sssd-users April 2021

sssd-users@lists.fedorahosted.org

10 participants
12 discussions

sssd performance on large domains
by zfnoctis＠gmail.com 03 Feb '22

03 Feb '22

Hi, I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases. Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment. Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows. Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems. I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways. Thanks for your time.

6 29

kcm, gssproxy and klist
by Winberg Adam 16 Dec '21

16 Dec '21

With KCM and gssproxy we often see a long list of credentials when doing a 'klist': [user.u@lxserv2114 ~]$ klist Ticket cache: KCM:17098:66803 Default principal: user.u@AD Valid starting Expires Service principal 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: 01/01/1970 00:00:00 01/01/1970 00:00:00 Encrypted/Credentials/v1@X-GSSPROXY: and so on... The actual gssproxy credentials at /var/lib/gssproxy/clients/ does not correspond with this output, it only contains what could be expected - a TGT and maybe some service tickets. The ever growing 'klist' list of credentials is a problem, after a while the user can no longer get any new credentials and therefore has no access to its NFS homedir (sec=krb5). I'm guessing it's the 'max_uid_ccaches' option in sssd-kcm that prevents this. What is going on here - have we configured gssproxy/kcm wrong or is this a bug? Regards Adam

3 5

sssd: AD range retrieval fails when enumeration is enabled
by R Davies 09 Aug '21

09 Aug '21

Hi, When enumeration is enabled (required due to legacy application), and where a group has > 1500 members, and AD's MaxValRange is at the default 1500, then sssd fails to show more than 1500 group members. Group lookups are no longer accurate. A further interesting aspect is that if the sssd cache is expired (sssctl cache-expiry -E), then the correct group membership is shown until such time as enumeration is processed again (i.e. at most ldap_enumeration_refresh_timeout + memcache_timeout) src/providers/ldap/sdap.c's sdap_parse_entry() states: /* This attribute contained range values and needs more to > * be retrieved > */ > /* TODO: return the set of attributes that need additional retrieval > * For now, we'll continue below and treat it as regular values. > */ As enumeration is enabled the subsequent ASQ/deref work is never undertaken. As such sssd only ever processes the initial range retrieved members (0-1499) (NB that nested groups members are evaluated). We have looked at the relevant source code, but can't find a way to trigger Attribute Scope Queries (ASQ)/deref. Indeed, no manner of sssd configuration settings (other than disabling enumeration - which we sadly cannot do) appears to change this behaviour. Increasing MaxValRange on AD defeats the purpose of having MaxValRange. Has anyone run into this before? Or, should I raise a new issue? Many Thanks. R.

5 7

ID Views for IPA ID Views for AD users inconsistent resolution
by Louis Abel 01 Aug '21

