1

My Fedora 26 (was 25 when installed/joined to AD) has a long timeout when I run sudo for my Active Directory user if I leave it alone for to long.

Timeout is long. 25 seconds.

I used strace (sudo strace -tt -o sudo_wait.strace sudo dnf update -y) to see if I could see what the system was doing for those 25 seconds, but it seem to be nothing:

[...]
07:50:48.362655 poll([{fd=3, events=POLLIN}, {fd=7, events=POLLIN}], 2, -1) = 1 ([{fd=7, revents=POLLIN|POLLHUP}])
07:50:48.367202 recvfrom(7, "", 8, MSG_WAITALL, NULL, NULL) = 0
07:50:48.367287 poll([{fd=3, events=POLLIN}], 1, -1) = ? ERESTART_RESTARTBLOCK (Interrupted by signal)
07:51:12.493581 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=29817, si_uid=0, si_status=0, si_utime=896, si_stime=124} ---
07:51:12.493646 write(4, "\21", 1)      = 1
07:51:12.493717 rt_sigreturn({mask=[]}) = -1 EINTR (Interrupted system call)
07:51:12.493769 poll([{fd=3, events=POLLIN}], 1, -1) = 1 ([{fd=3, revents=POLLIN}])
07:51:12.493820 read(3, "\21", 1)       = 1
[...]

It is probably not good that I use sudo to run both strace and dnf as I don't know which one of them is actually causing the delay.

I joined the machine to AD by using instructions here (or eerily similar).

If I run sudo again directly after waiting the 25 seconds there is no delay, but every morning when I try after not touching the machine for a few hours the delay is back.

How can I figure out what the machine is waiting for?

ow can I tweak how long credentials are cached?

How can I tweak how long the timeout is?

EDIT: Just found this on RedHat. Creating the /etc/sudo.conf as suggested did produce a debug log. Now I'll just have to wait for the delay to come back and then go through that log.

  • What do you mean by "timeout"? Does it work, just with a longer-than-desired delay? – mattdm Aug 11 '17 at 17:43
  • @mattdm yes, it works. But it takes 25 seconds before sudo asks for my password. – azzid Aug 11 '17 at 19:25
  • 1
    Generally, we use "timeout" to refer to failures. – mattdm Aug 11 '17 at 19:30
  • 1
    Try using sudo -v instead of sudo dnf, to simplify the problem.... – mattdm Aug 11 '17 at 19:45
  • 1
    Yes, I know. But it removes dnf from the equation. – mattdm Aug 18 '17 at 12:36
2

Is your AD user a member of many large AD groups? This is typically the case, usually suppressing the group members with the ignore_group_members option helps.

Alternatively, checking the sssd logs if the machine is able to connect to AD DCs and is not e.g. timing out the connection is also a good thing to do.

  • The sudo debug log as mentioned above is quite verbose, so I did not understand what was eating the time from reading it before. Going through it after your answer I do see alot of group-stuff going on there. I added ignore_group_members = True to /etc/sssd/sssd.conf. – azzid Aug 28 '17 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.