Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: after upgrading to fedora 31 (no problem before), I face very frequent sssd_be crashes. Issue seems related to sssd_ldap though can't be sure. System is up-to-date with latest components Version-Release number of selected component (if applicable): sssd-common-pac-2.2.2-3.fc31.x86_64 sssd-nfs-idmap-2.2.2-3.fc31.x86_64 sssd-krb5-common-2.2.2-3.fc31.x86_64 sssd-krb5-2.2.2-3.fc31.x86_64 sssd-proxy-2.2.2-3.fc31.x86_64 sssd-2.2.2-3.fc31.x86_64 sssd-common-2.2.2-3.fc31.x86_64 sssd-ipa-2.2.2-3.fc31.x86_64 sssd-client-2.2.2-3.fc31.x86_64 sssd-tools-2.2.2-3.fc31.x86_64 python3-sssdconfig-2.2.2-3.fc31.noarch sssd-client-2.2.2-3.fc31.i686 sssd-ldap-2.2.2-3.fc31.x86_64 sssd-ad-2.2.2-3.fc31.x86_64 sssd-kcm-2.2.2-3.fc31.x86_64 How reproducible: Happens when using sudo commands, getting error message: sudo: PAM account management error: Protocol not supported Executing sudo multiple times will show same error then works. Steps to Reproduce: 1. 2. 3. Actual results: sudo often fails with message "sudo: PAM account management error: Protocol not supported" Expected results: sudo should work Additional info: /var/log/message extract: Jan 17 09:36:57 maelle systemd-coredump[37859]: Process 37803 (sssd_be) of user 0 dumped core.#012#012Stack trace of thread 37803:#012#0 0x00007f957a350d76 sysdb_user_base_dn (libsss_util.so)#012#1 0x0000558301f47d4b be_refresh_step (sssd_be)#012#2 0x0000558301f480b2 be_refresh_send (sssd_be)#012#3 0x0000558301f47531 be_ptask_execute (sssd_be)#012#4 0x00007f957a266f3d tevent_common_invoke_timer_handler (libtevent.so.0)#012#5 0x00007f957a2670e0 tevent_common_loop_timer_delay (libtevent.so.0)#012#6 0x00007f957a2684a9 epoll_event_loop_once (libtevent.so.0)#012#7 0x00007f957a26653b std_event_loop_once (libtevent.so.0)#012#8 0x00007f957a2615d8 _tevent_loop_once (libtevent.so.0)#012#9 0x00007f957a26187b tevent_common_loop_wait (libtevent.so.0)#012#10 0x00007f957a2664cb std_event_loop_wait (libtevent.so.0)#012#11 0x00007f957a380e17 server_loop (libsss_util.so)#012#12 0x0000558301f3ec42 main (sssd_be)#012#13 0x00007f957a0a41a3 __libc_start_main (libc.so.6)#012#14 0x0000558301f3edfe _start (sssd_be) Jan 17 09:36:57 maelle systemd[1]: systemd-coredump: Succeeded. Jan 17 09:36:57 maelle abrt-dump-journal-core[993]: Failed to obtain all required information from journald Jan 17 09:36:57 maelle abrt-server[37872]: Deleting problem directory ccpp-2020-01-17-09:36:57.463705-37803 (dup of ccpp-2020-01-14-09:52:17.183530-1002) Jan 17 09:36:58 maelle abrt-notification[37906]: Process 1002 (sssd_be) crashed in sysdb_user_base_dn() sssd config: [sssd] domains = XXX.XXX, files services = nss, pam, autofs config_file_version = 2 [domain/files] #A new files provider was added. This provider mirrors the contents of /etc/passwd and /etc/group into the SSSD database id_provider = files [domain/XXX.XX] #debug_level = 9 #/var/log/sssd/ id_provider = ldap auth_provider = ldap cache_credentials = true entry_cache_timeout = 5400 #entry_cache_netgroup_timeout = #You can consider setting this value to 3/4 * entry_cache_timeout. refresh_expired_interval = 4000 ldap_uri = ldaps://ldap.XXX.XXX.XXX ldap_search_base = ou=XXX,dc=XXX,dc=XXX #ldap_id_use_start_tls = true ldap_tls_cacert = /etc/ssl/certs/chain-TCS.pem ldap_schema = rfc2307bis #Number of days entries are left in cache after last successful login before being removed during a cleanup of the cache. 0 means keep forever. The value of this parameter must be greater than or equal to offline_credentials_expiration #account_cache_expiration = 45 # By default SSSD will use the value retrieved from LDAP homedir_substring = /home override_homedir = %H/%u override_shell = /usr/bin/bash autofs_provider = ldap entry_cache_autofs_timeout = 86400 ldap_autofs_search_base=ou=autofs,ou=XXX,dc=XXX,dc=XXX #ldap_autofs_map_master_name= [pam] # If the authentication provider is offline, how long should we allow cached logins (in days since the last successful online login). 0 means no limit. offline_credentials_expiration = 0 [nss] filter_users = root filter_groups = root [autofs]
