SSSD / sssd

#192 nm-applet does not start with rhel5 and sssd account
Closed: Invalid Opened by villeys.

Closed: Invalid
Reopen Issue

It looks like sssd account is not appearing to D-BUS as being at console. First there are the original files and then the patch that makes the nm-applet start. The patch is insecure.

/etc/dbus-1/system.d/NetworkManager.conf

<!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
        <policy user="root">
                <allow own="org.freedesktop.NetworkManager"/>
                <allow send_destination="org.freedesktop.NetworkManager"/>
                <allow send_interface="org.freedesktop.NetworkManager"/>
                <allow own="org.freedesktop.NetworkManager.PPP"/>
                <allow send_destination="org.freedesktop.NetworkManager.PPP"/>
                <allow send_interface="org.freedesktop.NetworkManager.PPP"/>
        </policy>
        <policy user="haldaemon">
                <allow send_destination="org.freedesktop.NetworkManager"/>
        </policy>
        <policy at_console="true">
                <allow send_destination="org.freedesktop.NetworkManager"/>
                <allow send_interface="org.freedesktop.NetworkManager"/>
        </policy>
        <policy context="default">
                <deny own="org.freedesktop.NetworkManager"/>
                <deny send_destination="org.freedesktop.NetworkManager"/>
                <deny send_interface="org.freedesktop.NetworkManager"/>
                <deny own="org.freedesktop.NetworkManager.PPP"/>
                <deny send_destination="org.freedesktop.NetworkManager.PPP"/>
                <deny send_interface="org.freedesktop.NetworkManager.PPP"/>
        </policy>
        <limit name="max_replies_per_connection">512</limit>
</busconfig>

/etc/dbus-1/system.d/nm-applet.conf

<!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
        <policy user="root">
                <allow own="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
                <!-- Only root can get secrets -->
                <allow send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
        </policy>
        <policy at_console="true">
                <allow own="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
                <!-- Only root can get secrets -->
                <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
        </policy>
        <policy context="default">
                <deny own="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
                <!-- Only root can get secrets -->
                <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
        </policy>
        <limit name="max_replies_per_connection">512</limit>
</busconfig>
--- nm-applet.conf      2009-09-18 17:23:57.000000000 +0300
+++ /etc/dbus-1/system.d/nm-applet.conf 2009-09-18 17:24:16.000000000 +0300
 -21,7 +21,7 @@
                <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
        </policy>
        <policy context="default">
-               <deny own="org.freedesktop.NetworkManagerUserSettings"/>
+               <allow own="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
                <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
--- NetworkManager.conf 2009-09-18 17:25:19.000000000 +0300
+++ /etc/dbus-1/system.d/NetworkManager.conf    2009-09-18 17:25:56.000000000 +0300
 -19,13 +19,13 @@
                 <allow send_interface="org.freedesktop.NetworkManager"/>
         </policy>
         <policy context="default">
-                <deny own="org.freedesktop.NetworkManager"/>
-                <deny send_destination="org.freedesktop.NetworkManager"/>
-                <deny send_interface="org.freedesktop.NetworkManager"/>
+                <allow own="org.freedesktop.NetworkManager"/>
+                <allow send_destination="org.freedesktop.NetworkManager"/>
+                <allow send_interface="org.freedesktop.NetworkManager"/>
-                <deny own="org.freedesktop.NetworkManager.PPP"/>
-                <deny send_destination="org.freedesktop.NetworkManager.PPP"/>
-                <deny send_interface="org.freedesktop.NetworkManager.PPP"/>
+                <allow own="org.freedesktop.NetworkManager.PPP"/>
+                <allow send_destination="org.freedesktop.NetworkManager.PPP"/>
+                <allow send_interface="org.freedesktop.NetworkManager.PPP"/>
         </policy>
         <limit name="max_replies_per_connection">512</limit>

My best guess is that our PAM conversation is listing SSSD users as remote rather than local and at-console.

component: SSSD => PAM
description: It looks like sssd account is not appearing to D-BUS as being at console. First there are the original files and then the patch that makes the nm-applet start. The patch is insecure.

