Bug 1172494
| Summary: | PAC: krb5_pac_verify failures should not be fatal (backport fix from upstream) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Thomas Sondergaard <thomas> |
| Component: | sssd | Assignee: | SSSD Maintainers <sssd-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.7 | CC: | grajaiya, jhrozek, lslebodn, mkosek, mvarun, mzidek, nsoman, pbrezina, preichl |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.12.4-1.el6 | Doc Type: | Bug Fix |
| Doc Text: |
Do not document.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-07-22 06:42:50 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This bug is a bother to us as we have to maintain a patched sssd ourselves as long as the fix is not available in RHEL (and Fedora for that matter). I pushed the fix upstream to sssd-1-11 branch as:df62ac0be0ab00bb1661098590c2aec6773f321e btw we're debating on whether to rebase in 6.7 or not -- since 1.12 already has the patch, you'll get the fix either way. If you'd like the fix applied to a particular Fedora release, just holler! Upstream ticket: https://fedorahosted.org/sssd/ticket/2523 (In reply to Jakub Hrozek from comment #3) > I pushed the fix upstream to sssd-1-11 branch > as:df62ac0be0ab00bb1661098590c2aec6773f321e > > btw we're debating on whether to rebase in 6.7 or not -- since 1.12 already > has the patch, you'll get the fix either way. > > If you'd like the fix applied to a particular Fedora release, just holler! We deploy to RHEL 6 and RHEL7 so having a fix there is what matters most. We have developers that work on Fedora 20 (probably soon 21), so including the fix there would be nice, but it is not essential. Thanks a lot! Can you give Karma to: https://admin.fedoraproject.org/updates/sssd-1.11.7-4.fc20 (In reply to Jakub Hrozek from comment #6) > Can you give Karma to: > https://admin.fedoraproject.org/updates/sssd-1.11.7-4.fc20 Done. Thanks again. Verified sanity only :
[root@client67 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Stopping sssd: [ OK ]
Starting sssd: [ OK ]
[root@client67 ~]# kdestroy -A
[root@client67 ~]# ssh -l aduser05 `hostname`
aduser05@client67.testrelm.com's password:
Last login: Fri Apr 17 06:17:50 2015 from 10.16.98.185
** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** **
This System is reserved by mvarun.
To return this system early. You can run the command: return2beaker.sh
Ensure you have your logs off the system before returning to Beaker
To extend your reservation time. You can run the command:
extendtesttime.sh
This is an interactive script. You will be prompted for how many
hours you would like to extend the reservation.
You should verify the watchdog was updated succesfully after
you extend your reservation.
https://beaker.engineering.redhat.com/recipes/1918627
For ssh, kvm, serial and power control operations please look here:
https://beaker.engineering.redhat.com/view/ipaqa64vmd.idmqe.lab.eng.bos.redhat.com
For the default root password, see:
https://beaker.engineering.redhat.com/prefs/
Beaker Test information:
HOSTNAME=ipaqa64vmd.idmqe.lab.eng.bos.redhat.com
JOBID=930563
RECIPEID=1918627
RESULT_SERVER=127.0.0.1:7099
DISTRO=RHEL-6.7-20150415.n.2
ARCHITECTURE=x86_64
Job Whiteboard: Rhel 6.7 BZV-nb15.n.2
Recipe Whiteboard:
** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** **
Could not chdir to home directory /home/adlabs.com/aduser05: No such file or directory
-sh-4.1$
-sh-4.1$ logout
Connection to client67.testrelm.com closed.
[root@client67 ~]# service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start
Stopping sssd: [ OK ]
Starting sssd: [ OK ]
[root@client67 ~]# kdestroy -A
[root@client67 ~]# echo Secret123 | kinit aduser05
Password for aduser05:
[root@client67 ~]# ssh -l aduser05 `hostname` echo "login successful"
Could not chdir to home directory /home/adlabs.com/aduser05: No such file or directory
login successful
Verified in version
[root@client67 ~]# rpm -qa sssd
sssd-1.12.4-29.el6.x86_64
[root@client67 ~]# rpm -qa ipa-client
ipa-client-3.0.0-46.el6.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1448.html |
Please backport the following commit from sssd upstream: commit 6e51d44a65b15c2f0491b0a8b452caac0bc00584 Author: Jakub Hrozek <jhrozek> Date: Mon Aug 4 13:36:42 2014 +0200 PAC: krb5_pac_verify failures should not be fatal As noted in the MIT KRB5 documentation, some servers send PAC with no checksum, therefire the PAC validation should not be fatal, instead, we should treat a failure from krb5_pac_verify as if there was no PAC at all. Reported on sssd-devel by Thomas Sondergaard