Could you attach coredump as an attachment? It would be good also to provide log files with high debug_level https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html#sssd-debug-logs
Here is coredumpctl output coredumpctl dump /usr/libexec/sssd/sssd_be --output=/tmp/sssd_be.core PID: 50664 (sssd_be) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Fri 2020-01-17 10:53:04 CET (48s ago) Command Line: /usr/libexec/sssd/sssd_be --domain XXX.XXX --uid 0 --gid 0 --logger=files Executable: /usr/libexec/sssd/sssd_be Control Group: /system.slice/sssd.service Unit: sssd.service Slice: system.slice Boot ID: 81462c3f4e274edf897e2c49530319de Machine ID: 170ce127062f4dd1870833a9667a4889 Hostname: maelle.irisa.fr Storage: /var/lib/systemd/coredump/core.sssd_be.0.81462c3f4e274edf897e2c49530319de.50664.1579254784000000000000.lz4 (inaccessible) Message: Process 50664 (sssd_be) of user 0 dumped core. Stack trace of thread 50664: #0 0x00007f25fd0bfd76 sysdb_user_base_dn (libsss_util.so) #1 0x000055f98c683d4b be_refresh_step (sssd_be) #2 0x000055f98c6840b2 be_refresh_send (sssd_be) #3 0x000055f98c683531 be_ptask_execute (sssd_be) #4 0x00007f25fcfd5f3d tevent_common_invoke_timer_handler (libtevent.so.0) #5 0x00007f25fcfd60e0 tevent_common_loop_timer_delay (libtevent.so.0) #6 0x00007f25fcfd74a9 epoll_event_loop_once (libtevent.so.0) #7 0x00007f25fcfd553b std_event_loop_once (libtevent.so.0) #8 0x00007f25fcfd05d8 _tevent_loop_once (libtevent.so.0) #9 0x00007f25fcfd087b tevent_common_loop_wait (libtevent.so.0) #10 0x00007f25fcfd54cb std_event_loop_wait (libtevent.so.0) #11 0x00007f25fd0efe17 server_loop (libsss_util.so) #12 0x000055f98c67ac42 main (sssd_be) #13 0x00007f25fce131a3 __libc_start_main (libc.so.6) #14 0x000055f98c67adfe _start (sssd_be) Attaching core dump file
I failed to upload core, you can download it here: https://genostack-api-swift.genouest.org/v1/AUTH_db3183b479c9476b8d3c4948d27f247e/osallou_testelixir/sssd_be/core.sssd_be.0.81462c3f4e274edf897e2c49530319de.50664.1579254784000000000000.lz4
(In reply to osallou from comment #3) > I failed to upload core, you can download it here: > https://genostack-api-swift.genouest.org/v1/ > AUTH_db3183b479c9476b8d3c4948d27f247e/osallou_testelixir/sssd_be/core. > sssd_be.0.81462c3f4e274edf897e2c49530319de.50664.1579254784000000000000.lz4 It is dereference of NULL pointer (gdb) l 141 136 } 137 138 struct ldb_dn *sysdb_user_base_dn(TALLOC_CTX *mem_ctx, 139 struct sss_domain_info *dom) 140 { 141 return ldb_dn_new_fmt(mem_ctx, dom->sysdb->ldb, 142 SYSDB_TMPL_USER_BASE, dom->name); 143 } 144 145 struct ldb_dn *sysdb_group_dn(TALLOC_CTX *mem_ctx, (gdb) p dom->sysdb $13 = (struct sysdb_ctx *) 0x0 (gdb) p dom[0] $15 = {type = DOM_TYPE_POSIX, name = 0x55f98d4c1bd0 "files", conn_name = 0x55f98d4c1bd0 "files", provider = 0x55f98d4adce0 "files", timeout = 0, enumerate = false, sd_enumerate = 0x55f98d4ad2b0, fqnames = false, mpg_mode = MPG_DISABLED, ignore_group_members = false, id_min = 1, id_max = 0, pwfield = 0x7f25fd1023d3 "x", cache_credentials = false, cache_credentials_min_ff_length = 8, case_sensitive = true, case_preserve = true, override_gid = 0, override_homedir = 0x0, fallback_homedir = 0x0, subdomain_homedir = 0x55f98d4adbf0 "/home/%d/%u", homedir_substr = 