudo with ldap even though id_provider is ldap. Here is log from sssd_LDAP when running sudo -s http://dpaste.com/36PTMS0.txt Here is relevant config [domain/LDAP] chpass_provider = krb5 access_provider = ldap id_provider = ldap ... auth_provider = proxy proxy_pam_target = securid .. There is no sudo_* in here sudo -s works if I use the auth provider, which is 2FA. So it seems like sudo auth follows whatever auth_provider is set to? Can I have ssh login with proxy as auth provider and sudo login with ldap as auth provider? I know both ssh and sudo login works with ldap and krb5, but I need to have the ssh login with 2FA in my env. Thanks for your help -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users October 2017