sssd-users June 2019

sssd-users@lists.fedorahosted.org

16 participants
18 discussions

KCM credential forwarding behavior broken?
by James Ralston 09 Jun '19

09 Jun '19

I filed this issue a week or so ago: https://pagure.io/SSSD/sssd/issue/4017 In essence, it would seem that if KCM already has credentials in the cache, then KCM will never discard those credentials in favor of new credentials being forwarded via sshd, even if the credentials in the cache are expired. This is a showstopper bug for using KCM in any type of enterprise environment, where remote connections are frequent. Have I misunderstood what is actually happening? Or am I correct in that this a bug with KCM?

2 2

Re: enumerate in sssd.conf
by Dmitri Pal 05 Jun '19

05 Jun '19

Hello, Enumeration puts a lot of load on your directory. And with a big directory it can take several minutes pegging CPU and slowing down the performance of the client. Yes it is by design. SSSD will fetch and cache things on as needed basis. There are other means and tools that come with sssd that will help you to check if it is working or not. Thank you Dmitri On Wed, Jun 5, 2019 at 4:05 AM Alexander Fieroch < alexander.fieroch(a)mpi-dortmund.mpg.de> wrote: > Hi, > > I've set "enumerate = true" in sssd.conf which is working good for me > and our AD clients. > Now I recognized that RedHat does not recommend "enumerate = true" in > sssd.conf: > > <https://access.redhat.com/solutions/500433> > > When I disable enumarate in sssd, "getent passwd" does not list AD users > anymore. Is this normal behavior? > I use "getent passwd" for a quick test if sssd is working and finding AD > users... > > Best regards, > Alexander > > > -- Thank you, Dmitri Pal Director, Software Engineering Red Hat Enterprise Linux Platform Security and Identity Management dpal(a)redhat.com <https://red.ht/sig>

1 0

gdm login with smartcard set wrong username environment variables on RHEL8.0
by Winberg Adam 05 Jun '19

05 Jun '19

This is on RHEL8.0. Logging into gnome with smartcard results in username environment variables containing domain: $ env .... USER=a001329(a)ad.example.com USERNAME=a001329(a)ad.example.com LOGNAME=a001329(a)ad.example.com ... GDM debug log shows: Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: state AUTHENTICATED Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: trying to get updated username Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: username is 'a001329(a)ad.example.com' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: old-username='a001329(a)ad.example.com' new-username='a001329(a)ad.example.com' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: Found object path of user 'a001329(a)ad.example.com': /org/freedesktop/ Accounts/User60483 Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: finding user 'a001329(a)ad.example.com' state 3 Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: user 'a001329(a)ad.example.com' fetched Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: user a001329 is now loaded Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: user a001329 was not yet known, adding it Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: tracking user 'a001329' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: not yet loaded, so not emitting user-added signal Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: no pending users, trying to set loaded property Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: already loaded, so not setting loaded property Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: finished handling request for user 'a001329(a)ad.example.com' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: AccountsService: ActUserManager: unrefing manager owned by fetch user request Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: attempting to change state to AUTHORIZED Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: determining if authenticated user (password required:0) is authorized to session Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: state AUTHORIZED Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: attempting to change state to ACCREDITED Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'LOGNAME=a001329(a)ad.example.com' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'USER=a001329(a)ad.example.com' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'USERNAME=a001329(a)ad.example.com' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'HOME=/home/a001329' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'PWD=/home/a001329' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'SHELL=/bin/bash' Jun 05 14:06:27 c21637.ad.example.com gdm-smartcard][30108]: GdmSessionWorker: Set PAM environment variable: 'PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin' So it seems GDM gets the username with the domain part from the pam stack - i.e. pam_sss. So, I don't understand why sssd seems to pass username with domain part to the pam stack? Some bad config on my part or a bug? sssd_pam debug log: https://pastebin.com/raw/dQeLCNsF Adam Winberg ITpc SMHI Telefon 011-4958058 Fax 011-4958350 Epost Adam.Winberg(a)smhi.se<mailto:Adam.Winberg@smhi.se> 601 76 Norrköping Besöksadress Folkborgsvägen 1 www.smhi.se<http://www.smhi.se>

2 2

Identity information not cached for login?
by manuel.nuno.melo＠gmail.com 05 Jun '19

05 Jun '19

(reopening here after mis-posting to the devel list) Hello, I am using SSSD with NIS via the proxy id_provider and auth_provider (full conf below). I hoped that SSSD's cache would work around the sandboxing of systemd's logind that won't, by default, allow outgoing connections to the provider (see https://github.com/systemd/systemd/issues/7074). User and credential lookup works fine and I can log in remotely via ssh. However, immediately after auth, at session setup-time, pam_systemd.so calls logind, which calls getpwuid(), which in turn causes a NIS lookup that hangs because of the sandbox. Failure of pam_systemd.so also means I can't login via the GUI. I was hoping that SSSD's cache, which is up-to-date because of the immediately preceding auth, would be used instead of the NIS lookup. My alternative right now is to specifically disable that sandbox, as described in the link above, but I'd rather understand this completely and perhaps avoid that. I'm on Ubuntu 18.04, with sssd 1.16.1. sssd.conf: [sssd] services = nss, pam config_file_version = 2 domains = my.domain.name [nss] filter_groups = root filter_users = root reconnection_retries = 3 cache_first = true [pam] reconnection_retries = 3 pam_verbosity = 3 offline_failed_login_attempts = 3 offline_failed_login_delay = 1 # increased this in hopes of fixing the issue. Nope... pam_id_timeout = 35 cache_first = true [domain/my.domain.name] id_provider = proxy auth_provider = proxy proxy_lib_name = nis proxy_pam_target = none cache_credentials = true # increased this in hopes of fixing the issue. Nope... cached_auth_timeout = 30 # Tried with and without enumeration. No difference. enumerate = true The relevant PAM file -- /etc/pam.d/common-session. In my tests via ssh was included via /etc/pam.d/sshd: session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session optional pam_umask.so session required pam_unix.so session optional pam_sss.so # if I comment or skip the next line I get clean ssh logins, but still failing GUI logins. session optional pam_systemd.so nsswitch.conf: passwd: compat systemd sss group: compat systemd sss shadow: compat sss gshadow: files hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname networks: files protocols: db files services: db files ethers: db files rpc: db files sudoers: files getent output getent passwd testuser: testuser:$6$salted_hashed_password.:1100:100::/home/testuser:/bin/bash getent -s sss passwd testuser: testuser:*:1100:100::/home/testuser:/bin/bash getent -s sss shadow testuser: <no output>