0x0, override_shell = 0x0, default_shell = 0x0, user_timeout = 5400, group_timeout = 5400, netgroup_timeout = 5400, service_timeout = 5400, autofsmap_timeout = 5400, sudo_timeout = 5400, ssh_host_timeout = 5400, refresh_expired_interval = 0, subdomain_refresh_interval = 14400, cached_auth_timeout = 0, pwd_expiration_warning = -1, sysdb = 0x0, names = 0x0, parent = 0x0, subdomains = 0x0, realm = 0x0, flat_name = 0x0, domain_id = 0x0, trust_direction = 0, subdomains_last_checked = {tv_sec = 0, tv_usec = 0}, has_views = false, view_name = 0x0, prev = 0x55f98d4c1f20, next = 0x0, state = DOM_ACTIVE, sd_inherit = 0x0, forest = 0x0, forest_root = 0x0, upn_suffixes = 0x0, certmaps = 0x0, user_name_hint = false, output_fqnames = false} But the issue is that it tries "refresh" data in "files" domain even thought the process crashed in "XXX.XXX" domain. It would be good to add "debug_level = 9 " into "domain/XXX.XX" section. Reproduce issue and provide log files. I assume that commenting out "refresh_expired_interval" in domain section might be a workaround for crash. Could you confirm that? BTW may we know why there is explicit files domain? "domain/files"? Because implicit files domain is used by default on fedora (as the 1st domain) in case of missing explicit files domain. BTW
Created attachment 1653058 [details] sssd_domain log file with debug log level 9
Attached sssd_domain log file with debug log level 9 there is an error for sure in this file, but logs are really versbose.... regarding configuration, I do not know, this was configured this way. I can see that cache files are "updated" /var/lib/sss/db (their timestamp), and even tried a cache clear, just in case, but same issue. You mean commenting "refresh_expired_interval"? (because it is set for the moment). Commenting this paremeter and restarting sssd seems to work for the moment. However, this value being 4000 (quite large) I would not expect to see a change as refresh will not be done so often.
(In reply to osallou from comment #6) > You mean commenting "refresh_expired_interval"? (because it is set for the > moment). > Commenting this paremeter and restarting sssd seems to work for the moment. > However, this value being 4000 (quite large) I would not expect to see a > change as refresh will not be done so often. Commenting out the line "refresh_expired_interval" should disable the feature which trigger the crash. I would say it is caused by a change introduced in sssd-2.2.1 [1,2]. Another possible workaround might be to change order of domains in "[sssd]" section [sssd] domains = files, XXX.XXX [1] https://pagure.io/SSSD/sssd/c/1a08b53defa7f921a9b0f9e839ca90f91b5f86d2?branch=master [2] https://pagure.io/SSSD/sssd/issue/4012
I confirm commenting refresh_expired_interval *fixed* the issue (well, as a workaround...) At least, I did not face the issue again since....
This scratch build should solve crash without any workaround. https://koji.fedoraproject.org/koji/taskinfo?taskID=40712566
any way to use yum.repo.d to get them ? Or should I download them all for manual install? (quite a lot package...)
(In reply to osallou from comment #10) > any way to use yum.repo.d to get them ? > Or should I download them all for manual install? (quite a lot package...) Here you are https://copr.fedorainfracloud.org/coprs/lslebodn/test_BZ1792184/
unfortunatly I cannot test packages, installation fails with conflicts with other packages. Among other issues there is: - cannot install both libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and libsss_nss_idmap-2.2.2-3.fc31.x86_64 and uninstalling sssd will remove other packages... it tries to install it as a "side" package instead of upgrading it.
