The System Security Services Daemon service provides a set of daemons to manage access to remote directories and authentication mechanisms. It was found that SSSD"s Privilege Attribute Certificate responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon application configured to authenticate using the PAC responder plug-in. The sssd packages have been upgraded to upstream version 1.13.0, which provides a number of bug fixes and enhancements over the previous version. Several enhancements are described in the Red Hat Enterprise Linux 7.2 Release Notes, linked to in the References section: * SSSD smart card support * Cache authentication in SSSD * SSSD supports overriding automatically discovered AD site * SSSD can now deny SSH access to locked accounts * SSSD enables UID and GID mapping on individual clients * Background refresh of cached entries * Multi-step prompting for one-time and long-term passwords * Caching for initgroups operations Bugs fixed: * When the SELinux user content on an IdM server was set to an empty string, the SSSD SELinux evaluation utility returned an error. * If the ldap_child process failed to initialize credentials and exited with an error multiple times, operations that create files in some cases started failing due to an insufficient amount of i-nodes. * The SRV queries used a hard coded TTL timeout, and environments that wanted the SRV queries to be valid for a certain time only were blocked. Now, SSSD parses the TTL value out of the DNS packet. * Previously, initgroups operation took an excessive amount of time. Now, logins and ID processing are faster for setups with AD back end and disabled ID mapping. * When an IdM client with Red Hat Enterprise Linux 7.1 or later was connecting to a server with Red Hat Enterprise Linux 7.0 or earlier, authentication with an AD trusted domain caused the sssd_be process to terminate unexpectedly. * If replication conflict entries appeared during HBAC processing, the user was denied access. Now, the replication conflict entries are skipped and users are permitted access. * The array of SIDs no longer contains an uninitialized value and SSSD no longer crashes. * SSSD supports GPOs from different domain controllers and no longer crashes when processing GPOs from different domain controllers. * SSSD could not refresh sudo rules that contained groups with special characters, such as parentheses, in their name. * The IPA names are not qualified on the client side if the server already qualified them, and IdM group members resolve even if default_domain_suffix is used on the server side. * The internal cache cleanup task has been disabled by default to improve performance of the sssd_be process. * Now, default_domain_suffix is not considered anymore for autofs maps. * The user can set subdomain_inherit=ignore_group-members to disable fetching group members for trusted domains. * The group resolution failed with an error message: "Error: 14 ". The binary GUID handling has been fixed. Enhancements added: * The description of default_domain_suffix has been improved in the manual pages. * With the new "%0" template option, users on SSSD IdM clients can now use home directories set on AD. All sssd users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed : 854396 - [RFE] Support for smart cards 1007968 - sssd does not create AAAA record in AD 1163806 - [RFE]ad provider dns_discovery_domain option: kerberos discovery is not using this option 1187103 - [RFE] User"s home directories are not taken from AD when there is an IPA trust with AD 1187146 - If v4 address exists, will not create nonexistant v6 in ipa domain 1192314 - With empty ipaselinuxusermapdefault security context on client is staff_u 1199445 - Does sssd-ad use the most suitable attribute for group name? 1200873 - [RFE] Allow smart multi step prompting when user logs in with password and token code from IPA 1201840 - SSSD downloads too much information when fetching information about groups 1202245 - SSSD"s HBAC processing is not permissive enough with broken replication entries 1202724 - [RFE] Add a way to lookup users based on CAC identity certificates 1203642 - GPO access control looks for computer object in user"s domain only 1205144 - RFE: Support one-way trusts for IPA 1205160 - Complain loudly if backend doesn"t start due to missing or invalid keytab 1205554 - Rebase SSSD to 1.13.x 1206189 - [bug] sssd always appends default_domain_suffix when checking for host keys 1206565 - [RFE] Add dualstack and multihomed support 1206566 - SSSD does not update Dynamic DNS records if the IPA domain differs from machine hostname"s domain 1206571 - [RFE] Expose D-BUS interface 1211830 - external users do not resolve with "default_domain_suffix" set in IPA server sssd.conf 1214337 - Overrides with --login work in second attempt 1214716 - idoverridegroup for ipa group with --group-name does not work 1214718 - Overridde with --login fails trusted adusers group membership resolution