Bug 1602781
| Summary: | Offline logins and/or id_provider=local logins fail after upgrade to 7.6 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Madhuri <mupadhye> |
| Component: | sssd | Assignee: | Michal Zidek <mzidek> |
| Status: | CLOSED ERRATA | QA Contact: | sssd-qe <sssd-qe> |
| Severity: | unspecified | Docs Contact: | Lucie Vařáková <lmanasko> |
| Priority: | unspecified | ||
| Version: | 7.6 | CC: | grajaiya, jhrozek, lmanasko, lslebodn, mkosek, mupadhye, mzidek, pbrezina, sgoveas, tscherf |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.16.2-11.el7 | Doc Type: | Known Issue |
| Doc Text: |
Cause: There was an uninteded change in the way passwords are stored in sssd that resulted in the first three characters of the hash (which do not contain the hash itself, but a special "magic" string "$6$") to not be stored.
Consequence: If the sssd was upgraded while disconnected from the authentication source, offline logins would not work, because sssd would generate a new hash from the user provided password which wouldn't have the magic and compare with the stored hash that starts with the magic string.
Workaround (if any): none for the local provider. For regular logins, logging in while connected to the online source would refresh the cached password, but the first login after an upgrade to the broken version must be online, not offline. Note that if you do this, you must also log in online after the first upgrade to the fixed version as well to get rid of the bad hash.
Result:
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 10:42:59 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Madhuri
2018-07-18 13:29:37 UTC
Upstream ticket: https://pagure.io/SSSD/sssd/issue/3791 Hi Madhuri, can you try this scratch build of SSSD to see if it fixes the regression test? https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=17382595 Thanks, Michal Hello Michal, I tried above scratch build of SSSD and got successful run with beaker, so above build fix the failing regression test. successful beaker link: https://beaker.engineering.redhat.com/jobs/2651454 Thanks, Madhuri. Thank you for testing. Can we get a qa_ack in order to fix the bug in RHEL? * master: bb20d5160faed5e0076887ac4a83e550be15a8b2 verified with sssd-1.16.2-11.el7 Verificatios steps: 1. Configure sssd, add local user and change the user's password ===================================== INFO - RUN sss_groupadd -g 1010 localtestgroup1 DEBUG - RUN sss_groupadd -g 1010 localtestgroup1 DEBUG - Exit code: 0 INFO - RUN sss_useradd -G localtestgroup1 localtestuser1 DEBUG - Exit code: 0 INFO - RUN passwd --stdin localtestuser1 DEBUG - RUN passwd --stdin localtestuser1 DEBUG - Changing password for user localtestuser1. DEBUG - passwd: all authentication tokens updated successfully. DEBUG - Exit code: 0 2. Update sssd ======================================== RUN yum -y update sssd DEBUG - Updating : libsss_idmap-1.16.2-11.el7.x86_64 1/56 DEBUG - Updating : libsss_nss_idmap-1.16.2-11.el7.x86_64 2/56 DEBUG - Updating : libipa_hbac-1.16.2-11.el7.x86_64 3/56 DEBUG - Updating : python-sssdconfig-1.16.2-11.el7.noarch 4/56 DEBUG - Updating : sssd-client-1.16.2-11.el7.x86_64 5/56 DEBUG - Updating : libsss_autofs-1.16.2-11.el7.x86_64 6/56 DEBUG - Updating : libsss_sudo-1.16.2-11.el7.x86_64 7/56 DEBUG - Updating : sssd-common-1.16.2-11.el7.x86_64 8/56 DEBUG - Updating : sssd-krb5-common-1.16.2-11.el7.x86_64 9/56 DEBUG - Updating : sssd-common-pac-1.16.2-11.el7.x86_64 10/56 DEBUG - Updating : sssd-ad-1.16.2-11.el7.x86_64 11/56 DEBUG - Updating : sssd-ipa-1.16.2-11.el7.x86_64 12/56 DEBUG - Updating : sssd-ldap-1.16.2-11.el7.x86_64 13/56 DEBUG - Updating : sssd-krb5-1.16.2-11.el7.x86_64 14/56 DEBUG - Updating : python-sss-1.16.2-11.el7.x86_64 15/56 DEBUG - Updating : sssd-proxy-1.16.2-11.el7.x86_64 16/56 DEBUG - Updating : sssd-dbus-1.16.2-11.el7.x86_64 17/56 DEBUG - Updating : libsss_simpleifp-1.16.2-11.el7.x86_64 18/56 DEBUG - Updating : sssd-tools-1.16.2-11.el7.x86_64 19/56 DEBUG - Updating : libsss_simpleifp-devel-1.16.2-11.el7.x86_64 20/56 DEBUG - Updating : sssd-1.16.2-11.el7.x86_64 21/56 DEBUG - Dependency Updated: DEBUG - libipa_hbac.x86_64 0:1.16.2-11.el7 DEBUG - sssd-ad.x86_64 0:1.16.2-11.el7 DEBUG - sssd-client.x86_64 0:1.16.2-11.el7 DEBUG - sssd-common.x86_64 0:1.16.2-11.el7 DEBUG - sssd-common-pac.x86_64 0:1.16.2-11.el7 DEBUG - sssd-dbus.x86_64 0:1.16.2-11.el7 DEBUG - sssd-ipa.x86_64 0:1.16.2-11.el7 3. Check sssd version ==================================== DEBUG - RUN rpm -q sssd DEBUG - sssd-1.16.2-11.el7.x86_64 DEBUG - Exit code: 0 4. Check user lookup and authentication with same password ==================================== INFO - RUN id localtestuser1 DEBUG - RUN id localtestuser1 DEBUG - uid=1011(localtestuser1) gid=1011(localtestuser1) groups=1011(localtestuser1),1010(localtestgroup1) DEBUG - Exit code: 0 INFO - WRITE /tmp/qe_pytest_expect_fileGJA4DTU11R INFO - RUN ['expect', '-f', '/tmp/qe_pytest_expect_fileGJA4DTU11R'] DEBUG - RUN ['expect', '-f', '/tmp/qe_pytest_expect_fileGJA4DTU11R'] DEBUG - spawn ssh -o NumberOfPasswordPrompts=1 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -l localtestuser1 localhost whoami DEBUG - Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts. DEBUG - localtestuser1@localhost's password: DEBUG - Could not chdir to home directory /home/localtestuser1: Permission denied DEBUG - bash: /home/localtestuser1/.bashrc: Permission denied DEBUG - localtestuser1 DEBUG - Exit code: 3 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:3158 |