RHBA-2014:0005 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides the Name
Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces
toward the system and a pluggable back-end system to connect to multiple
different account sources.

This update fixes the following bugs:

• When the SSSD daemon was acting as a client of an IPA server that

established a trust relationship with an Active Directory server, creating
system accounts using the shadow-utils programs took a long time. This was
caused by the shadow-utils package examining the whole UID or GID space and SSSD
was unable to filter these requests out. This bug has been fixed and creating
system accounts now takes significantly less time. (BZ#1028046)

• Previously, if the SSSD daemon was configured with a proxy back end and an

Lightweight Directory Access Protocol (LDAP) authentication, the LDAP back end
was unable to look up the Distinguished Name (DN) of the authenticated user.
This update adds the possibility to look up the user DN during authentication.
(BZ#1032966)

• Previously, if the "default_domain_suffix" option was specified in the

sssd.conf file, all automounter maps were fully qualified, which disrupted the
automounter integration. This bug has been fixed and sssd can now successfully
retrieve autofs maps from an IPA domain. (BZ#1036168)

• Previously, the SSSD daemon did not free per-client allocated memory when

netgroups were requested. As a consequence, if netgroups were used by a
long-running application, the sssd_nss process grew large in memory consumption.
This bug has been fixed and sssd_nss memory footprint no longer grows
significantly in this scenario. (BZ#1044905)

Users of sssd are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.5 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.5 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.5 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - AUS 6.5 x86_64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server - TUS 6.5 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.5 i386
• Red Hat Enterprise Linux EUS Compute Node 6.5 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1028046 - Creating system accounts on a IdM client takes up to 10 minutes when AD trust is configured in the IdM.
• BZ - 1036168 - sssd can't retrieve auto.master when using the "default_domain_suffix" option in
• BZ - 1044905 - sssd_nss grows memory footprint when netgroups are requested

CVEs

(none)

References

(none)