#935528 sssd: Using sssd together with winbind causes authentication DoS

Package:
src:sssd
Source:
sssd
Submitter:
Heiko Wundram
Date:
2026-10-09 07:55:02 UTC
Severity:
important
Tags:
#935528#5
Date:
2019-08-23 15:28:00 UTC
From:
To:
Dear Maintainer,

using sssd together with winbind when both services target different authentication
sources (e.g. sssd for LDAP, winbind for AD-domain) leads to an authentication/NSS
DoS due to incorrect recursive NSS calls of sssd for users unknown to both
authentication providers. Upstream has patched the corresponding issues in #3963
and #3964, with backports for 1.16.x attached to the issues (and prepared
for inclusion in the Debian patch framework attached to this report).

Please consider including the corresponding patches in the Debian distribution of
sssd.
#935528#10
Date:
2026-10-09 07:53:11 UTC
From:
To:
Control: close -1

Hi Heiko,

I assume that this issue has long been resolved in Debian, because as
you said, patches are included upstream meanwhile.

If not, please reopen or resubmit patches that still need to be included.

Mike