RHBA-2012:0164 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs and add various enhancements are now
available.

Description

The sssd packages contain a set of daemons to manage access to remote
directories and authentication mechanisms.

These updated sssd packages include numerous bug fixes and one enhancement.
Space precludes documenting all of these changes in this advisory. Users are
directed to the Red Hat Enterprise Linux 5.8 Technical Notes for information on
the most significant of these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.8_Technical_Notes/sssd.html#RHBA-2012-0164

All users of SSSD should upgrade to these updated packages, which fix these bugs
and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 680443 - Dynamic DNS update fails if multiple servers are given in ipa_server config option
• BZ - 692455 - rfc2307bis groups are being enumerated even when the gidNumber is out of the range of min_id,max_id.
• BZ - 694580 - SSSD's man pages are missing information
• BZ - 698724 - kpasswd fails when using sssd and kadmin server != kdc server
• BZ - 700168 - Users with a local group as their primary GID are denied access by the simple access provider
• BZ - 707975 - Unable to authenticate users when username contains "\0"
• BZ - 707999 - The IPA provider does not work with IPv6
• BZ - 708104 - "renew_all_tgts" and "renew_handlers" messages are being logged multiple times when the provider comes back online.
• BZ - 709352 - Typo in negative cache notification for initgroups()
• BZ - 719107 - Native AD password policy attributes break shadow entries on forced password change, preventing login
• BZ - 748818 - SSSD not functional after "self" reboot
• BZ - 748820 - RFC2307bis initgroups calls are slow
• BZ - 748821 - [RFE] Support overriding attribute value
• BZ - 748822 - SSSD is not populating nested groups in Active Directory
• BZ - 748833 - latest sssd fails if ldap_default_authtok_type is not mentioned
• BZ - 748834 - IPA provider fails initgroups() if user is not a member of any group
• BZ - 748835 - SSSD's async resolver only tries the first nameserver in /etc/resolv.conf
• BZ - 748836 - Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV) when ldap_uri is misconfigured.
• BZ - 748837 - RFE: SSSD should support paged LDAP lookups
• BZ - 748842 - Include valid "ldap_uri" formats in sssd-ldap man page
• BZ - 748844 - sssd.$arch should require sssd-client.$arch
• BZ - 748846 - During the change password operation the ccache is not replaced by a new one if the old one isn't active anymore.
• BZ - 748847 - sssd shuts down if inotify crashes
• BZ - 748848 - libsss_ldap segfault at login against OpenLDAP
• BZ - 748849 - Certificate validation fails with message "Connection error: TLS: hostname does not match CN in peer certificate"
• BZ - 748853 - IPA dynamic DNS update mangles AAAA records
• BZ - 748854 - Remove DENY rules from the HBAC access provider
• BZ - 748855 - sssd_pam leaks file descriptors.
• BZ - 748856 - sssd doesn't honor ldap supportedControls
• BZ - 748857 - "groups user" and "finger gecos" fails
• BZ - 748858 - sssd does not handle kerberos server IP change
• BZ - 748860 - LDAP+GSSAPI needs explicit Kerberos realm
• BZ - 748861 - Provide a mechanism for vetoing the use of certain shells
• BZ - 748864 - SSSD taking 5 minutes to log in
• BZ - 748865 - When non-posix groups are skipped, initgroups returns random GID
• BZ - 748866 - Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON
• BZ - 748867 - [RFE] Have SSSD cache properly with krb5_validate = True and SElinux enabled
• BZ - 748869 - "System error" appears in log during change password operation of a user in openldap server with ppolicy enabled.
• BZ - 748870 - sssd crashes during auth while there exists multiple external hosts along with managed host.
• BZ - 748872 - Authentication fails when there exists an empty hbacsvcgroup.
• BZ - 748873 - Improve password policy error message
• BZ - 748874 - Unable to enumerate rfc2307bis group with non-default attribute names.
• BZ - 748875 - SSSD should pick a user/group name when there are multi-valued names
• BZ - 748877 - Group lookups doesn't return it's member for sometime when the member has multi-valued uid.
• BZ - 748878 - Lookup fails for non-primary usernames with multi-valued uid.
• BZ - 748879 - "Unknown (private extension) error(21853), (null)" messages are logged during change password operation of a user in openldap server with ppolicy enabled.
• BZ - 748881 - Use an explicit base 10 when converting uidNumber to integer
• BZ - 748882 - Rework the example config
• BZ - 748883 - HBAC rule evaluation does not properly handle host groups
• BZ - 748893 - SSSD backend gets killed on slow systems
• BZ - 748895 - Only access sssd_nss internal hash table if it was initialized
• BZ - 748896 - sssd_pam segfaults on sssd restart
• BZ - 748897 - HBAC processing is very slow when dealing with FreeIPA deployments with large numbers of hosts.
• BZ - 748898 - SSSD can crash due to dbus server removing a UNIX socket
• BZ - 758168 - sssd_nss crashes when passed invalid UTF-8 for the username in getpwnam()
• BZ - 773327 - The full dyndns update message should be logged into debug logs

CVEs

(none)

References

• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.8_Technical_Notes/sssd.html#RHBA-2012-0164