SSSD / sssd

#219 [RFE] SSSD should have more meaningful feedback in case of pam system errors
Closed: Fixed Opened by sejeff.

Closed: Fixed
Reopen Issue

The only current way to troubleshoot pam system errors wrt sssd is by cranking the debug level way up and re-running sssd. It would be nice if the daemon gave a mention of what the problem was or something clearer than "System Error".

Sumit, please make a decision regarding inclusion in SSSD 1.0 RC.

component: SSSD => PAM
owner: somebody => sbose

There already is the possibility to send messages to pam_sss which will send to syslog by pam_sss. Currently this is used for text error messages which are send by the LDAP or Kerberos servers, like e.g. 'Decrypt integrity check failed'. There might be error conditions inside the sssd as well where is make sense to send a test error message to the client.

My suggestion is that there should not be a separate task to add these messages, but to add them when someone is working at a piece of code where is makes sense.

Attempting to change your password to something very short ie: bad will result in a system error also.

Fields changed

milestone: SSSD Deferred => SSSD 1.1

sejeff,

can you have a look at the latest version from git and see if the feedback to the user has improved? If there are still use case where you would like to see a more detailed message it would be nice if you can add them here. Thanks.

The two use cases I saw problems with were:
- User's password is too short (try changing it to a for an example)
- User doesn't enter the same password in both attempts

These conditions result in nasty "system error" messages that the user should never see. The only way to see the actual issue is ratcheting up the debug. Are those issues fixed? If so I'd be happy to grab the latest git and give it a go.

 
jschroeder@xentest1: ~ $ rpm -q sssd
sssd-1.0.99-0.2010021017git20f7be4.fc10.ewt.x86_64

Using a password that is way too short of "p":

jschroeder@xentest1: ~ $ passwd
Changing password for user jschroeder.
Password: 
New UNIX password: 
BAD PASSWORD: it is WAY too short
New UNIX password: 
BAD PASSWORD: it is WAY too short
New UNIX password: 
BAD PASSWORD: it is WAY too short
passwd: Authentication token manipulation error

Logs from using the wrong password when initially trying to change a password

(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_pam_chpass_handler] (2): starting password change request for user [jschroeder].
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [get_server_status] (7): Status of server 'ldap1.site1.int' is 'working'
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [get_port_status] (7): Port status of port 389 for server 'ldap1.site1.int' is 'working'
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [get_server_status] (7): Status of server 'ldap1.site1.int' is 'working'
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [be_resolve_server_done] (4): Found address for server ldap1.site1.int: [10.118.200.10]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_install_ldap_callbacks] (8): Trace: sh[0x17702e0], connected[1], ops[(nil)], fde[0x176fdd0], ldap[0x1906a00]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x17702e0], connected[1], ops[0x1821860], ldap[0x1906a00]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), (null)
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [fo_set_port_status] (4): Marking port 389 of server 'ldap1.site1.int' as 'working'
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [set_server_common_status] (4): Marking server 'ldap1.site1.int' as 'working'
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x17702e0], connected[1], ops[(nil)], ldap[0x1906a00]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [find_password_expiration_attributes] (9): No password policy requested.
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=jschroeder,ou=People,o=int
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x17702e0], connected[1], ops[0x1770070], ldap[0x1906a00]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Invalid credentials(49), (null)
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Backend returned: (3, 7, <NULL>) [Internal Error (Success)]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sending result [7][LDAP]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [be_pam_handler_callback] (4): Sent result [7][LDAP]
(Thu Feb 11 13:50:15 2010) [sssd[be[LDAP]]] [sdap_handle_release] (8): Trace: sh[0x17702e0], connected[1], ops[(nil)], ldap[0x1906a00]
(Thu Feb 11 13:50:39 2010) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus conn: 16784F0
(Thu Feb 11 13:50:39 2010) [sssd[be[LDAP]]] [sbus_dispatch] (9): Dispatching.

What the user sees when typing the wrong initial password:

jschroeder@xentest1: ~ $ passwd
Changing password for user jschroeder.
Password: 
passwd: Authentication token manipulation error
jschroeder@xentest1: ~ $

The case when the current password is correct but the 2 new password and the verification are different is correct. You mentioned you had a patch for this. Sling it at the list and let me know when it is in a testable state please.

Short password: The 'BAD PASSWORD: it is WAY too short' is not coming from pam_sss but from pam_cracklib and you should see a similar dialog if you just have pam_unix in the stack.

Wrong initial password: The dialog you have shown above would be the same if only pam_unix is in the stack. After some thinking I would say that it might not be a good idea to print 'Wrong password' in this case, because this might disclose some information to an attacker.

Various patches have been committed to make give the user a better feedback in the case of errors, e.g. fbcab705c90135080e09544616f1526c0e7ef90c and 9dc76c9405860004ebbaeb7da944e06e7767780d .

fixedin: => 1.1.0
resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @sejeff:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 1.1

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1261

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
High
enhancement
PAM
0.6.0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.