/etc/dbus-1/system.d/NetworkManager.conf





            <allow own="org.freedesktop.NetworkManager.PPP"/>
            <allow send_destination="org.freedesktop.NetworkManager.PPP"/>
            <allow send_interface="org.freedesktop.NetworkManager.PPP"/>
    </policy>
    <policy user="haldaemon">
            <allow send_destination="org.freedesktop.NetworkManager"/>
    </policy>
    <policy at_console="true">
            <allow send_destination="org.freedesktop.NetworkManager"/>
            <allow send_interface="org.freedesktop.NetworkManager"/>
    </policy>
    <policy context="default">
            <deny own="org.freedesktop.NetworkManager"/>
            <deny send_destination="org.freedesktop.NetworkManager"/>
            <deny send_interface="org.freedesktop.NetworkManager"/>
            <deny own="org.freedesktop.NetworkManager.PPP"/>
            <deny send_destination="org.freedesktop.NetworkManager.PPP"/>
            <deny send_interface="org.freedesktop.NetworkManager.PPP"/>
    </policy>
    <limit name="max_replies_per_connection">512</limit>

/etc/dbus-1/system.d/nm-applet.conf



            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
            <!-- Only root can get secrets -->
            <allow send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
    </policy>
    <policy at_console="true">
            <allow own="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
            <!-- Only root can get secrets -->
            <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
    </policy>
    <policy context="default">
            <deny own="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
            <!-- Only root can get secrets -->
            <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
    </policy>
    <limit name="max_replies_per_connection">512</limit>

--- nm-applet.conf 2009-09-18 17:23:57.000000000 +0300
+++ /etc/dbus-1/system.d/nm-applet.conf 2009-09-18 17:24:16.000000000 +0300
-21,7 +21,7 @@



-
+ 

            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>

--- NetworkManager.conf 2009-09-18 17:25:19.000000000 +0300
+++ /etc/dbus-1/system.d/NetworkManager.conf 2009-09-18 17:25:56.000000000 +0300
-19,13 +19,13 @@



-
-
-
+
+
+ 


  •  <limit name="max_replies_per_connection">512</limit> => It looks like sssd account is not appearing to D-BUS as being at console. First there are the original files and then the patch that makes the nm-applet start. The patch is insecure.

/etc/dbus-1/system.d/NetworkManager.conf
{{{





            <allow own="org.freedesktop.NetworkManager.PPP"/>
            <allow send_destination="org.freedesktop.NetworkManager.PPP"/>
            <allow send_interface="org.freedesktop.NetworkManager.PPP"/>
    </policy>
    <policy user="haldaemon">
            <allow send_destination="org.freedesktop.NetworkManager"/>
    </policy>
    <policy at_console="true">
            <allow send_destination="org.freedesktop.NetworkManager"/>
            <allow send_interface="org.freedesktop.NetworkManager"/>
    </policy>
    <policy context="default">
            <deny own="org.freedesktop.NetworkManager"/>
            <deny send_destination="org.freedesktop.NetworkManager"/>
            <deny send_interface="org.freedesktop.NetworkManager"/>
            <deny own="org.freedesktop.NetworkManager.PPP"/>
            <deny send_destination="org.freedesktop.NetworkManager.PPP"/>
            <deny send_interface="org.freedesktop.NetworkManager.PPP"/>
    </policy>
    <limit name="max_replies_per_connection">512</limit>


}}}

/etc/dbus-1/system.d/nm-applet.conf
{{{



            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
            <!-- Only root can get secrets -->
            <allow send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
    </policy>
    <policy at_console="true">
            <allow own="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
            <!-- Only root can get secrets -->
            <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
    </policy>
    <policy context="default">
            <deny own="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>
            <!-- Only root can get secrets -->
            <deny send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
    </policy>
    <limit name="max_replies_per_connection">512</limit>


}}}

{{{
--- nm-applet.conf 2009-09-18 17:23:57.000000000 +0300
+++ /etc/dbus-1/system.d/nm-applet.conf 2009-09-18 17:24:16.000000000 +0300
-21,7 +21,7 @@



-
+ 

            <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/>
            <allow send_interface="org.freedesktop.NetworkManagerSettings"/>

--- NetworkManager.conf 2009-09-18 17:25:19.000000000 +0300
+++ /etc/dbus-1/system.d/NetworkManager.conf 2009-09-18 17:25:56.000000000 +0300
-19,13 +19,13 @@



-
-
-
+
+
+ 


  •  <limit name="max_replies_per_connection">512</limit>

    }}}
    owner: somebody => sbose

Then entry

session sufficient pam_sss.so

in /etc/pam.d/system-auth finished the pam session setup for the sssd user and pam_console from /etc/pam.d/gdm was never executed for for sssd users. When changing this line to

session optional pam_sss.so

everything works as expected.

An easy and, at least for me, always working rule to configure pam_sss is to configure LDAP authentication with authconfig and then substitute pam_ldap by pam_sss in /etc/pam.d/system-auth. On RHEL pam_ldap.so is added to session as optional, too.

resolution: => invalid
status: new => closed

This needs to be reflected in the HOWTO pages.

doc: 0 => 1

Extended PAM section of HOWTO page. Please review.

docupdated: 0 => 1

Fields changed

rhbz: => 0

Metadata Update from @villeys:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 0.6.0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1234

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
defect
PAM
0.5.0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.