Hide Forgot
Created attachment 1197605 [details] SSSD Domain log file Description of problem: This issue was observed during the automated execution of bug 773660. A clock skew event should fail kerberos user authentication and error should be logged. However, user auth succeeds. Version-Release number of selected component (if applicable): sssd-1.14.0-34.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Setup a 389DS LDAP server and KRB server. 2. Add a testuser to LDAP server and add the same user to KRB server. See cmd below: # kadmin.local -q "addprinc -pw Secret123 +requires_preauth a1m2user" 3. Setup a RHEL-7.3 SSSD client system with the following configuration: SSSD.CONF File -------------------------------------- [sssd] reconnection_retries = 3 config_file_version = 2 sbus_timeout = 30 services = nss, pam domains = KRB [domain/KRB] id_provider = ldap ldap_tls_reqcert = hard ldap_uri = ldap://<LDAP_SERVER> ldap_search_base = dc=example,dc=com enumerate = TRUE cache_credentials = TRUE debug_level = 9 auth_provider = krb5 krb5_server = <KRB_SERVER> krb5_realm = EXAMPLE.COM chpass_provider = krb5 4. Set kdc_timesync = 0 in /etc/krb5.conf file. # cat /etc/krb5.conf Configuration snippets may be placed in this directory as well includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log kdc_timesync = 0 [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] EXAMPLE.COM = { kdc = hp-dl380pgen8-02-vm-9.lab.bos.redhat.com admin_server = hp-dl380pgen8-02-vm-9.lab.bos.redhat.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM 5. Restart SSSD service and set the date to a future one. Current date: # date Sun Sep 4 05:56:14 EDT 2016 Set date to a future: # date -s "`date -d "+1 day"`" Mon Sep 5 05:56:17 EDT 2016 6. Execute user authentication (auth succeeds instead of failing due to clock skew). # ssh -l a1m2user localhost a1m2user@localhost's password: Last login: Mon Sep 5 05:56:48 2016 from localhost ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** This System is part of the Red Hat Test System. Please do not use this system for individual unit testing. RHTS Test information: HOSTNAME=auto-hv-02-guest08.idmqe.lab.eng.bos.redhat.com JOBID=1486675 RECIPEID=3038029 LAB_SERVER= RESULT_SERVER=[::1]:7081 DISTRO=RHEL-7.3-20160902.n.0 ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** Could not chdir to home directory /home/a1m2user: No such file or directory /usr/bin/id: cannot find name for group ID 10341 -sh-4.2$ date Mon Sep 5 06:02:31 EDT 2016 -sh-4.2$ logout Connection to localhost closed. Actual results: User auth succeeds. Expected results: Authentication should fail and a clock skew error should be logged. Additional info: I have attached syslog, sssd_domain log and krb5_child.log file.
Created attachment 1197606 [details] Krb child log file
Created attachment 1197607 [details] Syslog file -- /var/log/messages
iirc MIT Kerberos got some patches to handle different times on client and KDC better. See, e.g. http:http://krbdev.mit.edu/rt/Ticket/Display.html?id=7656 and http//krbdev.mit.edu/rt/Ticket/Display.html?id=7657. Robbie, can you confirm that it is expected nowadays that kinit works even if the time on the client and servers differs? Please note that even if kinit return a ticket, it might not be usable because the timestamps in the ticket are generated on the KDC and depending on the time difference the ticket might not yet be valid or already invalid.
(In reply to Sumit Bose from comment #5) > iirc MIT Kerberos got some patches to handle different times on client and > KDC better. See, e.g. > http:http://krbdev.mit.edu/rt/Ticket/Display.html?id=7656 and > http//krbdev.mit.edu/rt/Ticket/Display.html?id=7657. > > Robbie, can you confirm that it is expected nowadays that kinit works even > if the time on the client and servers differs? Spec requires us to be tolerant up to a five minute skew. We do try to be more tolerant than that.
Amith, please try to add the kdc_timesync option in the [libdefaults] section and not in the [logging] section.
Sumit, The issue is resolved by adding kdc_timesync option in the [libdefaults] section. In fact, the automation code appended "kdc_timesync = 0" to the [logging] section instead of [libdefaults] due to the recent changes in file krb5.conf. That's why we saw regression failures. I have updated the code.