3 4

[alexander.fieroch@mpi-dortmund.mpg.de: enumerate in sssd.conf]
by Jakub Hrozek 05 Jun '19

05 Jun '19

2 2

Any way to convince realm join not to do authselect in RHEL8?
by Spike White 04 Jun '19

04 Jun '19

All, Basically here is the realm command we use to join the appropriate regional AD domain: realm join -v --automatic-id-mapping=no --computer-ou="OU=Servers,OU=UNIX,DC=$SUPPORTREGION,DC=COMPANY,DC=COM" --user-principal="host/`hostname --fqdn`@$JOINDOMAIN" $JOINDOMAIN As part of this, realm join internally runs the following command: * /usr/bin/sh -c /usr/bin/authselect select sssd with-mkhomedir --force && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service But that sets /etc/pam.d/password-auth and /etc/pam.d/system-auth to a sub-optimal PAM stack. I.e., not what we desire. For example, 99.9% of our users are in AD. So we want to run pam_sssd *before* pam_unix. We are very comfortable with testing and debugging PAM stacks. We have a stable, tested PAM stack that works great -- ever since RHEL7. Basically, after the 'realm join' above is done, we have to overwrite /etc/pam.d/{system-auth,password-auth,postlogin} with what we desire. If 'realm join' can't be convinced to not run authselect, we're ok with creating a custom/profile authselect profile with what we want. And then convince realm join to run: authselect select custom/profile Instead of the above authselect select sssd Prior to running 'realm join', I have to drop down a /etc/realmd.conf file so that the 'realm join' behaves as I want it to. Is there any option in realmd.conf to not run authselect or tailor the authselect command? Or may a flag on the 'realm discover' command line? I don't remember any of these problems with realm join on RHEL7. Maybe it was running authconfig inappropriately as well -- and I just never noticed, because I over-wrote with desired PAM stack? Spike

3 4

[alexander.fieroch@mpi-dortmund.mpg.de: SSSD + samba shares]
by Sumit Bose 03 Jun '19

03 Jun '19

----- Forwarded message from Alexander Fieroch <alexander.fieroch(a)mpi-dortmund.mpg.de> ----- Date: Mon, 20 May 2019 15:52:30 +0200 From: Alexander Fieroch <alexander.fieroch(a)mpi-dortmund.mpg.de> To: sssd-users-owner(a)lists.fedorahosted.org Subject: SSSD + samba shares Hi, I'm using SSSD for my AD integration and samba shares. Since my last upgrade (ubuntu 18.10 -> 19.04) to samba 4.10.0 and sssd 1.16.3 samba shares are not working anymore and I got the error message in /var/log/samba/log.smbd: [2019/05/20 12:09:23.022488, 0] ../../source3/auth/auth_util.c:1386(make_new_session_info_guest) create_local_token failed: NT_STATUS_NO_MEMORY [2019/05/20 12:09:23.022542, 0] ../../source3/smbd/server.c:2041(main) ERROR: failed to setup guest info. Newer samba versions require a running winbindd but I use SSSD instead of winbindd which was working before. The samba team says SSSD is not supported by samba and I should use winbindd. But I want to stay with SSSD. So what is the recommended SSSD and samba configuration to get samba shares working while using SSSD? Or is it not possible anymore to use only SSSD with samba shares without winbind? Thanks! Best regards /etc/samba/smb.conf: [global] disable netbios = Yes dns proxy = No domain master = No kerberos method = system keytab local master = No log file = /var/log/samba/log.%m map to guest = Bad User max log size = 1000 obey pam restrictions = Yes pam password change = Yes panic action = /usr/share/samba/panic-action %d passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . passwd program = /usr/bin/passwd %u realm = DOMAIN security = ADS server role = member server server string = %h %a syslog = 0 unix password sync = Yes usershare allow guests = Yes workgroup = DOMAIN ----- End forwarded message -----

4 8

SSSD and Samba
by Dav Banks 03 Jun '19

03 Jun '19

Hi There, I was wondering if anyone has experience with using sssd for samba authentication. I’ve gotten sssd working for getent tools but when a user tries to access a share that they have permissions to via a group they get a permissions denied error. If I add the user directly to the ACL it works fine. I can post more info but was just wondering if this is a known problem or just something strange with me. ------------------------------- Dav Banks

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2019