Merge ~sergiodj/ubuntu/+source/sssd:merge-2.7.3-2-kinetic into ubuntu/+source/sssd:debian/sid

[Sergio Durigan Junior]

This is the merge of sssd 2.7.3-2 from Debian unstable.

Here's the FFe for the merge:

https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1988615

In it, you will find a brief explanation of the most important change here: the reversion of the dh-nss usage. Long story short, dh-nss is a new dh sequencer that will make it easier for packages to change the /etc/nsswitch.conf file. However, since it's a new thing, it still has a few rough edges that need to be sorted out. Unfortunately, one of those rough edges is causing sssd's dep8 tests to fail on Debian. Although this specifically problem has been addressed by the dh-nss maintainer, I still don't feel confident enough to bring this change into Ubuntu yet.

I decided to merge this new version because it introduces a change that I think is interesting to our users: "All SSSD client libraries (nss, pam, etc) won't serialize requests anymore by default, i.e. requests from multiple threads can be executed in parallel."

There's a PPA with the proposed change here:

https://launchpad.net/~sergiodj/+archive/ubuntu/sssd-merge/+packages

Because this is an FFe, I also decided to rebuild the reverse Build-Depends. You can find them here:

https://launchpad.net/~sergiodj/+archive/ubuntu/sssd-merge-kinetic/+packages

autopkgtest is still OK:

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-sergiodj-sssd-merge/?format=plain)
  sssd @ amd64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-sergiodj-sssd-merge/kinetic/amd64/s/sssd/20220903_042948_718f7@/log.gz
    03.09.22 04:29:48 ✅ Triggers: sssd/2.7.3-2ubuntu1~ppa2
  sssd @ arm64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-sergiodj-sssd-merge/kinetic/arm64/s/sssd/20220903_043150_f85a9@/log.gz
    03.09.22 04:31:50 ✅ Triggers: sssd/2.7.3-2ubuntu1~ppa2
  sssd @ armhf:
    http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-sergiodj-sssd-merge/kinetic/armhf/s/sssd/20220903_044318_5af0f@/log.gz
    03.09.22 04:43:18 ✅ Triggers: sssd/2.7.3-2ubuntu1~ppa2
  sssd @ ppc64el:
    http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-sergiodj-sssd-merge/kinetic/ppc64el/s/sssd/20220903_042902_f85a9@/log.gz
    03.09.22 04:29:02 ✅ Triggers: sssd/2.7.3-2ubuntu1~ppa2
  sssd @ s390x:
    http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-sergiodj-sssd-merge/kinetic/s390x/s/sssd/20220903_042643_68c49@/log.gz
    03.09.22 04:26:43 ✅ Triggers: sssd/2.7.3-2ubuntu1~ppa2

[Andreas Hasenack (ahasenack)]

review: Needs Information

[Andreas Hasenack (ahasenack)]

The revert looks good, I compared 2.7.3-1 with this branch, debian/ directory only (git diff pkg/import/2.7.3-1..merge-2.7.3-2-kinetic -- debian), and you just missed a comment ("# append 'sss' to the end of the line if it's not found already
"), and a sed was done in a different position.

I guess it's just the automount/automounter question now, and it looks like debian's fix for it in 2.7.3-2 was perhaps incomplete?

b78f6fd... by Sergio Durigan Junior on 2022-09-06

merge-changelogs

d00301b... by Sergio Durigan Junior on 2022-09-06

reconstruct-changelog

331d49c... by Sergio Durigan Junior on 2022-09-06

update-maintainer

[Sergio Durigan Junior (sergiodj)]

Thanks, Andreas.

I've addressed your comments. I decided to add the missing comment to the postinst file and make the revert as clean as possible. The "automount" thing was indeed a thinko; fixed.

I'd appreciate if you could take another quick look. Meanwhile, I will ask the release team to take a look at the FFe bug.

