RHBA-2015:1448 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs and add various enhancements are now
available for Red Hat Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms.

The sssd packages have been upgraded to upstream version 1.12.4, which provides
a number of bug fixes and enhancements over the previous version. (BZ#1168347)

Several enhancements are described in the Red Hat Enterprise Linux 6.7 Release
Notes, linked from the References section:

• The "domains=" option for the pam_sss module (BZ#1168363)
• The UPN (User Principal Name) attribute to identify users and user logins

(BZ#1088402)

• Password expiration warnings for non-password authentication (BZ#1036745)
• The ID views feature (BZ#1168344)
• Transferring the user shell attribute from an Active Directory (AD) server to

an Identity Management (IdM) client (BZ#1168377)

• Updating cached entries out-of-band in the background (BZ#1098147)
• The ad_site option can be used to override the AD site discovered from DNS

(BZ#1161564)

• A new Kerberos plug-in maps Kerberos principals to local SSSD user names

(BZ#1168357)

• Groups for AD trusted users are displayed without logging in (BZ#1168378)
• The case_sensitive option accepts the "preserve" value. (BZ#1171782)
• The ldap_access_order option accepts the "ppolicy" value. (BZ#1173198)
• SSSD can use GPOs on an AD server (BZ#1187642)

Bug fixes:

• Applications leveraging identities from SSSD could terminate unexpectedly

while invalidating the memory cache using the sss_cache utility. This bug has
been fixed, and using sss_cache is safe. (BZ#1123291)

• SSSD properly recognizes Windows 2012R2 as an AD server and applies the

correct AD-specific performance optimizations. (BZ#1134942)

• SSSD failed to connect to servers that only allowed authenticated connections

to read the rootDSE entry, such as IBM Tivoli LDAP servers. SSSD now retries an
authenticated connection after a non-authenticated connection fails while
reading rootDSE. As a result, SSSD works as expected with these servers.
(BZ#1139878)

• When the simple_allow_groups and simple_allow_users options contained

non-existent and existing entries, SSSD denied access to the existing users or
groups. Now, SSSD logs and skips the non-existent entries and correctly handles
the existing ones. (BZ#1170910)

• This update fixes bugs that caused SSSD to terminate unexpectedly due to

memory errors or when trying to access callback data. (BZ#1173738, BZ#1194367)

• The sssd-ldap(5) and sssd.conf(5) man pages have been modified. (BZ#1135838,

BZ#1172865)

• SSSD downloaded an unnecessary amount of data when obtaining information about

groups from an AD provider when using POSIX attributes on the server. With this
update, SSSD downloads only the information about the group object, not the
contents of the group. (BZ#1201847)

• SSSD did not properly handle the "objectGUID" AD LDAP attribute. Now, SSSD

considers "objectGUID" a binary value as expected, and the attribute is stored
correctly. (BZ#1205382)

• If a multi-process program requested the initgroups data immediately after

SSSD startup, before the SSSD cache was ready, the NSS responder could
incorrectly return an empty group list. With this update, the initgroups
requests from a multi-process program with an empty cache work correctly, and
the described problem no longer occurs. (BZ#1215765)

• Setups with "subdomains_provider=none" set for AD domains did not sometimes

work as expected. Now, the ldap_idmap_default_domain_sid option value is used
for the SSSD main domain, thus fixing the bug. Note that
ldap_idmap_default_domain_sid must be set for SSSD to function correctly in this
situation. (BZ#1221358)

Enhancement:

• SRV queries now honor the time to live (TTL) values from DNS. (BZ#1171378)

Users of sssd are advised to upgrade to these updated packages, which fix these
bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1134942 - sssd does not recognize Windows server 2012 R2's LDAP as AD
• BZ - 1135432 - Dereference code errors out when dereferencing entries protected by ACIs
• BZ - 1135643 - sssd segfaults repeatedly with error 4 in memberof.so
• BZ - 1135838 - Man sssd-ldap shows parameter ldap_purge_cache_timeout with "Default: 10800 (12 hours)"
• BZ - 1140909 - sssd.conf man page missing subdomains_provider ad support
• BZ - 1148113 - sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout'
• BZ - 1148582 - inconsistent group information when multiple ad domain sections are configured in sssd
• BZ - 1154042 - RHEL6.6 sssd (1.11) doesn't return all group memberships against an IPA server
• BZ - 1161564 - [RFE]ad provider dns_discovery_domain option: kerberos discovery is not using this option
• BZ - 1168344 - [RFE] ID Views: Support migration from the sync solution to the trust solution
• BZ - 1170910 - SSSD should not fail authentication when only allow rules are used
• BZ - 1172494 - PAC: krb5_pac_verify failures should not be fatal (backport fix from upstream)
• BZ - 1194302 - With empty ipaselinuxusermapdefault security context on client is staff_u
• BZ - 1198478 - ccname_file_dummy is not unlinked on error
• BZ - 1200093 - sssd_nss segfaults if initgroups request is by UPN and doesn't find anything
• BZ - 1200487 - Relax the libldb requirements to unblock RH Storage
• BZ - 1201847 - SSSD downloads too much information when fetching information about groups
• BZ - 1202728 - sssd-ad requires samba3, but ipa-server-trust-ad requires samba4
• BZ - 1203630 - SSSD doesn't own the GPO cache directory
• BZ - 1203643 - GPO access control looks for computer object in user's domain only
• BZ - 1205382 - Properly handle AD's binary objectGUID
• BZ - 1205716 - Installing sssd-common-1.12.4-18.el6 might install with wrong user account (root)
• BZ - 1206121 - ldap_access_order=ppolicy: Explicitly mention in manpage that unsupported time specification will lead to sssd denying access
• BZ - 1207720 - id lookup resolves "Domain Local" group and errors appear in domain log
• BZ - 1211728 - Only set the selinux context if the context differs from the local one
• BZ - 1213716 - idoverridegroup for ipa group with --group-name does not work
• BZ - 1213822 - Overrides with --login work in second attempt
• BZ - 1216094 - /usr/libexec/sssd/selinux_child crashes and gets avc denial when ssh
• BZ - 1217328 - autofs provider fails when default_domain_suffix and use_fully_qualified_names set
• BZ - 1219844 - Unable to resolve group memberships for AD users when using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with ipa-server-3.0.0-42.el6.x86_64 with AD Trust
• BZ - 1221358 - SSSD doesn't work with ID mapping and disabled subdomains
• BZ - 1225614 - IPA enumeration provider crashes
• BZ - 1226834 - id lookup for non-root domain users doesn't return all groups on first attempt
• BZ - 1232738 - Cache is not updated after user is deleted from ldap server

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.7_Release_Notes/index.html