Bug 1800571
| Summary: | Multiples Kerberos ticket on RHEL 7.7 after lock and unlock screen | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | cilmar <cilmar> |
| Component: | sssd | Assignee: | Sumit Bose <sbose> |
| Status: | CLOSED ERRATA | QA Contact: | sssd-qe <sssd-qe> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.7 | CC: | apeetham, atikhono, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sbose, sgoveas, srigler, thalman, tscherf |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | sync-to-jira2 | ||
| Fixed In Version: | sssd-1.16.5-6.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-09-29 19:50:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 4
Sumit Bose
2020-05-15 08:39:35 UTC
* `master`
* 11435b1060675339263ce0a2a546cc44ab9bd576 - krb5: do not cache ccache or password during preauth
* `sssd-1-16`
* 895aa34af41cc76aaac78c3cb74c68eeeb31a1d9 - krb5: do not cache ccache or password during preauth
Verified the bug on SSSD Version: sssd-1.16.5-10.el7.x86_64 Steps followed during verification: ----------------------------------------------------- 1. Fresh installation of latest 7.9 OS Server with GUI. # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.9 Beta (Maipo) # rpm -q sssd sssd-1.16.5-10.el7.x86_64 2. Configure SSSD in system with ldap-krb provider. See the sample config file: [sssd] config_file_version = 2 domains = LDAP services = nss, pam [nss] filter_groups = root filter_users = root [pam] [domain/LDAP] id_provider = ldap debug_level = 0xFFF0 ldap_uri = ldap://hubcap.lab.eng.pnq.redhat.com ldap_search_base = dc=example,dc=com auth_provider = krb5 krb5_server = hubcap.lab.eng.pnq.redhat.com krb5_realm = EXAMPLE.COM 3. Ensure krb5.conf file is set with defualt ccahe type ie, FILE: 4. Run getent and fetch the testuser to verify a working configuration. # getent passwd -s sss testuser testuser:*:21201:21201:testuser:/home/testuser:/bin/bash 5. Login to server via GUI. 6. Check the availability of credential file in /tmp directory. # ls -l /tmp/krb* -rw-------. 1 testuser 21201 542 Jun 18 15:10 /tmp/krb5cc_21201_keUqpr 7. Now, lock the user screen and wait for few minutes. 8. Login again and check the presence of multiple credential file in /tmp directory. # ls -l /tmp/krb* -rw-------. 1 testuser 21201 542 Jun 18 15:13 /tmp/krb5cc_21201_keUqpr OBSERVATION : I DONT FIND ADDITIONAL CACHE FILES FOR testuser in /tmp DIR. Hence bug looks fixed. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3904 |