[Andreas Hasenack (ahasenack)]

+1, just please also list in the FFe bug the other two changes that are being done here:
- usage of DPKG_ROOT (no idea what bug that was fixing)
- the s/automounter/automount/ fix in maintainer scripts

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, ahasenack
Uploaders: sergiodj, ahasenack
MP auto-approved

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Tuesday, September 06 2022, Andreas Hasenack wrote:

> Review: Approve
>
> +1, just please also list in the FFe bug the other two changes that are being done here:
> - usage of DPKG_ROOT (no idea what bug that was fixing)
> - the s/automounter/automount/ fix in maintainer scripts

OK, will do.

I pinged #ubuntu-release but so far nobody replied to the FFe bug, so
I'm still waiting...

Thanks.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Sergio Durigan Junior (sergiodj)]

FFe approved.

Uploaded:

$ dput sssd_2.7.3-2ubuntu1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/sssd/sssd_2.7.3-2ubuntu1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/sssd/sssd_2.7.3-2ubuntu1.dsc: Valid signature from 106DA1C8C3CBBF14
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sssd_2.7.3-2ubuntu1.dsc: done.
  Uploading sssd_2.7.3.orig.tar.gz: done.
  Uploading sssd_2.7.3.orig.tar.gz.asc: done.
  Uploading sssd_2.7.3-2ubuntu1.debian.tar.xz: done.
  Uploading sssd_2.7.3-2ubuntu1_source.buildinfo: done.
  Uploading sssd_2.7.3-2ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 8fc6bdc..f74417d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,18 @@
+sssd (2.7.3-2ubuntu1) kinetic; urgency=medium
+    
+  * Merge with Debian unstable (LP: #1987348, #1988615). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Add changes:
+    - Revert dh_nss usage; the feature is still being polished.
+      + d/control: Don't Build-Depend on dh-sequence-installnss.
+      + d/libnss-sss.nss: Remove file.
+      + d/libnss-sss.postinst: Revert changes to use dh-nss.
+      + d/libnss-sss.postrm: Likewise.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 06 Sep 2022 13:56:06 -0400
+
 sssd (2.7.3-2) unstable; urgency=medium
 
   [ Timo Aaltonen ]
@@ -17,6 +32,15 @@ sssd (2.7.3-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 06 Jul 2022 08:52:58 +0300
 
+sssd (2.7.2-3ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 23 Jun 2022 14:03:54 -0400
+
 sssd (2.7.2-3) unstable; urgency=medium
 
   * d/p/fix-shebang-on-sss_analyze.patch: Fix shebang on sss_analyze.
@@ -36,6 +60,18 @@ sssd (2.7.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 22 Jun 2022 13:19:27 +0300
 
+sssd (2.7.1-2ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1971327, #1934997). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Dropped changes:
+    - d/rules: Disable lto, not ready upstream.
+    [ Incorporated by Debian ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 14 Jun 2022 16:59:20 -0400
+
 sssd (2.7.1-2) unstable; urgency=medium
 
   * pac-relax-default-for-pac_check-option.diff: Drop pac_present from
@@ -78,6 +114,31 @@ sssd (2.6.3-2) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Tue, 29 Mar 2022 10:04:50 +0300
 
+sssd (2.6.3-1ubuntu3) jammy; urgency=medium
+
+  * No-change rebuild with new samba 4.15.5
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 24 Feb 2022 08:55:08 -0300
+
+sssd (2.6.3-1ubuntu2) jammy; urgency=medium
+
+  * No-change rebuild with new libnfsidmap from src:nfs-utils
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 17 Feb 2022 10:57:41 -0300
+
+sssd (2.6.3-1ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - d/rules: Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Dropped changes, picked by Debian:
+    - Remove RANDFILE from the config template. It's no longer necessary and
+      breaks with openssl 3.0.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 14 Feb 2022 16:21:21 -0500
+
 sssd (2.6.3-1) unstable; urgency=medium
 
   * New upstream release.
@@ -89,6 +150,40 @@ sssd (2.6.3-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Fri, 11 Feb 2022 09:35:43 +0200
 
