We've confirmed that adding a bootcmd key to Subiquity's user-data
section which runs an sssd command to initialize the config.ldb database
works around this issue:
# cloud-config
autoinstall:
version: 1
user-data:
bootcmd:
- sudo -u sssd -- timeout 5s sssd -i -d 4
It looks like the cloud-init users_groups module runs before the SSSD service
starts up and initializes the config.ldb database.
After looking at the passwd source code it is directly calling
/usr/sbin/sss_cache to flush the SSSD cache after a password change, i.e.
passwd -u.
https://github.com/shadow-maint/shadow/blob/5e7ae07fa785af8bb614c0f9e24e06a82b3915a8/src/passwd.c#L1116
https://github.com/shadow-maint/shadow/blob/5e7ae07fa785af8bb614c0f9e24e06a82b3915a8/lib/sssd.c#L24
Disabling the SSSD service, removing SSSD from the PAM stack, and renaming the
/usr/sbin/sss_cache utility before cloud-init's first boot run will work around
this issue as well.
This prevents passwd from calling the sss_cache utility when unlocking the
account created by the Subiquity autoinstall identity section.
The passwd utility itself doesn't return an error code in our testing, but the
/usr/sbin/sss_cache utility does produce an error.
We're guessing the sss_cache error trips the error checking in the cloud-init
unlock_passwd function leading to it running passwd -d on the user account.
https://github.com/canonical/cloud-init/blob/6193b2a0d241bed305e28a7aced1bd5c8c09de9a/cloudinit/distros/__init__.py#L1059
We're currently testing the new 26.04.1 release in deployment without
these SSSD workarounds to see if something may have fixed this issue in
the point release.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2153951
Title:
no config.ldb file under /var/lib/sss/db in 26.04
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2153951/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
