RHBA-2015:0441 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs and add various enhancements are now
available for Red Hat Enterprise Linux 7.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms.

This update adds several enhancements that are described in more detail in the
Red Hat Enterprise Linux 7.1 Release Notes, linked to in the References section,
including:

• Added the "domains=" option to the pam_sss module.
• Added an SSSD plug-in to enable accessing a CIFS share.

(BZ#727466, BZ#922081)

This update fixes the following bugs:

• The sssd-ad(5) man page did not explain that when using multiple types of

providers, such as an Active Directory (AD) provider and an LDAP provider, the
user must fully configure each of the providers. The man page explains this now.
(BZ#1075141)

• The system added the "sss" module to the nsswitch.conf file, even when SSSD

was not running. The GNU C Library (glibc) calls returned incorrect error
messages, which caused certain user space tools to not work properly. The
"sssd_nss" module returns correct error codes, so that the user space tools
handle them gracefully. (BZ#1124320)

• The hard-coded list of supported AD servers in SSSD did not include the

Windows Server 2012R2 (WS2012R2) release. Clients connected to WS2012R2 printed
a warning to the logs and were unable to use some AD-specific performance
enhancements. To fix these problems, this update adds WS2012R2 to the list.
(BZ#1134940)

• SSSD overwrote a variable containing password expiration data under certain

circumstances, and did not sometimes display password expiration messages to the
user. This update fixes the problem, and SSSD displays password expiration data
as expected. (BZ#1144011)

• Several AD-specific codepaths in the LDAP provider assumed data structures and

functions that were available only with a full AD provider. Looking up secondary
groups using the LDAP provider failed. This update modifies the codepaths to
allow using the "id_provider=ldap" setting with AD servers and disables the
support for the tokenGroups attribute when using this configuration. Clients
using "id_provider=ldap" with an AD server work seamlessly. (BZ#1146541)

• SSSD sometimes did not map some of the group security identifiers (SIDs)

returned from the tokenGroups attribute, unless an SSSD client used the
"id_provider=ad" setting. SSSD did not display all groups in the "id" output and
could deny access to users. Support for tokenGroups is now disabled if
"id_provider=ad" is not used, and SSSD reports the group membership correctly.
(BZ#1161741)

• Failed attempts to convert a GID to a group name during certain access control

checks, which is required for comparison with the "simple_allow_groups" list,
could cause SSSD to incorrectly deny access. SSSD now continues to resolve the
next groups when only allow rules are used, and the users can log in even if
SSSD cannot perform the conversion for some of their groups. (BZ#1175408)

This update adds the following enhancements:

• The sssd service can now be run as a non-root user. Previously, sssd could

only be run as root, which could potentially pose a security risk. To set sssd
to run unprivileged, add the "user=sssd" option to the [sssd] section of the
sssd.conf file. (BZ#1113783)

• SSSD is able use the group policy objects (GPOs) stored on an AD server for

access control. Windows administrators can now use the GPOs to control access to
Linux clients. (BZ#1115429)

• A new Kerberos plug-in helps to map Kerberos principals to local SSSD user

names. It is no longer necessary to configure the .k5login file or the
"auth_to_local" rules in the krb5.conf file to enable passwordless logins to IdM
clients for AD users in a setup with AD trusts. (BZ#1135043)