01 Aug '21

I didn't get a response in #sssd, so I figured I'll try here at the mail list. # rpm -q sssd ipa-server sssd-1.16.0-19.el7_5.5.x86_64 ipa-server-4.5.4-10.el7_5.3.x86_64 I've been scratching my head trying to resolve this particular issue. I'm having issues with AD users where when they login, they'll get the UID/GID assigned in the ID views correctly, but only some of the time. Other times, they won't get the id view assigned to them. This is all done in the default trust view. What makes this issue even more interesting is that out of my 6 domain controllers, sometimes it'll be one server out of the six that does it, sometimes it's two. But it's never the same ones, so it's difficult to track the particular issue down. What's even more interesting is this is not occurring with some users (like my own). I have yet to see it occur with my account or even the rest of my team's accounts. One of the things I tried to do is delete the ID views of the offending users and recreate them to no avail. I put SSSD into debug mode on the IPA servers and tried to get some relevant logs and such to try and figure this out. Below is my SSSD configuration, ldb info, and debug logs (removing private information where possible). I'm trying to determine if this is either a bug within SSSD or if this is a misconfiguration on my part. $ ldbsearch -H cache_ipa.example.com.ldb name=user.name(a)ad.example.com originalADuidNumber uidNumber originalADgidNumber gidNumber asq: Unable to register control with rootdse! # record 1 dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb originalADuidNumber: 55616902 originalADgidNumber: 55616902 uidNumber: 55616902 gidNumber: 55616902 $ ipa idoverrideuser-show "Default Trust View" user.name(a)ad.example.com Anchor to override: user.name(a)ad.example.com UID: 40001 GID: 40001 Home directory: /home/user.name Login shell: /bin/bash $ ldbsearch -H timestamps_ipa.example.com.ldb | less dn: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb objectCategory: user originalModifyTimestamp: 20180823172515.0Z entryUSN: 92632390 initgrExpireTimestamp: 1535133621 lastUpdate: 1535128235 dataExpireTimestamp: 1535133635 distinguishedName: name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb ## DEBUG LOGS (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 32 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 32 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1080], connected[1], ops[(nil)], ldap[0x55f30a5d0f90] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [ipaanchoruuid=:SID:S-1-5-21-922099545-2851689246-2917073205-16902,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [loginShell] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [uidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaAnchorUUID] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [gidNumber] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [homeDirectory] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaOriginalUid] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a645310], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 32 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): Found override for object with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-16902))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [uidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x0080): Override attribute for [gidNumber] has more [2] than one value, using only the first. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [gidNumber] with [40001] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [homeDirectory] with [/home/user.name] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_apply_default_override] (0x4000): Override [loginShell] with [/bin/bash] for [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a6819a0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a681a60 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a681a60 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a6819a0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [safe_original_attributes] (0x4000): Original object does not have [sshPublicKey] set. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a683c50 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a683d10 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a683d10 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a683c50 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_ldb_msg_difference] (0x2000): Replaced/extended attr [uidNumber] of entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d1c0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a68d280 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a68d280 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d1c0 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sysdb_set_entry_attr] (0x0200): Entry [name=user.name(a)ad.example.com,cn=users,cn=ad.example.com,cn=sysdb] has set [cache, ts_cache] attrs. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a68d330 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a688900 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a689320 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6893e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a688900 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a68d330 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55f30a634920 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55f30a6349e0 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6893e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a689320 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Running timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Destroying timer event 0x55f30a6349e0 "ltdb_timeout" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ldb] (0x4000): Ending timer event 0x55f30a634920 "ltdb_callback" (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 0/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Fetching group S-1-5-21-922099545-2851689246-2917073205-20676 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000): Searching 172.20.23.190:389 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))][cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=chotel,dc=com]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 33 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 33 timeout 6 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55f30a5d1940], connected[1], ops[0x55f30a63f270], ldap[0x55f30a5ce320] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 33 finished (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:SID:S-1-5-21-922099545-2851689246-2917073205-20676))]. (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_initgr_get_overrides_step] (0x1000): Processing group 1/1 (Fri Aug 24 16:30:12 2018) [sssd[be[ipa.example.com]]] [ipa_get_ad_memberships_send] (0x0400): External group information still valid. ## /etc/sssd/sssd.conf [domain/ipa.example.com] cache_credentials = True krb5_store_password_if_offline = True # krb5_realm = IPA.EXAMPLE.COM ipa_domain = ipa.example.com ipa_hostname = entl01.ipa.example.com # Server Specific Settings ipa_server = entl01.ipa.example.com ipa_server_mode = True subdomain_homedir = %o fallback_homedir = /home/%u default_shell = /bin/bash id_provider = ipa auth_provider = ipa access_provider = ipa chpass_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt [sssd] services = nss, sudo, pam, ssh domains = ipa.example.com [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd,tomcat,activemq,informix,oracle,xdba,grid,dbadmin,weblogic,operator,postgres,devolog memcache_timeout = 600 homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp]

