Starting SSSD without root
by Tero Saarni
Hi,
I'm trying to run SSSD inside docker container without root user. The
container is executed in OpenShift cluster which does not allow running as root
inside container.
SSSD requires root and checks for this specifically.
Is there any workaround for this?
I believe the limitation is implemented for security reasons, in order to have
most critical parts executed as root and have it drop privileges for other
parts but this now completely blocks using SSSD in the above environment.
--
Tero
1 month
Only IPv4 addresses in /var/lib/sss/pubconf/kdcinfo.DOMAIN
by Brian J. Murrell
On my dual-stack network where some machines actually don't have IPv4
connectivity I am finding that whatever is writing IP addresses into
/var/lib/sss/pubconf/kdcinfo.DOMAIN is only writing the IPv4 addresses
and not the KDC's IPv6 addresses.
The result is that such an IPv6 machine cannot reach a KDC until I
remove that file. It ends up being recreated at some subsequent point
again with only the KDC's IPv4 addresses.
Is this a bug or a problem with my configuration?
Cheers,
b.
9 months, 4 weeks
Frequently disconnected from domain
by Sac Isilia
Hi Team,
We are using sssd in our environment for authentication of AD users. But it
disconnect from domain for unknown reasons.
Can someone help if there is some best practice or script that
automatically rejoin the server to domain as soon as it disconnects? It has
become pain for us to do it manually.
Regards
Sachin Kumar
11 months, 3 weeks
cldap error messages on sssd domain log
by Maverick .
Hi,
I have my Fedora 36 laptop joined to an AD with sssd-2.7.4.
AD DCs are Fedora 37 servers with Samba 4.17.8.
Everything seems to be working fine, though i see this cldap error messages on my sssd_test.com.log:
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc1.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [sdap_process_result] (0x0040): ldap_result error: [Can't contact LDAP server]
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [generic_ext_search_handler] (0x0020): sdap_get_generic_ext_recv request failed: [5]: Input/output error
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_dc_done] (0x0040): dc2.test.com:3268: unable to get netlogon information
* ... skipping repetitive backtrace ...
(2023-05-18 13:03:13): [be[test.com]] [ad_cldap_ping_done] (0x0040): Unable to get site and forest information [2]: No such file or directory
Anyone knows what this might be?
12 months
Mixing both local files and LDAP for automount maps.
by Prentice Bisbal
SSSD Users,
I'm having a problem using a combination of both local files and LDAP as
sources for automount information.
Historically, our site has always used LDAP for automount map
information, and all systems used the same NFS home directories.
I'm now setting up a new HPC cluster, and I want the home directories
(mounted as /u/<username>to be local to that cluster. The home
directories will be provided by the master note of that cluster, but I
still want to use the LDAP provided mount information for our project
directories (mounted as /p/<project_name>. I want /etc/auto.home to be
consulted for /u, but use the auto.projects automountmap in LDAP for /p.
This should be simple, but it's not working for me:
# automount -m
autofs dump map information
===========================
global options: none configured
Mount point: /u
source(s):
instance type(s): file
map: /etc/auto.home
* | ranger-master:/home/&
Mount point: /p
source(s):
instance type(s): sss
map: auto.projects
no keys found in map
I created this /etc/auto.master file:
/u /etc/auto.home
/p auto.projects
And have this in my /etc/auto.home:
* cluster-master:/home/&
I could swear this worked last week, but is not working now. My
/etc/nsswitch.conf contains the following for entry for automounting:
automount: files sss
and my /etc/sssd/sssd.conf looks like this:
[domain/default]
id_provider = ldap
autofs_provider = ldap
sudo_provider = ldap
cache_credentials = True
auth_provider = krb5
chpass_provider = krb5
krb5_kpasswd = kerberos.example.com
krb5_server = kerberos.example.com
krb5_store_password_if_offline = True
krb5_realm = PPPL.GOV
ldap_uri =ldap://ldap1.example.com,ldap://ldap2.example.com
ldap_search_base = dc=unix,dc=example,dc=com
ldap_id_use_start_tls = False
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_autofs_search_base = ou=mounts,dc=unix,dc=example,dc=com
ldap_autofs_map_object_class = automountMap
ldap_autofs_map_name = ou
ldap_autofs_entry_object_class = automount
ldap_autofs_entry_key = cn
ldap_autofs_entry_value = automountInformation
enumerate = true
[sssd]
config_file_version = 2
services = nss, pam, autofs, sudo
domains = default
[nss]
[pam]
[autofs]
[sudo]
What am I missing or doing wrong here?
--
Prentice
1 year
[SSSD] Announcing SSSD 2.9.0
by Pavel Březina
# SSSD 2.9.0
The SSSD team is announcing the release of version 2.9.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.9.0
See the full release notes at:
https://sssd.io/release-notes/sssd-2.9.0.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### General information
* `sss_simpleifp` library is deprecated and might be removed in further
releases. Those who are interested to keep using it awhile should
configure its build explicitly using `--with-libsifp` `./configure` option.