+sssd (2.6.1-1ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild with Python 3.10 as default version
+
+ -- Graham Inggs <[e-mail]>  Sun, 16 Jan 2022 15:13:06 +0000
+
+sssd (2.6.1-1ubuntu3) jammy; urgency=medium
+
+  * Remember how architecture lists in debian/control work.
+
+ -- Steve Langasek <[e-mail]>  Fri, 17 Dec 2021 23:12:51 +0000
+
+sssd (2.6.1-1ubuntu2) jammy; urgency=medium
+
+  * Don't build sssd-tools on i386, now uninstallable due to added
+    python3-{click,systemd} dependencies.
+
+ -- Steve Langasek <[e-mail]>  Fri, 17 Dec 2021 21:50:00 +0000
+
+sssd (2.6.1-1ubuntu1) jammy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - Remove RANDFILE from the config template. It's no longer necessary and
+      breaks with openssl 3.0.
+  * Dropped changes, included upstream:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes, included in Debian:
+    - debian/control: Switch to libsemanage-dev from libsemanage1-dev
+
+ -- Steve Langasek <[e-mail]>  Fri, 10 Dec 2021 10:29:16 -0800
+
 sssd (2.6.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -105,6 +200,54 @@ sssd (2.5.2-5) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Mon, 08 Nov 2021 21:17:29 +0200
 
+sssd (2.5.2-4ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild against libssl3
+
+ -- Steve Langasek <[e-mail]>  Thu, 09 Dec 2021 00:19:23 +0000
+
+sssd (2.5.2-4ubuntu3) jammy; urgency=medium
+
+  * Remove RANDFILE from the config template. It's no longer necessary and
+    breaks with openssl 3.0.
+
+ -- Rico Tzschichholz <[e-mail]>  Tue, 23 Nov 2021 20:19:07 +0100
+
+sssd (2.5.2-4ubuntu2) jammy; urgency=medium
+
+  * debian/control: Switch to libsemanage-dev from libsemanage1-dev
+
+ -- Rico Tzschichholz <[e-mail]>  Mon, 22 Nov 2021 20:51:36 +0100
+
+sssd (2.5.2-4ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+      [ Incorporated by Debian.  ]
+    - Fix FTBFS with newer autoconf
+      + debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+        and PYTHON_EXEC_PREFIX in src/external/python.m4.
+      [ Incorporated by Debian. ]
+    - SECURITY UPDATE: shell command injection in sssctl comment
+      + debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+        avoid execution of user supplied command in
+        src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+        src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+      + CVE-2021-3621
+      [ Incorporated by Debian. ]
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+      [ Not needed anymore; issue does not reproduce on Jammy. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 27 Oct 2021 20:16:31 -0400
+
 sssd (2.5.2-4) unstable; urgency=medium
 
   * control: Promote libnss-sss and libpam-sss to sssd-common Depends.
@@ -147,6 +290,63 @@ sssd (2.5.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Thu, 16 Sep 2021 14:51:42 +0300
 
+sssd (2.4.1-2ubuntu4) impish; urgency=medium
+
+  * Fix FTBFS with newer autoconf
+    - debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+      and PYTHON_EXEC_PREFIX in src/external/python.m4.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 08 Sep 2021 11:39:53 -0400
+
+sssd (2.4.1-2ubuntu3) impish; urgency=medium
+
+  * SECURITY UPDATE: shell command injection in sssctl comment
+    - debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+      avoid execution of user supplied command in
+      src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+      src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+    - CVE-2021-3621
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 18 Aug 2021 08:13:38 -0400
+
+sssd (2.4.1-2ubuntu2) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 18:09:16 -0400
+
+sssd (2.4.1-2ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+  * Dropped changes:
+    - d/p/condition-path-exists-sssd-conf.patch: Only start
+      sssd.service if there is a configuration file present.
+      (LP: #1900642)
+      [ Included in 2.4.1-2 ]
+    - d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+      Upstream patch to make sssd.service only able to start when there
+      is a configuration file present.  (LP #1900642)
+    - d/p/condition-path-exists-sssd-conf.patch: Remove.
+      [ Included in 2.4.1-2 ]
+    - Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP #1908065):
+      + d/p/lp-1908065-01-syslog_identifier-format.patch:
+        Upstream patch to include "sssd[]" identifier in program names.
+      + d/p/lp-1908065-02-remove-syslog_identifier.patch:
+        Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+      [ Included in 2.4.1-2 ]
+  * Added changes:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 18 May 2021 17:29:58 -0400
+
 sssd (2.4.1-2) unstable; urgency=medium
 