(In reply to osallou from comment #12) > unfortunatly I cannot test packages, installation fails with conflicts with > other packages. > > Among other issues there is: > > - cannot install both libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and > libsss_nss_idmap-2.2.2-3.fc31.x86_64 > > and uninstalling sssd will remove other packages... > > it tries to install it as a "side" package instead of upgrading it. There are more ways how to enable copr repos but I did not have any issues with updatrade sh-5.0# rpm -q sssd libsss_nss_idmap sssd-2.2.2-3.fc31.x86_64 libsss_nss_idmap-2.2.2-3.fc31.x86_64 sh-5.0# curl -o /etc/yum.repos.d/copr.repo https://copr.fedorainfracloud.org/coprs/lslebodn/test_BZ1792184 /repo/fedora-31/lslebodn-test_BZ1792184-fedora-31.repo % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 403 100 403 0 0 1665 0 --:--:-- --:--:-- --:--:-- 1665 sh-5.0# dnf update -y \*sss\* Copr repo for test_BZ1792184 owned by lslebodn 6.5 kB/s | 3.3 kB 00:00 Dependencies resolved. ========================================================================================================== Package Arch Version Repository Size ========================================================================================================== Upgrading: libipa_hbac x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 41 k libsss_autofs x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 43 k libsss_certmap x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 70 k libsss_idmap x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 45 k libsss_nss_idmap x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 53 k libsss_sudo x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 41 k sssd x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 31 k sssd-ad x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 175 k sssd-client x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 104 k sssd-common x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 1.4 M sssd-common-pac x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 104 k sssd-ipa x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 269 k sssd-kcm x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 158 k sssd-krb5 x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 68 k sssd-krb5-common x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 115 k sssd-ldap x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 147 k sssd-nfs-idmap x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 39 k sssd-proxy x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 69 k Transaction Summary ========================================================================================================== Upgrade 18 Packages Total download size: 3.0 M Downloading Packages: (1/18): libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64.rpm 119 kB/s | 43 kB 00:00 (2/18): libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64.rpm 97 kB/s | 41 kB 00:00 (3/18): libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm 160 kB/s | 70 kB 00:00 (4/18): libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm 532 kB/s | 45 kB 00:00 (5/18): libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm 314 kB/s | 53 kB 00:00 (6/18): libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64.rpm 180 kB/s | 41 kB 00:00 (7/18): sssd-2.2.2-3.1bz1792184.fc31.x86_64.rpm 87 kB/s | 31 kB 00:00 (8/18): sssd-client-2.2.2-3.1bz1792184.fc31.x86_64.rpm 316 kB/s | 104 kB 00:00 (9/18): sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64.rpm 245 kB/s | 175 kB 00:00 (10/18): sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64.rpm 253 kB/s | 104 kB 00:00 (11/18): sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64.rpm 813 kB/s | 158 kB 00:00 (12/18): sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64.rpm 867 kB/s | 269 kB 00:00 (13/18): sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64.rpm 757 kB/s | 68 kB 00:00 (14/18): sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64.rpm 980 kB/s | 115 kB 00:00 (15/18): sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64.rpm 1.7 MB/s | 147 kB 00:00 (16/18): sssd-common-2.2.2-3.1bz1792184.fc31.x86_64.rpm 1.4 MB/s | 1.4 MB 00:01 (17/18): sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm 289 kB/s | 39 kB 00:00 (18/18): sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64.rpm 589 kB/s | 69 kB 00:00 ---------------------------------------------------------------------------------------------------------- Total 1.6 MB/s | 3.0 MB 00:01 