sssd-users April 2022

sssd-users@lists.fedorahosted.org

11 participants
6 discussions

Do any commercial NAS vendors use the SSD ID mapping algorithm?
by mythmail＠runbox.com 18 May '22

18 May '22

Hello, I work in an enterprise environment which has both Linux and Windows systems and an Active Directory for identity. For good reasons we need to move from Linux based file servers to a NAS. The problem is that all our Linux systems use the SSD ID mapping algorithm to calculate UID and GIDs (and it works great!). We've not found a commercial NAS vendor who supports this algorithm so we can't just drop their products in place. Do you know of any who do please? Surely there must be some as many NASs run on Linux and BSD and use open source software heavily. My colleague asked this in a GitHub issue [1] but I thought that it might be best to ask here. Thanks in advance! Ed. [1]: https://github.com/SSSD/sssd/issues/6126

6 16

Using SSSD in a road warrior setup; update cached credentials problem
by David Wittwer 24 Apr '22

24 Apr '22

Hi everyone In a small business solution, I'd like to setup a road warrior solution like so: Step #1: User logs in to their ubuntu laptop. SSSD is configured to authenticate the user against LDAP but is not yet connected to the VPN. Works with cached credentials. Password cache is set to 10 days. Step #2: User starts VPN client and they then have access to company resources such as LDAP. Works. Step #3: SSSD updates the cached password as soon as LDAP is available. Cache timeout shall reset to the full 10 days once the user (and their laptop) is on the VPN. With this setup, it should be enforced that the user needs to login to the VPN at least every 10 days. I've got a problem with step #3: How can I force SSSD to renew the cached password of the user as soon as the LDAP server becomes available? (As mentioned, the VPN connection is activated *after* the user logs in.) Thanks for every hint or stories war stories on how to treat workstations with temporary connection to the auth backend. Client OS: Ubuntu 20.04 (soon 22.04) sssd: 2.4.1

2 1

Debian user for sssd with AD
by Matt Zagrabelny 15 Apr '22

15 Apr '22

Greetings, I haven't started using sssd yet, but am excited to do so. I have a bunch of Debian clients that I'd like to use/test against an AD controller. I'm assuming other folks have done such configurations. I'm afraid I don't know exactly which packages I'll need to install to have sss(d) perform the nsswitch'ing. I've read that sssd has a local cache in case the connection to the LDAP directory fails. Can anyone point me in the right direction regarding what packages I'll need or perhaps a HOWTO document on the internet? I've seen a few Redhat/Fedora docs - which I can translate/interpret for Debian as needed, but was wondering if there was a somewhat condensed version for simply setting up a (Debian) client. Thanks for any pointers and for helping out a newcomer. -m

2 1

[SSSD] Announcing SSSD 2.7.0
by Pavel Březina 14 Apr '22

14 Apr '22

# SSSD 2.7.0 The SSSD team is proud to announce the release of version 2.7.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.7.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.7.0.html RPM packages will be made available for Fedora shortly. ## New pgp key So far we have been signing each release with our personal keys. Starting from this release (including) we have switched to the new project key that is used to sign our release tarball. - Key ID: C13CD07FFB2DB1408E457A3CD3D21B2910CF6759 - URL: https://github.com/SSSD/sssd/blob/2.7.0/contrib/pubkey.asc - Keyserver: keys.openpgp.org ## Changes release process We have switched to a more aggressive release process since the release of 2.0, where we were trying to publish new features even on every .z release. From now on, we want to switch the process again to prioritize stabilization of each released version. Therefore .z releases will rather focus more on publishing bug fixes and will receive none or only very few carefully selected new features. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### New features * Added a new krb5 plugin `idp` and a new binary `oidc_child` which performs **OAuth2** authentication against FreeIPA. This, however, can not be tested yet because this feature is still under development on the FreeIPA server side. Nevertheless, we have decided to include this in the release in order to enable the functionality on the clients immediately when the FreeIPA project delivers this feature without the need to update the clients. ### General information * Better default for IPA/AD re_expression. Tunning for group names containing '@' is no longer needed. * A warning is added in the logs if an LDAP operation needs more than 80% of the configured timeout. * A new debug level is added to show statistical and performance data. Currently the duration of a backend request and of single LDAP operations are recorded if debug_level is set to 9 or the bit 0x20000 is set. * Added support for anonymous PKINIT to get FAST credentials * We have many warnings and errors from static analyzers ### Important fixes * SSSD now correctly falls back to UPN search if the user was not found even with `cache_first = true`. ### Packaging changes * Added new configure option `--with-oidc-child` and `--without-oidc-child` to control build of `oidc_child` (enabled by default). * Added new package `sssd-idp` that contains the `oidc_child` and krb5 `idp` plugin, this package is required by `sssd-ipa`.

1 0

GPO Access Control Failing: ini_config_file_open failed [84][Invalid or incomplete multibyte or wide character]
by lingyuan zhu 13 Apr '22

