RHBA-2016:1407 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs are now available for Red Hat Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

This update fixes the following bugs:

• If an Active Directory (AD) user with a disabled user account attempts to log in, Identity Management (IdM) is expected to deny access. Previously, the login attempt succeeded when the user used a login method other than the standard password login, such as an SSH key. To fix this problem, IdM no longer checks only the IdM-specific account lockout attributes, but also the AD lockout attributes. As a result, an AD user with a disabled user account is no longer permitted to log in with an SSH key. (BZ#1342058)
• On systems where the adcli package was not installed and SSSD was running with the AD provider, the AD provider sometimes created a new process using the fork() function, but starting the adcli code using the exec() function failed. Consequently, the forked process was not killed. The number of the sssd_be processes increased, which eventually exhausted system resources. This update modifies the AD provider to ensure that on systems without adcli, fork() is not called to clone sssd_be. As a result, SSSD no longer forks the processes, which prevents exhausting the system resources. (BZ#1343638)
• Every execution of the keytab renewal task previously leaked a file descriptor, which eventually exhausted system resources. Now, the AD provider properly closes both ends of the two-way pipe opened to communicate with the helper adcli process. Running the keytab renewal task no longer allocates new system resources. (BZ#1344657)
• The SSSD NFS ID mapping plug-in requires the libnfsidmap library. Installing the sssd-common package previously also installed libnfsidmap, which then installed a number of additional NFS packages as dependencies. However, only systems that install and configure NFS packages explicitly can make use of the SSSD NFS ID mapping plug-in. With this update, sssd-common no longer includes libnfsidmap as a dependency, which prevents the mentioned packages from being installed unnecessarily by default. (BZ#1348538)

Users of sssd are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 1342058 - In IPA-AD trust environment access is granted to AD user even if the user is disabled on AD.
• BZ - 1344657 - The AD keytab renewal task leaks a file descriptor

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal