Bug 1093795
| Summary: | sssd_be segfaulting | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Brian J. Murrell <brian.murrell> |
| Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> |
| Status: | CLOSED DUPLICATE | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.5 | CC: | brian.murrell, grajaiya, jgalipea, lslebodn, mkosek, pbrezina, preichl |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-05-05 13:17:21 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Brian J. Murrell
2014-05-02 17:00:15 UTC
Upstream ticket: https://fedorahosted.org/sssd/ticket/2325 This bug seems to be duplicate of BZ1019285 or BZ1071823. If I remember correctly, this problem is reproducible if system was configured to utilize integration sssd with ssh and id_provider ldap is used. The integfration with ssh could be configured by ipa-client-install. Do you use sssd as a ipa-client? (In reply to Lukas Slebodnik from comment #3) > Do you use sssd as a ipa-client? Yes. Could you check your sssd.conf if there is domain with id_provider ldap? sssd should not crash with id_provider ipa. The best way would be if you could attach sssd.conf to this ticket. (In reply to Lukas Slebodnik from comment #5) > Could you check your sssd.conf if there is domain with id_provider ldap? Yes, there is. [domain/EXAMPLE.COM] auth_provider = krb5 chpass_provider = krb5 krb5_kdcip = ipa-1, ipa-2 krb5_kpasswd = ipa-1 krb5_realm = EXAMPLE.COM id_provider = ldap ldap_uri = ldap://ipa-1, ldap://ipa-2 ldap_search_base = cn=accounts,dc=example,dc=com ldap_schema = rfc2307bis # ldap_tls_reqcert = demand # ldap_tls_cacert = /etc/ssl/certs/slapd-ca-cert.pem cache_credentials = true enumerate = true debug_level = 10 > sssd should not crash with id_provider ipa. I have been meaning to re-work/write our sssd.conf file. Ours current configuration has been in place/use for a number of years. Maybe it's getting time to do that. Maybe the best way to start is to ask to see what your idea of a well supported FreeIPA/SSSD sssd.conf looks like. (In reply to Brian J. Murrell from comment #6) > Maybe the best way to start is to ask to see what your idea of a well > supported FreeIPA/SSSD sssd.conf looks like. I would say you should just let ipa-client-install generate the config file. The only change to get the functionality you use then would be to enable enumeration (which I personally discourage) and check if cache_credentials is enabled in the default sssd.conf that ipa-client-install generates. btw by using id_provider=ipa you'd also get better performance, by using access_provider=ipa, you'll be able to leverage HBAC access control, etc etc. So yeah. That's what I ended up doing. FWIW, we use configuration management (i.e. chef) here and that's what was installing an older configuration of that file, after ipa-client-install was done. So I took the result of a pristine sssd.conf from a ipa-client-install and plugged that into our configuration management system which allowed me to go back to the machines that had the older one installed and replace it with the one that ipa-client-install would have put there. As a result the segfaults are probably gone as well as the pauses/hangs that I was getting with ssh and some nss calls. (In reply to Brian J. Murrell from comment #9) > As a result the segfaults are probably gone as well as the pauses/hangs that > I was getting with ssh and some nss calls. Thanks for the testing. I'll close this one as a duplicate of bug #1071823 *** This bug has been marked as a duplicate of bug 1071823 *** |