* "Files provider" (i.e. `id_provider = files`) is deprecated and might
be removed in further releases. Those who are interested to keep using
it awhile should configure its build explicitly using
`--with-files-provider` `./configure` option. Or consider using "Proxy
provider" with `proxy_lib_name = files` instead.
* Previously deprecated `--enable-files-domain` configure option, which
was used to manage default value of the `enable_files_domain` config
option, is now removed.
* Long time unused '--enable-all-experimental-features' configure option
was removed.
* SSSD will no longer warn about changed defaults when using
`ldap_schema = rfc2307` and default autofs mapping. This warning was
introduced in 1.14 to loudly warn about different default values.
### New features
* New passkey functionality, which will allow the use of FIDO2 compliant
devices to authenticate a centrally managed user locally. Moreover, in
the case of a FreeIPA user, it can also issue a Kerberos ticket
automatically with upcoming FreeIPA version 4.11.
* Add support for ldapi:// URLs to allow connections to local LDAP servers
* NSS IDMAP has two new methods: `getsidbyusername` and `getsidbygroupname`
Note: support for passkey is in its initial phase and the authentication
policy will be adjusted in future versions.
#### Packaging changes for passkey
* Include passkey subpackage and dependency for libfido2.
#### Configuration changes for passkey
* New options to enable and tune passkey behavior: `pam_passkey_auth`,
`ldap_user_passkey`, `passkey_verification`, `passkey_child_timeout`,
`interactive`, `interactive_prompt`, `touch` and `touch_prompt`.
* `--with-passkey` is a new configuration option to enable building
passkey authentication.
### Important fixes
* A regression when running sss_cache when no SSSD domain is enabled
would produce a syslog critical message was fixed.
### Configuration changes
* Default value of `cache_first` option was changed to `true` in case
SSSD is built without `files provider`.
* ipa_access_order parameter introduced. It behaves much like
ldap_access_order but affects IPA domains (id_provider = ipa) and
accepts limited values. Please see sssd-ipa(5) for more information.
1 year
SSSD and NSS problem with gid resolution with two domains (freeipa + Active Directory)
by David Serrano Amarelle
First, I would like to appreciate all the help you could provide me. I have an issue with sssd and nss that I don't still understand quite well...
The point is that I have configured some servers with 2 active domains. The first domain is a freeipa managed environment and the second one is an AD domain.
But I recently noticed that if I try to obtain the uids and gids for several users, the groupnames have the right gid, but groupnames are wrong. I mean, what I detected is even all gids an uids retrieved by the id command are right, the names of the groups shown, sometimes are from the other domain. I think it always retrieve the name of the group of the first domain (domain1.com) if the gid exists there, but if don't, it will look for it in the sencond domain (addomain2.com).
It seems this is a problem with the NSS, not exactly with the SSSD, event they are very linked. So, please, If this is not the better place to ask for this, I will appreciate help to look for help in another forum.
For instance:
[root@lab6 ~]# id user1
uid=105806(user1) gid=106520(group1) groups=106520(group1),104446(group2),104870(group3),102242(group5),100327(group6)
where:
* user1 is an user from the AD domain (addomain2.com)
* gis are perfectly obtained
* group1, group2 and group3 are from the AD domain (addomain2.com)
* group5 and group6 are groups OR USERS form the FREEIPA domain (domain1.com)
I could understand that it is normal that it happens if I use the sortname way "id user1", but I think that not should happen with the long-user way: "ia user1(a)addomain2.com". I mean, this also happens if I do:
[root@lab6 ~]# id user1(a)addomain2.com
uid=105806(user1) gid=106520(group1) groups=106520(group1),104446(group2),104870(group3),102242(group5),100327(group6)
This is my sssd.conf:
[root@lab6 ~]# cat /etc/sssd/sssd.conf
[domain/domain1.com]
id_provider = ipa
ipa_server = _srv_, freeipa01.domain1.com
ipa_domain = domain1.com
ipa_hostname = lab6.domain1.com
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = True
[domain/addomain2.com]
ad_domain = addomain2.com
krb5_realm = addomain2.com
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad
krb5_keytab = /etc/krb5.keytab.ad
ldap_krb5_keytab = /etc/krb5.keytab.ad
ldap_id_mapping = false
ad_enabled_domains = addomain2.com
ad_gpo_access_control = disabled
dyndns_update = false
dns_resolver_timeout = 10
dns_resolver_op_timeout = 10
krb5_auth_timeout = 30
timeout = 30
[sssd]
services = nss, pam, ssh, sudo
domains = domain1.com,addomain2.com
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[session_recording]
[root@lab6 ~]# realm list
domain1.com
type: kerberos
realm-name: domain1.com
domain-name: domain1.com
configured: kerberos-member
server-software: ipa
client-software: sssd
required-package: ipa-client
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
login-formats: %U
login-policy: allow-realm-logins
addomain2.com
type: kerberos
realm-name: addomain2.com
domain-name: addomain2.com
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
login-formats: %U
login-policy: allow-realm-logins
Does I have any sense for you? Did I miss something in my configuration?
Is there any way to tell NSS what domain should use in SSSD configuration?
Thanks a lot for your help.
Regards,
david
1 year