2 1

p11_child doesn't use 2nd slot if 1st slot is empy
by Assaf Morami 15 Jul '21

15 Jul '21

Hello everyone. I'm trying to configure smart card login of active directory users on an ubuntu machine. I'm following this guide: https://scriptech.io/linux-enable-smartcard-authentication-against-active-d… But for me the opensc library cannot talk with my card and I'm using a library that my card provider gave my. My issue right now is that `p11_child --pre --nssdb=/etc/pki/nssdb` fails to pull the certificate from my smart card. I'm able to log in with AD users and their smart cards using `kinit` and `ksu`, so I know the cards are okay. What's weird to me is that `modutil -list` shows slot 0 as empty and slot 1 as not empty, and then `p11_child --pre` doesn't try to use slot 1. Maybe p11_child thinks that if slot 0 is empty then slot 1 must be empty too? Please help! Here are the relevant logs: ``` # modutil -dbdir nssdb -list Listing of PKCS #11 Modules ---------------------------------------------------- 1. NSS Internal #11 Module uri: pkcs11: library-manufacturer=Mozilla%20Foundation; library-description=NSS%20Internal%20Crypto%20Services;library slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203 slot: NSS User Private Key and Certificate Services token: NSS Certificate DB uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation; serial=0000000000000000;model=NSS%203 2. MyTest library name: mylib.so uri: pkcs11:library-manufacturer=Boring%20Ent.;library-description=Cryptokit%20Extended%20Version;libversion=5.3 slots: 2 slots attached status: loaded slot: [EMPTY] token: uri: pkcs11: slot: Athena ASE IIIe (SBR069-00000) 00 00 token: 918 uri: pkcs11:token=918;manufacturer=Boring%20Ent.;serial=0349B7D30E11024G;model=PKISmartCard%20(A) ``` ``` # p11_child --pre --nssdb=nssdb -d=9 [main] (0x0400): p11_child started. [main] (0x2000): Running in [pre-auth] mode. [main] (0x2000): Running with effective IDs: [0][0]. [do_card] (0x4000): Default Module List: [do_card] (0x4000): common name: INSS Internal PKCS #11 [do_card] (0x4000): dll name: [(null)). [do_card] (0x4000): common name: [MyTest] [do_card] (0x4000): dll name: [Libsadaptor.so]. [do_card] (0x4000): Dead Module List: [do_card] (0x4000): DB Module List: [do_card] (ex4000): common name: [NSS Internal Module]. [do_card] (0x4000): dll name: [(null)]. [do_card] (0x4000): Description [NSS Internal Cryptographic Services Mozilla Foundation] Manufacturer [Mozilla Foundation] flags [9] removable [false] token present [true]. [do_card] (0x4000): Description [NSS User Private Key and Certificate Services Mozilla Foundation] Manufacturer [Mozilla Foundation] flags [1] removable [false] token present [true]. [do_card] (0x4000): Description [[EMPTY] Boring Ent.] Manufacturer [Boring Ent.] flags [2] removable [true] token present [false]. [do_card] (0x4000): Token not present. [main] (0x0040): do-work failed. [main] (Ox0020): p11_child failed! ```

2 4

KRb5KDC Service starts but stops shortly
by Ash Ryder 26 Apr '21

26 Apr '21

Hello Guys, I am having a bit of trouble keeping the krb5kdc service up for longer than 10mins. I have just installed Free IPA on our windows domain and can authenticate when the service is up to the IPA server with my windows credentials. Any help would be much appreciated. Please let me know which required information/logs would assist. The service errors with the following: Loaded: loaded (/usr/lib/systemd/system/krb5kdc.service; disabled; vendor preset: disabled) Active: failed (Result: core-dump) since Mon 2021-04-26 10:09:02 AEST; 3h 55min ago Process: 139132 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid $KRB5KDC_ARGS (code=exited, status=0/SUCCESS) Main PID: 139136 (code=dumped, signal=ABRT) LOG SSD_Example.com shows this around the same time the service stops (2021-04-26 10:08:53): [be[linux.example.com]] [sdap_id_conn_data_expire_handler] (0x0080): connection is about to expire, releasing it (2021-04-26 10:09:01): [be[linux.example.com]] [sasl_bind_send] (0x0020): ldap_sasl_bind failed (-2)[Local error] (2021-04-26 10:09:01): [be[example.com]] [sasl_bind_send] (0x0080): Extended failure message: [SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Cannot contact any KDC for realm 'LINUX.EXAMPLE.COM')] KRB5KDC.LOG Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) 10.2.0.208: NEEDED_PREAUTH: host/IPA01.linux.example.com(a)LINUX.EXAMPLE.COM for krbtgt/LINUX.EXAMPLE.COM(a)LINUX.EXAMPLE.COM, Additional pre-authentication required Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): closing down fd 12 Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139136](Error): worker 139142 exited with status 134 Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) 10.2.0.208: ISSUE: authtime 1619395741, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, host/IPA01.linux.example.com(a)LINUX.EXAMPLE.COM for krbtgt/LINUX.EXAMPLE.COM(a)LINUX.EXAMPLE.COM Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): closing down fd 11 Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): closing down fd 10 Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): closing down fd 9 Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): closing down fd 8 Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): shutting down Apr 26 10:09:01 IPA01.linux.example.com krb5kdc[139141](info): IPA certauth plugin un-loaded. Thank in advance, Ash