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Running scriptlet: libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64 1/1 Upgrading : libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64 1/36 Upgrading : libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 2/36 Upgrading : sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64 3/36 Upgrading : libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64 4/36 Upgrading : libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 5/36 Upgrading : sssd-client-2.2.2-3.1bz1792184.fc31.x86_64 6/36 Running scriptlet: sssd-client-2.2.2-3.1bz1792184.fc31.x86_64 6/36 Upgrading : libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64 7/36 Upgrading : sssd-common-2.2.2-3.1bz1792184.fc31.x86_64 8/36 Running scriptlet: sssd-common-2.2.2-3.1bz1792184.fc31.x86_64 8/36 Upgrading : sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64 9/36 Upgrading : sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64 10/36 Upgrading : sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64 11/36 Upgrading : sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64 12/36 Upgrading : sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64 13/36 Upgrading : sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64 14/36 Upgrading : libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64 15/36 Upgrading : sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64 16/36 Upgrading : sssd-2.2.2-3.1bz1792184.fc31.x86_64 17/36 Upgrading : sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64 18/36 Running scriptlet: sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64 18/36 Cleanup : sssd-2.2.2-3.fc31.x86_64 19/36 Cleanup : sssd-ipa-2.2.2-3.fc31.x86_64 20/36 Cleanup : sssd-ad-2.2.2-3.fc31.x86_64 21/36 Cleanup : sssd-ldap-2.2.2-3.fc31.x86_64 22/36 Cleanup : sssd-krb5-2.2.2-3.fc31.x86_64 23/36 Cleanup : sssd-proxy-2.2.2-3.fc31.x86_64 24/36 Running scriptlet: sssd-kcm-2.2.2-3.fc31.x86_64 25/36 Cleanup : sssd-kcm-2.2.2-3.fc31.x86_64 25/36 Running scriptlet: sssd-kcm-2.2.2-3.fc31.x86_64 25/36 Cleanup : sssd-common-pac-2.2.2-3.fc31.x86_64 26/36 Cleanup : sssd-krb5-common-2.2.2-3.fc31.x86_64 27/36 Running scriptlet: sssd-common-2.2.2-3.fc31.x86_64 28/36 Cleanup : sssd-common-2.2.2-3.fc31.x86_64 28/36 Running scriptlet: sssd-common-2.2.2-3.fc31.x86_64 28/36 Running scriptlet: sssd-client-2.2.2-3.fc31.x86_64 29/36 Cleanup : sssd-client-2.2.2-3.fc31.x86_64 29/36 Cleanup : libsss_idmap-2.2.2-3.fc31.x86_64 30/36 Cleanup : libsss_nss_idmap-2.2.2-3.fc31.x86_64 31/36 Cleanup : libsss_certmap-2.2.2-3.fc31.x86_64 32/36 Cleanup : libsss_autofs-2.2.2-3.fc31.x86_64 33/36 Cleanup : libsss_sudo-2.2.2-3.fc31.x86_64 34/36 Cleanup : sssd-nfs-idmap-2.2.2-3.fc31.x86_64 35/36 Cleanup : libipa_hbac-2.2.2-3.fc31.x86_64 36/36 Running scriptlet: sssd-common-2.2.2-3.1bz1792184.fc31.x86_64 36/36 Running scriptlet: libipa_hbac-2.2.2-3.fc31.x86_64 36/36 Verifying : libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64 1/36 Verifying : libipa_hbac-2.2.2-3.fc31.x86_64 2/36 Verifying : libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64 3/36 Verifying : libsss_autofs-2.2.2-3.fc31.x86_64 4/36 Verifying : libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64 5/36 Verifying : libsss_certmap-2.2.2-3.fc31.x86_64 6/36 Verifying : libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 7/36 Verifying : libsss_idmap-2.2.2-3.fc31.x86_64 8/36 Verifying : libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 9/36 Verifying : libsss_nss_idmap-2.2.2-3.fc31.x86_64 10/36 Verifying : libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64 11/36 Verifying : libsss_sudo-2.2.2-3.fc31.x86_64 12/36 Verifying : sssd-2.2.2-3.1bz1792184.fc31.x86_64 13/36 Verifying : sssd-2.2.2-3.fc31.x86_64 14/36 Verifying : sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64 15/36 Verifying : sssd-ad-2.2.2-3.fc31.x86_64 16/36 Verifying : sssd-client-2.2.2-3.1bz1792184.fc31.x86_64 17/36 Verifying : sssd-client-2.2.2-3.fc31.x86_64 18/36 Verifying : sssd-common-2.2.2-3.1bz1792184.fc31.x86_64 19/36 Verifying : sssd-common-2.2.2-3.fc31.x86_64 20/36 Verifying : sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64 21/36 Verifying : sssd-common-pac-2.2.2-3.fc31.x86_64 22/36 Verifying : sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64 23/36 Verifying : sssd-ipa-2.2.2-3.fc31.x86_64 24/36 Verifying : sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64 25/36 Verifying : sssd-kcm-2.2.2-3.fc31.x86_64 26/36 Verifying : sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64 