RHEA-2018:0929 - Product Enhancement Advisory

Topic

An update for sssd is now available for Red Hat Enterprise Linux 7.

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Users of sssd are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

• BZ - 888739 - Enumerating large number of users makes sssd_be hog the cpu for a long time.
• BZ - 1272214 - [RFE] Create a local per system report about who can access that IDM client (attestation)
• BZ - 1400614 - [RFE] sssd should remember DNS sites from first search
• BZ - 1408294 - Provide a debug message when SSSD authentication fails because two IPA accounts share an email address
• BZ - 1416150 - RFE: Log to syslog when sssd cannot contact servers, goes offline
• BZ - 1421194 - SSSD doesn't use AD global catalog for gidnumber lookup, resulting in unacceptable delay for large forests
• BZ - 1432010 - SSSD ships a drop-in configuration snippet in /etc/systemd/system
• BZ - 1454559 - python-sssdconfig doesn't parse hexadecimal debug_level, resulting in set_option(): /usr/lib/python2.7/site-packages/SSSDConfig/__init__.py killed by TypeError
• BZ - 1456968 - MAN: document that attribute 'provider' is not allowed in section 'secrets'
• BZ - 1460689 - KCM/secrets: Storing many secrets in a rapid succession segfaults the secrets responder
• BZ - 1460724 - SYSLOG_IDENTIFIER is different
• BZ - 1461462 - sssd_client: add mutex protected call to the PAC responder
• BZ - 1461899 - Loading enterprise principals doesn't work with a primed cache
• BZ - 1462343 - document information on why SSSD does not use host-based security filtering when processing AD GPOs
• BZ - 1464049 - Idle nss file descriptors should be closed
• BZ - 1469791 - Rebase SSSD to version 1.16+
• BZ - 1472255 - Improve SSSD performance in the 7.5 release
• BZ - 1473571 - ipa-extdom-extop plugin can exhaust DS worker threads
• BZ - 1474711 - Querying the AD domain for external domain's ID can mark the AD domain offline
• BZ - 1479983 - id root triggers an LDAP lookup
• BZ - 1482231 - sssd_nss consumes more memory until restarted or machine swaps
• BZ - 1482555 - sysdb index improvements - missing ghost attribute indexing, unneeded objectclass index etc..
• BZ - 1484376 - [RFE] Add a configuration option to SSSD to disable the memory cache
• BZ - 1486786 - sssd going in offline mode due to sudo search filter.
• BZ - 1489666 - Combination sssd-ad and postfix recieve incorrect mail with asterisks or spaces
• BZ - 1489895 - Issues with certificate mapping rules
• BZ - 1490501 - sssd incorrectly checks 'try_inotify' thinking it is the wrong section
• BZ - 1502686 - crash - /usr/libexec/sssd/sssd_nss in nss_setnetgrent_timeout
• BZ - 1502713 - SSSD can crash due to ABI changes in libldb >= 1.2.0 (1.1.30)
• BZ - 1505277 - Race condition between refreshing the cr_domain list and a request that is using the list can cause a segfault is sssd_nss
• BZ - 1507614 - Improve Smartcard integration if multiple certificates or multiple mapped identities are available
• BZ - 1520984 - getent output is not showing home directory for IPA AD trusted user
• BZ - 1523010 - IPA user able to authenticate with revoked cert on smart card
• BZ - 1523282 - sssd used wrong search base with wrong AD server
• BZ - 1525052 - sssd_krb5_localauth_plugin fails to fallback to other localname rules
• BZ - 1525644 - dbus-send unable to find user by CAC cert
• BZ - 1544943 - sssd goes offline when renewing expired ticket

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html