2 1

Where is the reference to the better AD DC discovery algorithm recently implemented in a recent release?
by Spike White 22 Apr '21

22 Apr '21

All, I read with great interest the release notes on a recent sssd release notes. That terse note had a link to a fuller discussion on the better AD DC discovery algorithm. The original sssd AD DC discovery algorithm looked up the SRV records in DNS for this local AD domain. It randomly picked 5 AD DCs to send the CLDAP ping. the first AD DC that responded it would query to determine AD site and thus, preferred servers. However, if none of these 5 AD DCs respond -- game over! The new better discovery algorithm implements the same as Windows (& some commercial AD integration products such as Quest) implement. They do a CLDAP ping to *all* AD DCs found via SRV DNS lookup. The first AD DC that responds, it queries to determine AD site and thus, preferred servers. What is the difference? Quite a lot actually -- in the real world. Lots of companies when implementing DMZs or other tightly-firewalled segments (like back-traffic from public cloud) only allow access to 2-3 read-only DCs. Yet, the DNS SRV lookup will return all the DCs. RW and RO. You might be back 80 - 90 DCs, of which only 2-3 are truly reachable. Thus Windows, Quest and new sssd versions work here -- out of the box. Old sssd version only work if you specifically disable site discovery and hard-code the specific 2-3 RO DCs. BTW there is an RFC that documents this new better discovery algorithm. So -- where is the reference to this new discovery algorithm? And which recent sssd release implements it? I can't find it now. I'm stuck administering RHEL6, 7 and 8 servers. So it'll be years before I can enjoy this new discovery algorithm. But at least I have something to look forward to -- years from now. Spike

1 0

Hii
by Jaya Chandra 19 Apr '21

19 Apr '21

I’m receiving System Error (4) in the authentication log with kerboes and sssd. Can anybody help. Thanks & Regards Jaya Chandra B

2 1

[resolv_gethostbyname_done] (0x0040): querying hosts database failed [5]: Input/output error
by Sylvain CROUET 19 Apr '21

19 Apr '21

Hi, I joined a Ubuntu 20.04 server to a Windows domain, but I am stuck with the following errors in the /var/log/sssd_domain.log file: (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [resolv_gethostbyname_done] (0x0040): querying hosts database failed [5]: Input/output error (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [nsupdate_get_addrs_done] (0x0040): Could not resolve address for this machine, error [5]: Input/output error, resolver returned: [11]: Could not contact DNS servers (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [nsupdate_get_addrs_done] (0x0040): nsupdate_get_addrs_done failed: [5]: [Input/output error] (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [sdap_dyndns_dns_addrs_done] (0x0040): Could not receive list of current addresses [5]: Input/output error (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [5]: Input/output error (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [be_ptask_done] (0x0040): Task [Dyndns update]: failed with [5]: Input/output error (Tue Apr 13 15:07:38 2021) [sssd[be[my_domain]]] [sdap_sudo_load_sudoers_done] (0x0040): Received 0 sudo rules I checked the outputs of 'hostname' and 'hostname --fqdn' and they are correct. 'nslookup' resolves correctly the name of any other Windows server within the domain.