27/36 Verifying : sssd-krb5-2.2.2-3.fc31.x86_64 28/36 Verifying : sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64 29/36 Verifying : sssd-krb5-common-2.2.2-3.fc31.x86_64 30/36 Verifying : sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64 31/36 Verifying : sssd-ldap-2.2.2-3.fc31.x86_64 32/36 Verifying : sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64 33/36 Verifying : sssd-nfs-idmap-2.2.2-3.fc31.x86_64 34/36 Verifying : sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64 35/36 Verifying : sssd-proxy-2.2.2-3.fc31.x86_64 36/36 Upgraded: libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64 libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64 libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64 libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64 sssd-2.2.2-3.1bz1792184.fc31.x86_64 sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64 sssd-client-2.2.2-3.1bz1792184.fc31.x86_64 sssd-common-2.2.2-3.1bz1792184.fc31.x86_64 sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64 sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64 sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64 sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64 sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64 sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64 sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64 sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64 Complete! sh-5.0# rpm -q sssd libsss_nss_idmap sssd-2.2.2-3.1bz1792184.fc31.x86_64 libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64
nope sorry, can't on my side: dnf update -y \*sss\* Last metadata expiration check: 1:15:13 ago on Mon 20 Jan 2020 03:47:36 PM CET. Dependencies resolved. Problem 1: libsss_idmap-2.2.2-3.fc31.i686 has inferior architecture - cannot install both libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and libsss_idmap-2.2.2-3.fc31.x86_64 - cannot install the best update candidate for package libsss_idmap-2.2.2-3.fc31.i686 - cannot install the best update candidate for package libsss_idmap-2.2.2-3.fc31.x86_64 Problem 2: libsss_nss_idmap-2.2.2-3.fc31.i686 has inferior architecture - cannot install both libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and libsss_nss_idmap-2.2.2-3.fc31.x86_64 - cannot install the best update candidate for package libsss_nss_idmap-2.2.2-3.fc31.i686 - cannot install the best update candidate for package libsss_nss_idmap-2.2.2-3.fc31.x86_64 Problem 3: sssd-client-2.2.2-3.fc31.i686 has inferior architecture - cannot install both sssd-client-2.2.2-3.1bz1792184.fc31.x86_64 and sssd-client-2.2.2-3.fc31.x86_64 - cannot install the best update candidate for package sssd-client-2.2.2-3.fc31.i686 - cannot install the best update candidate for package sssd-client-2.2.2-3.fc31.x86_64 removing sssd would remove other extra packages and I'd like to avoid breaking things... as it occurs on my professional laptop. I tried to reproduce in a docker container with base packages to test later upgrade but I cannot reproduce in a different env at the moment. As I am not in my ldap domain but at home, maybe this is the cause. Will try again later on. Anyway, workaround is fine for me at this time.
It looks like you also have some 32-bit packages installed (sssd-client + deps) I am not sure whether you still need them. If you need them you will probably need to manually update them because looks like automatic update does not work well even though packages are there also for i686 https://copr-be.cloud.fedoraproject.org/results/lslebodn/test_BZ1792184/fedora-31-i386/01169457-sssd/
(In reply to Lukas Slebodnik from comment #15) > It looks like you also have some 32-bit packages installed (sssd-client + > deps) > I am not sure whether you still need them. > If you need them you will probably need to manually update them because > looks like automatic update does not work well > even though packages are there also for i686 > https://copr-be.cloud.fedoraproject.org/results/lslebodn/test_BZ1792184/ > fedora-31-i386/01169457-sssd/ ^^^^ maybe issue with i686 vs i386
after removal of i686 packages I could install from your repo. Don't know why I got i686 packages, anyway.... After setting configuration back to original setup and restarting sssd service, things looks fine. Will continue testing however, as PAM error did not appear all the time.
Upstream ticket: https://pagure.io/SSSD/sssd/issue/4142
master: https://pagure.io/SSSD/sssd/c/007d5b79b7aef67dd843ed9a3b65095faaeb580f
Included in sssd-2.3.0 rebase.