Users of sssd are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 790850 - Delete IPA specific attribute mappings from man page
• BZ - 829760 - Optimize RFC2307bis lookups when user and group search bases do not overlap
• BZ - 839664 - Improve syslog message when configuration cannot be loaded
• BZ - 845255 - Update manpage with the minimal value expected for ldap_idmap_range_size
• BZ - 887277 - Offline mode timeout not documented
• BZ - 889206 - On clock skew sssd returns system error
• BZ - 990688 - [RFE] User's shells are not taken from AD when there is an IPA trust with AD
• BZ - 995389 - sssd don't get some nested groups users
• BZ - 1007447 - check for active sessions not troll proc for uids
• BZ - 1007474 - Enable ad_compat sasl option
• BZ - 1030429 - Undocument and deprecate ipa_hbac_support_srchost
• BZ - 1043826 - Sssd dyndns update fails for addresses from different networks
• BZ - 1075141 - [GSS 7.0] if access_provider is not set sssd fails with no good error
• BZ - 1089250 - Expired shadow policy user(shadowLastChange=0) is not prompted for password change
• BZ - 1090653 - segfault in sssd_be when second domain tree users are queried while joined to child domain
• BZ - 1091957 - sssd_be crashes when ad_domain=junk and adding host/fqdn upn
• BZ - 1097286 - Expanding home directory fails when the request comes from the PAC responder
• BZ - 1109756 - Rebase SSSD to 1.12
• BZ - 1110245 - Use python2 in shebang for python scripts
• BZ - 1110247 - Failover SRV discovery not honouring priority/weight
• BZ - 1115508 - [RFE] Send debug logs to journald by default
• BZ - 1118339 - sudo: invalid sudoHost filter with asterisk
• BZ - 1127266 - Problems with tokengroups and ldap_group_search_base
• BZ - 1132365 - Remove password from the PAM stack if OTP is used
• BZ - 1134940 - sssd does not recognize Windows server 2012 R2's LDAP as AD
• BZ - 1135043 - [RFE] Implement localauth plugin for MIT krb5 1.12
• BZ - 1135433 - Dereference code errors out when dereferencing entries protected by ACIs
• BZ - 1137010 - disable midpoint refresh for netgroups if ptask refresh is enabled
• BZ - 1137012 - [PATCH] sss_cache flush ssh host keys.
• BZ - 1137013 - Enable OpenSSH-LPK support by default
• BZ - 1137014 - Shell fallback mechanism in SSSD
• BZ - 1137015 - [RFE] User Principal Name as a template expansion for homedir mappings
• BZ - 1144024 - sssd.conf man page missing subdomains_provider ad support
• BZ - 1147663 - authconfig crashes if case_sensitive=preserving in sssd.conf
• BZ - 1147936 - group members returned in lowercase with case_sensitive=preserving
• BZ - 1148573 - AD Provider crashes when looking up the "Domain Users" group
• BZ - 1153518 - service lookups returned in lowercase with case_sensitive=preserving
• BZ - 1153593 - Manpage description of case_sensitive=preserving is incomplete
• BZ - 1153603 - Proxy Provider: Fails to lookup case sensitive users and groups with case_sensitive=preserving
• BZ - 1158809 - Enumeration shows only a single group multiple times
• BZ - 1161741 - TokenGroups for LDAP provider breaks in corner cases
• BZ - 1162480 - dereferencing failure against openldap server
• BZ - 1163742 - "debug_timestamps = false" and "debug_microseconds = true" do not work after enabling journald with sssd.
• BZ - 1165794 - sssd does not work with custom value of option re_expression
• BZ - 1167324 - pam_sss domains option: User auth should fail when domains=<emtpy value>
• BZ - 1168735 - The Kerberos provider is not properly views-aware
• BZ - 1168904 - gid is overridden by uid in default trust view
• BZ - 1169459 - sssd-ad: The man page description to enable GPO HBAC Policies are unclear
• BZ - 1169739 - selinuxusermap rule does not apply to trusted AD users
• BZ - 1170300 - Access is not rejected for disabled domain
• BZ - 1171215 - Crash in function get_object_from_cache
• BZ - 1171382 - getent of AD universal group fails after group users login
• BZ - 1171383 - getent fails for posix group with AD users after login
• BZ - 1175705 - sssd-libwbclient conflicts with Samba's and causes crash in wbinfo
• BZ - 1177140 - gpo_child fails if "log level" is enabled in smb.conf
• BZ - 1182183 - pam_sss(sshd:auth): authentication failure with user from AD
• BZ - 1184140 - Users saved throug extop don't have the originalMemberOf attribute
• BZ - 1184982 - Need to set different umask in selinux_child
• BZ - 1185188 - Uncached SIDs cannot be resolved
• BZ - 1187113 - sssd deamon was not running after RHEL 7.1 upgrade.
• BZ - 1187192 - IPA initgroups don't work correctly in non-default view

CVEs

• CVE-2014-0249

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.1_Release_Notes/index.html