   [ Marco Trevisan (Treviño) ]
@@ -172,6 +372,59 @@ sssd (2.4.1-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 10 Feb 2021 11:32:35 +0200
 
+sssd (2.4.0-1ubuntu7) impish; urgency=medium
+
+  * d/control: Drop libgdm-dev Build-Depend on i386.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 11 May 2021 16:22:31 -0400
+
+sssd (2.4.0-1ubuntu6) hirsute; urgency=medium
+
+  * Disable lto, not ready upstream.
+
+ -- Matthias Klose <[e-mail]>  Tue, 23 Mar 2021 13:18:53 +0100
+
+sssd (2.4.0-1ubuntu5) hirsute; urgency=medium
+
+  * No change rebuild with fixed ownership.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 16 Feb 2021 15:22:14 +0000
+
+sssd (2.4.0-1ubuntu4) hirsute; urgency=medium
+
+  * Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP: #1908065):
+    - d/p/lp-1908065-01-syslog_identifier-format.patch:
+      Upstream patch to include "sssd[]" identifier in program names.
+    - d/p/lp-1908065-02-remove-syslog_identifier.patch:
+      Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+
+ -- Valters Jansons <[e-mail]>  Fri, 05 Feb 2021 20:51:32 +0000
+
+sssd (2.4.0-1ubuntu3) hirsute; urgency=medium
+
+  * d/apparmor-profile: Update profile. (LP: #1910611)
+    - Extend read permissions to /etc/sssd/conf.d/* and /etc/gss/mech.d/*.
+    - Add read/execute permission to /usr/libexec/sssd/*.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 18 Jan 2021 16:57:21 -0500
+
+sssd (2.4.0-1ubuntu2) hirsute; urgency=medium
+
+  * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+    Upstream patch to make sssd.service only able to start when there
+    is a configuration file present.  (LP: #1900642)
+  * d/p/condition-path-exists-sssd-conf.patch: Remove.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 12 Jan 2021 16:17:38 -0500
+
+sssd (2.4.0-1ubuntu1) hirsute; urgency=medium
+
+  * d/p/condition-path-exists-sssd-conf.patch: Only start
+    sssd.service if there is a configuration file present.
+    (LP: #1900642)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 10 Dec 2020 14:20:24 -0500
+
 sssd (2.4.0-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1241,3 +1494,4 @@ sssd (0.5.0-0ubuntu1) karmic; urgency=low
   * Initial release.
 
  -- Mathias Gug <[e-mail]>  Mon, 24 Aug 2009 16:35:11 -0400
+
diff --git a/debian/control b/debian/control
index 8618c7a..4a8fc74 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>,
  Dominik George <[e-mail]>
 Build-Depends:
@@ -11,7 +12,6 @@ Build-Depends:
  debhelper-compat (= 12),
  dh-apparmor,
  dh-python,
- dh-sequence-installnss,
  dnsutils,
  docbook-xml,
  docbook-xsl,
@@ -27,7 +27,7 @@ Build-Depends:
  libcurl4-openssl-dev,
  libdbus-1-dev,
  libdhash-dev,
- libgdm-dev [!s390x !kfreebsd-any !hurd-any],
+ libgdm-dev [!s390x !kfreebsd-any !hurd-any !i386],
  libglib2.0-dev,
  libini-config-dev,
  libjansson-dev,
@@ -229,7 +229,7 @@ Description: System Security Services Daemon -- proxy back end
  PAM modules to leverage SSSD caching.
 