2 1

Help with pam_sss_gss.so
by Sam Morris 06 Apr '21

06 Apr '21

I have two Debian systems, and using pam_sss_gss.so for sudo works fine on one of them, but not the other. Both have SSSD 2.4.1 installed and are joined to FreeIPA domains.On the system where it works, the user is defined in the FreeIPA domain. On the system where it doesn't work, my user is an AD trust user. Here's what I get from sssd_pam.log: (2021-04-01 10:54:52): [pam] [server_common_rotate_logs] (0x0010): Debug level changed to 0x07f0 (2021-04-01 10:54:52): [pam] [sbus_issue_request_done] (0x0400): sssd.service.rotateLogs: Success (2021-04-01 10:55:00): [pam] [accept_fd_handler] (0x0400): Client [0x55b162023b40][19] connected to privileged pipe! (2021-04-01 10:55:00): [pam] [sss_cmd_get_version] (0x0200): Received client version [3]. (2021-04-01 10:55:00): [pam] [sss_cmd_get_version] (0x0200): Offered version [3]. (2021-04-01 10:55:00): [pam] [cache_req_send] (0x0400): CR #6: New request 'User by name' (2021-04-01 10:55:00): [pam] [cache_req_process_input] (0x0400): CR #6: Parsing input name [sam.morris(a)example.net] (2021-04-01 10:55:00): [pam] [sss_parse_name_for_domains] (0x0200): name 'sam.morris(a)example.net' matched expression for domain 'example.net', user is sam.morris (2021-04-01 10:55:00): [pam] [cache_req_set_name] (0x0400): CR #6: Setting name [sam.morris] (2021-04-01 10:55:00): [pam] [cache_req_select_domains] (0x0400): CR #6: Performing a single domain search (2021-04-01 10:55:00): [pam] [cache_req_search_domains] (0x0400): CR #6: Search will check the cache and check the data provider (2021-04-01 10:55:00): [pam] [cache_req_set_domain] (0x0400): CR #6: Using domain [example.net] (2021-04-01 10:55:00): [pam] [cache_req_prepare_domain_data] (0x0400): CR #6: Preparing input data for domain [example.net] rules (2021-04-01 10:55:00): [pam] [cache_req_search_send] (0x0400): CR #6: Looking up sam.morris(a)example.net (2021-04-01 10:55:00): [pam] [cache_req_search_ncache] (0x0400): CR #6: Checking negative cache for [sam.morris(a)example.net] (2021-04-01 10:55:00): [pam] [cache_req_search_ncache] (0x0400): CR #6: [sam.morris(a)example.net] is not present in negative cache (2021-04-01 10:55:00): [pam] [cache_req_search_cache] (0x0400): CR #6: Looking up [sam.morris(a)example.net] in cache (2021-04-01 10:55:00): [pam] [cache_req_search_send] (0x0400): CR #6: Returning [sam.morris(a)example.net] from cache (2021-04-01 10:55:00): [pam] [cache_req_search_ncache_filter] (0x0400): CR #6: This request type does not support filtering result by negative cache (2021-04-01 10:55:00): [pam] [cache_req_create_and_add_result] (0x0400): CR #6: Found 1 entries in domain example.net (2021-04-01 10:55:00): [pam] [cache_req_done] (0x0400): CR #6: Finished: Success (2021-04-01 10:55:00): [pam] [pam_cmd_gssapi_init_done] (0x0400): Trying GSSAPI auth: User[sam.morris(a)example.net], Domain[example.net], UPN[Sam.Morris(a)EXAMPLE.NET], Target[host(a)myself.ipa.example.net] (2021-04-01 10:55:00): [pam] [pam_cmd_gssapi_init_done] (0x0400): Returning [0]: Success (2021-04-01 10:55:00): [pam] [client_recv] (0x0400): Invalid data from client, closing connection! (2021-04-01 10:55:00): [pam] [accept_fd_handler] (0x0400): Client [0x55b162039780][19] connected to privileged pipe! (2021-04-01 10:55:00): [pam] [sss_cmd_get_version] (0x0200): Received client version [3]. (2021-04-01 10:55:00): [pam] [sss_cmd_get_version] (0x0200): Offered version [3]. (2021-04-01 10:55:00): [pam] [client_recv] (0x0400): Invalid data from client, closing connection! There's nothing particularly special about the PAM & SSSD setup; /etc/pam.d/sudo starts with "auto sufficient pam_sss_gss.so", and sssd.conf in the [pam] sectiion has "pam_gssapi_services = sudo". I can use strace to see exactly what data is being received by sssd_pam from pam_sss_gss.so but I don't know what sensitive data might be within so I don't want to post it here. I can provide it privately if it would help. -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

4 9

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users April 2021