password and other info from pam_handler in the dump memory of the sssd stack processes

[666SixSixSix666]

I have information from pam_handler including my password from domain user in sssd, sssd_be and sssd_pam. This memory is then merged into the swap

dump sssd

user@domain.com
domain.com
sudo
/dev/pts/1
user@domain.com
MYPASSWORD
eedesktop.DBus
AddMatch
type='signal',interface='sssd.Responder.NegativeCache',member='ResetGroups'
/org/freedesktop/DBus
org.freedesktop.DBus

domain.com
domain.com
sudo
/dev/pts/1
user@domain.com
MYPASSWORD
n4+i
er_domain_search_base
er_domain_search_base
n4+i
roup_dom

dump sssd_be

user@domain.com
domain.com
sudo
/dev/pts/1
user@domain.com
MYPASSWORD
@80<
70< domain.com hostmaster 73<

user@domain.com
domain.com
sudo
/dev/pts/1
user@domain.com
MYPASSWORD
ut expired, or the network connection was broken.
0d9<
Gq]w
pr.<
Pt9<

p<<
pa<<
0m<<
pr<<
f,DC=ru
MYPASSWORD
~<<
0]<<
`^<<
Pb<<
@e<<

dump sssd_pam

IPAM
user@domain.com
sudo
/dev/pts/1
user@domain.com
MYPASSWORD
MAPI
password
Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
@domain.c
user@domain.com

user@domain.com
domain.com
sudo
/dev/pts/1
user@domain.com
MYPASSWORD
user@domain.com
DOMAIN.COM

[alexey-tikhonov]

Not sure I understand the issue being reported... but re:

password and other info from pam_handler in the dump memory of the sssd stack processes

-- does core_dumpable option of 'sssd.conf' helps here?

[666SixSixSix666]

Not sure I understand the issue being reported... but re:

password and other info from pam_handler in the dump memory of the sssd stack processes

-- does core_dumpable option of 'sssd.conf' helps here?

In the processes sssd, sssd_be, sssd_pam, the password is stored for a long time after authentication (both the correct and incorrect password are stored in case of unsuccessful authentication). I believe this is the password from authentication requests from pam clients. Because of this, memory pages are loaded into swap and the password for the domain account can be found in the swap dump

[sumit-bose]

Hi,

thank you for your reply. SSSD already overwrites memory used to store passwords or other credentials e.g. with the help of explicit_bzero() but your ticket helped me to identify an area where we should do this as well and I will prepare a patch. In the meantime, if you are concerned about the swap space, you can disable swapping e.g. with the help of the systemd service files, see e.g. the MemorySwapMax entry in man systemd.resource-control for details.

HTH

bye,
Sumit

[666SixSixSix666]

Hi,

thank you for your reply. SSSD already overwrites memory used to store passwords or other credentials e.g. with the help of explicit_bzero() but your ticket helped me to identify an area where we should do this as well and I will prepare a patch. In the meantime, if you are concerned about the swap space, you can disable swapping e.g. with the help of the systemd service files, see e.g. the MemorySwapMax entry in man systemd.resource-control for details.

HTH

bye, Sumit

Hi, Sumit

I will check disabling swap, thank you!