 Package: sssd-tools
-Architecture: any
+Architecture: amd64 arm64 armhf ppc64el riscv64 s390x
 Depends:
  python3,
  python3-sss,
diff --git a/debian/libnss-sss.nss b/debian/libnss-sss.nss
deleted file mode 100644
index b775128..0000000
--- a/debian/libnss-sss.nss
+++ /dev/null
@@ -1,6 +0,0 @@
-passwd	last	sss
-group	last	sss
-shadow	last	sss
-netgroup	last	sss
-services	last	sss
-automount	last	sss
diff --git a/debian/libnss-sss.postinst b/debian/libnss-sss.postinst
index 547ae99..8faf711 100755
--- a/debian/libnss-sss.postinst
+++ b/debian/libnss-sss.postinst
@@ -1,19 +1,31 @@
 #!/bin/sh
 set -e
 
+#DEBHELPER#
+
+# This code was taken from libnss-myhostname, which got it from nss-mdns:
+
 log() {
     echo "$*"
 }
 
-# Add the `automount` database to nsswitch.conf if it's not there.
-insert_nss_automount_db () {
+# try to insert sss entries to the passwd, group, shadow and netgroup
+# lines in /etc/nsswitch.conf to automatically enable libnss-sss
+# support; do not change the configuration if the lines already
+# references some sss lookups
+insert_nss_entry() {
     log "Checking NSS setup..."
     # abort if /etc/nsswitch.conf does not exist
     if ! [ -e "${DPGK_ROOT}/etc/nsswitch.conf" ]; then
         log "Could not find ${DPKG_ROOT}/etc/nsswitch.conf."
         return
     fi
-
+    # append 'sss' to the end of the line if it's not found already
+    sed -i --regexp-extended '
+      /^(passwd|group|shadow|netgroup|services|automount):/ {
+        /\bsss\b/! s/$/ sss/
+      }
+    ' /etc/nsswitch.conf
     # and add a new entry for automount if it's not there
     if ! grep -q automount "${DPKG_ROOT}/etc/nsswitch.conf" ; then
         log "Setting up empty automount NSS database"
@@ -26,8 +38,9 @@ action="$1"
 if [ configure = "$action" ]; then
     if [ -z "$2" ]; then
         log "First installation detected..."
-        # first install: setup automount NSS database.
-        insert_nss_automount_db
+        # first install: setup the recommended configuration (unless
+        # nsswitch.conf already contains sss entries)
+        insert_nss_entry
     else
         # upgrade
         version="$2"
@@ -38,5 +51,3 @@ if [ configure = "$action" ]; then
         fi
     fi
 fi
-
-#DEBHELPER#
diff --git a/debian/libnss-sss.postrm b/debian/libnss-sss.postrm
index ea36611..426adfc 100755
--- a/debian/libnss-sss.postrm
+++ b/debian/libnss-sss.postrm
@@ -3,11 +3,13 @@ set -e
 
 #DEBHELPER#
 
+# This code was taken from libnss-myhostname, which got it from nss-mdns:
+
 log() {
     echo "$*"
 }
 
-remove_nss_automount_db () {
+remove_nss_entry() {
     log "Checking NSS setup..."
     # abort if /etc/nsswitch.conf does not exist
     if ! [ -e "${DPKG_ROOT}/etc/nsswitch.conf" ]; then
@@ -17,12 +19,18 @@ remove_nss_automount_db () {
 
     # Remove NSS databases: `automount` and `automounter` (legacy).
     sed -i '/^automount/d' "${DPKG_ROOT}/etc/nsswitch.conf"
+    sed -i --regexp-extended '
+      /^(passwd|group|shadow|netgroup|services):/ {
+        s/\bsss\b//g
+        s/[[:space:]]+$//
+      }
+    ' /etc/nsswitch.conf
 }
 
 case "$1" in
     remove|purge)
         if [ "${DPKG_MAINTSCRIPT_PACKAGE_REFCOUNT:-1}" = 1 ]; then
-            remove_nss_automount_db
+            remove_nss_entry
         fi
     ;;
     upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)