Fedora Account System
Red Hat Associate
Red Hat Customer
Some of automated SSSD tests started to fail very recently. Symptoms are as follows: - test executes: ``` ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 -l TESTUSER localhost ``` - enters password - and gets in response: ``` TESTUSER@localhost: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive). ``` In systemd journal it looks like: ``` sshd-session[665010]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=TESTUSER sshd-session[665010]: Failed password for TESTUSER from ::1 port 59358 ssh2 ``` SSSD own logs look sane - auth succeeds. Timing hints this might be related with recent rebase: https://src.fedoraproject.org/rpms/openssh/c/be36f8dbd60f4d2e7e1e8b21c615a615f1182f84?branch=rawhide ``` # rpm -q openssh openssh-10.2p1-1.fc44.x86_64 ``` Reproducible: Always
I think the code that Marco added upstream (git commit 140bae1df2b7246bb43439d039bf994159973585) should instead use a second call to `getpwnam()`, e.g. `getpwnam(pam_user)`, and then compare pw->uid with the authctxt->pw->uid. This way we don't care whether the PAM stack changed the name by normalization, as long as this gets to the same POSIX account.
@atikhono I implemented the change that Alexander Bokovoy suggested. Seems to work, however I am not sure if my reproducer is correct. I was using similar reproducer as for https://bugzilla.mindrot.org/show_bug.cgi?id=3853. Here is the proposed patch: https://src.fedoraproject.org/rpms/openssh/pull-request/105# scratch build should be present under the MR but here is one that I made https://koji.fedoraproject.org/koji/taskinfo?taskID=142383168 Could you please test the change?
@zfridric, do you have a copr repo?
(In reply to Alexey Tikhonov from comment #6) > @zfridric, do you have a copr repo? I don't.
FEDORA-2026-e0777ae202 (openssh-10.2p1-3.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-e0777ae202
FEDORA-2026-63e3fa9387 (openssh-10.2p1-3.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-63e3fa9387
FEDORA-2026-e0777ae202 (openssh-10.2p1-3.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-63e3fa9387 (openssh-10.2p1-3.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.