RHBA-2012:0747 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs and add various enhancements are now
available for Red Hat Enterprise Linux 6.

Description

SSSD (System Security Services Daemon) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides NSS
(Name Service Switch) and PAM (Pluggable Authentication Modules) interfaces
toward the system and a pluggable back end system to connect to multiple
different account sources.

These updated sssd packages include numerous bug fixes and enhancements. Space
precludes documenting all of these changes in this advisory. Users are directed
to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most
significant of these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/sssd.html#RHBA-2012-0747

Users are advised to upgrade to these updated sssd packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 721289 - Process /usr/libexec/sssd/sssd_be was killed by signal 11 during auth when password for the user is not set.
• BZ - 726467 - SSSD takes 30+ seconds to login
• BZ - 744197 - [RFE] close LDAP connection to the server when idle for some (configurable) time
• BZ - 746181 - "getgrgid call returned more than one result" after group name change in MSAD
• BZ - 753763 - Provide logging configuration compatibility on SSSD 1.5/1.6 upgrade
• BZ - 753876 - [RFE] Add support for the services map
• BZ - 755506 - [RFE] Add host-based access control to sssd
• BZ - 759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
• BZ - 761570 - [RFE] support looking up autofs maps via SSSD
• BZ - 761582 - [RFE] Add ldap_sasl_minssf option
• BZ - 766141 - [RFE] SSSD should support FreeIPA's internal netgroup representation
• BZ - 766876 - [RFE] Make HBAC srchost processing optional
• BZ - 766904 - [RFE] Create a command line tool to change the debug levels on the fly
• BZ - 766907 - Use [...] for IPv6 addresses in kdc info files
• BZ - 766913 - [RFE] Add option to select validate and FAST keytab principal name
• BZ - 766930 - [RFE] Add a new option to override home directory value
• BZ - 766941 - The full dyndns update message should be logged into debug logs
• BZ - 768935 - Crash when apply settings
• BZ - 771361 - case_sensitive function not working as intended for ldap
• BZ - 771702 - sssd_pam crashes during change password operation against a IPA server.
• BZ - 772163 - Iterator loop reuse cases a tight loop in the native IPA netgroups code
• BZ - 772297 - Fails to update if all nisNetgroupTriple or memberNisNetgroup entries are deleted from a netgroup.
• BZ - 773660 - Kerberos errors should go to syslog
• BZ - 783138 - Backend occasionally goes offline under heavy load.
• BZ - 784870 - SSSD fails during autodetection of search bases for new LDAP features
• BZ - 785741 - sssd.api.conf and sssd.api.d should not be in /etc
• BZ - 785871 - wrong build dependency on nscd
• BZ - 785873 - IPA host search base cannot be set
• BZ - 785879 - sss_obfuscate/python config parser modifies config file too much
• BZ - 785880 - debug_level in sssd.conf overrides command-line
• BZ - 785881 - List the keytab to pick the princiapl to use instead of guessing
• BZ - 785883 - check DNS records before updates
• BZ - 785884 - Honour TTL when resolving host names
• BZ - 785888 - sssd returns empty netgroup at a second request for an non-existing netgroup
• BZ - 785898 - Enable midway cache refresh by default
• BZ - 785902 - Errors with empty loginShell and proxy provider
• BZ - 785904 - [RFE] SSSD should have --version option
• BZ - 785905 - [RFE] DEBUG timestamps should offer higher precision
• BZ - 785907 - [RFE] Add support to request canonicalization on krb AS requests
• BZ - 785908 - ldap_*_search_base doesn't fully limit the group / netgroup search base correctly
• BZ - 785909 - --debug-timestamps=1 is not passed to providers
• BZ - 786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as a dependancy
• BZ - 788979 - sssd crashes during initgroups against a user belonging to nested rfc2307bis group.
• BZ - 791208 - Entries lacking a POSIX username value break group lookups
• BZ - 795562 - Infinite loop checking Kerberos credentials
• BZ - 796307 - Simple Paged Search control needs to be used more sparingly
• BZ - 797282 - sssd-1.5.1-66.el6.x86_64 needs openldap >=openldap-2.4.23-20.el6.x86_64
• BZ - 797975 - sssd_be: The requested target is not configured is logged at each login
• BZ - 798317 - sssd crashes when ipa_hbac_support_srchost is set to true.
• BZ - 798655 - Password logins failing due to a process with high UID
• BZ - 798774 - IPA provider should assume that ipa_domain is also the dns_discovery_domain
• BZ - 798881 - Install-time warnings
• BZ - 799915 - Unable to lookup netgroups with case_sensitive=false.
• BZ - 799929 - Raise limits for max num of files sssd_nss/sssd_pam can use
• BZ - 799971 - sssd_be crashes on shutdown
• BZ - 801368 - Group lookups doesn't return members with proxy provider configured.
• BZ - 801377 - getent returns non-existing netgroup name, when sssd is configured as proxy provider
• BZ - 801407 - sssd_nss gets hung processing identical search requests
• BZ - 801533 - sssd_be crashes when resolving non-trivial nested group structure
• BZ - 802207 - getent netgroup hangs when "use_fully_qualified_names = TRUE" in sssd
• BZ - 803659 - Service lookup shows case sensitive names twice with case_sensitive=false
• BZ - 803842 - Unable to bind to LDAP server when minssf set
• BZ - 803937 - sssd crashed after "LDAP connection error"
• BZ - 804057 - Initial service lookups having name with uppercase alphabets doesn't work.
• BZ - 804065 - Service lookup using case-sensitive protocol names doesn't work when case_sensitive=false.
• BZ - 805034 - accessing an undefined variable might cause crash
• BZ - 805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login
• BZ - 805281 - sssd: Uses the wrong key when there a multiple realms in a single keytab.
• BZ - 805452 - Unable to lookup user, group, netgroup aliases with case_sensitive=false.
• BZ - 805729 - sssd_nss dies and does not get restarted properly
• BZ - 805918 - Wrong resolv_status might cause crash when name resolution times out
• BZ - 805924 - SSSD should attempt to get the RootDSE after binding
• BZ - 808458 - Authconfig crashes when sets krb realm
• BZ - 808597 - sssd_nss crashes on request when no back end is running
• BZ - 812281 - autofs client: map name length used as key length
• BZ - 814237 - sdap_check_aliases must not error when detects the same user
• BZ - 814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes
• BZ - 816616 - group members are now lowercased in case insensitive domains
• BZ - 818642 - Auth fails for user with non-default attribute names
• BZ - 819063 - sssd fails to provide partial data till paged search returns "Size Limit Exceeded"
• BZ - 820585 - Group enumeration fails in proxy provider
• BZ - 820759 - AVC denial seen on sssd upgrade during ipa-client upgrade
• BZ - 821044 - sss_groupadd no longer detects duplicate GID numbers
• BZ - 822236 - SSSD netgroups do not honor entry_cache_nowait_percentage
• BZ - 824616 - sssd_nss crashes when configured with use_fully_qualified_names = true
• BZ - 825028 - Service lookups by port number doesn't work on s390x/ppc64 arches

CVEs

(none)

References

• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/sssd.html#RHBA-2012-0747