13 Apr '22

1、SSSD version: sssd-common-1.16.5-10.el7_9.12.x86_64 sssd-ldap-1.16.5-10.el7_9.12.x86_64 sssd-ad-1.16.5-10.el7_9.12.x86_64 sssd-client-1.16.5-10.el7_9.12.x86_64 python-sssdconfig-1.16.5-10.el7_9.12.noarch sssd-krb5-common-1.16.5-10.el7_9.12.x86_64 sssd-ipa-1.16.5-10.el7_9.12.x86_64 sssd-krb5-1.16.5-10.el7_9.12.x86_64 sssd-1.16.5-10.el7_9.12.x86_64 sssd-common-pac-1.16.5-10.el7_9.12.x86_64 sssd-proxy-1.16.5-10.el7_9.12.x86_64 2、 SSSD Configuration [sssd] domains = adtest.zly.com config_file_version = 2 services = nss, pam [domain/adtest.zly.com] ad_server = adtest.adtest.zly.com ad_domain = adtest.zly.com krb5_realm = ADTEST.ZLY.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = true use_fully_qualified_names = false fallback_homedir = /home/%u access_provider = ad debug_level=9 ad_gpo_access_control=enforcing #ad_gpo_access_control=permissive 3、error log Error in /var/log/secure : Apr 12 15:28:15 wxvmlinux sshd[3784]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=njadmin Apr 12 15:28:15 wxvmlinux sssd[be[adtest.zly.com]]: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode. Apr 12 15:28:15 wxvmlinux sshd[3784]: Accepted password for njadmin from ::1 port 49040 ssh2 Apr 12 15:28:15 wxvmlinux sshd[3784]: pam_unix(sshd:session): session opened for user njadmin by (uid=0) Apr 12 15:28:24 wxvmlinux sshd[3836]: Received disconnect from ::1 port 49040:11: disconnected by user Apr 12 15:28:24 wxvmlinux sshd[3836]: Disconnected from ::1 port 49040 Apr 12 15:28:24 wxvmlinux sshd[3784]: pam_unix(sshd:session): session closed for user njadmin Apr 12 15:28:40 wxvmlinux polkitd[547]: Registered Authentication Agent for unix-process:3889:296012 (system bus name :1.57 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) Apr 12 15:28:41 wxvmlinux polkitd[547]: Unregistered Authentication Agent for unix-process:3889:296012 (system bus name :1.57, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Apr 12 15:28:46 wxvmlinux sshd[3925]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=njadmin Apr 12 15:28:46 wxvmlinux sshd[3925]: pam_sss(sshd:account): Access denied for user njadmin: 4 (System error) Apr 12 15:28:46 wxvmlinux sshd[3925]: Failed password for njadmin from ::1 port 49084 ssh2 Apr 12 15:28:46 wxvmlinux sshd[3925]: fatal: Access denied for user njadmin by PAM account configuration [preauth] /var/log/sssd/gpo_child.log (2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0400): gpo_child started. (2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0400): context initialized (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x0400): cached_gpt_version: -1 (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_server length: 27 (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_server: smb://adtest.adtest.zly.com (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_share length: 7 (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_share: /SysVol (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_path length: 63 (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_path: /adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319} (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_cse_suffix length: 49 (2022-04-12 15:28:54): [gpo_child[3955]] [unpack_buffer] (0x4000): smb_cse_suffix: /Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf (2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0400): performing smb operations (2022-04-12 15:28:54): [gpo_child[3955]] [copy_smb_file_to_gpo_cache] (0x0400): smb_uri: smb://adtest.adtest.zly.com/SysVol/adtest.zly.com/Policies/{63899852-E3D6-4… (2022-04-12 15:28:54): [gpo_child[3955]] [copy_smb_file_to_gpo_cache] (0x4000): smb_buflen: 50 (2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x4000): smb_path_with_suffix: /adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}/GPT.INI (2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x0400): Storing GPOs in /var/lib/sss/gpo_cache/adtest.zly.com (2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x0400): Storing GPOs in /var/lib/sss/gpo_cache/adtest.zly.com/Policies (2022-04-12 15:28:54): [gpo_child[3955]] [prepare_gpo_cache] (0x0400): Storing GPOs in /var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319} (2022-04-12 15:28:54): [gpo_child[3955]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}/GPT.INIPUsDAW] (2022-04-12 15:28:54): [gpo_child[3955]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-4975-84B6-1B585DE97319}/GPT.INIPUsDAW] (2022-04-12 15:28:54): [gpo_child[3955]] [ad_gpo_parse_ini_file] (0x0400): ini_filename:/var/lib/sss/gpo_cache/adtest.zly.com/Policies/{63899852-E3D6-… (2022-04-12 15:28:54): [gpo_child[3955]] [ad_gpo_parse_ini_file] (0x0020): ini_config_file_open failed [84][Invalid or incomplete multibyte or wide character] (2022-04-12 15:28:54): [gpo_child[3955]] [ad_gpo_parse_ini_file] (0x0020): Error encountered: 84. (2022-04-12 15:28:54): [gpo_child[3955]] [perform_smb_operations] (0x0020): Cannot parse ini file: [84][Invalid or incomplete multibyte or wide character] (2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0020): perform_smb_operations failed.[84][Invalid or incomplete multibyte or wide character]. (2022-04-12 15:28:54): [gpo_child[3955]] [main] (0x0020): gpo_child failed! 4、Reproduction method 1) preparation AD: windows server 2012 datacenter， Configure AD Domain server, DNS Service Configure domain: adtest.zly.com Gpo policy: “computer configuration ==> strategy==>windows setting==>security setting==>local stategy==> Allow local login”, configure some user or group who have local login permission Linux client： centos 7.9 or redhat 7.9 realm join adtest.zly.com 2) reproduction Linux client: [root@wxvmlinux sssd]# ssh -l wxadmin localhost wxadmin@localhost's password: Authentication failed.

2 3

Using pam_sss to force the retrieval of a new TGT
by Francis Augusto Medeiros-Logeay 13 Apr '22

13 Apr '22

Hi, Having some RHEL 8 machines as vdi on a VMware Horizon desktop pool, we see that when reconnecting to a machine, system-auth and its pam-stack is executed (at least I think so). Is there a way to make pam_sss actually fetch a new TGT when doing so, just like entering a password when the screensaver does? Best, Francis

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users April 2022