________________________________________
From: 389-users-bounces(a)lists.fedoraproject.org
[389-users-bounces(a)lists.fedoraproject.org] on behalf of Gordon Messmer
[yinyang(a)eburg.com]
Sent: 22 July 2010 04:17
To: General discussion list for the 389 Directory server project.
Subject: Re: [389-users] Preventing ssh keys from granting a user access when LDAP account
is disabled.
On 07/21/2010 08:53 AM, Gordon Messmer wrote:
> There are a number of pam_... options available in /etc/ldap.conf, but
> I'm not sure if those are used when doing ssh logins with keys. That's
> probably worth checking out if you use nss_ldap. There are probably
> similar options for nss_sss, but I haven't looked at that yet either. :)
I played around with some options after setting the following in
/etc/ldap.conf:
pam_filter !(nsRoleDN=cn=nsmanageddisabledrole,dc=...)
The syntax is correct, and it works for password authentication (such as
"su"). However, even after setting all of the ldap modules in PAM to
"required", I'm still able to log in with a key. The documentation for
PAM in the sshd configuration file leads me to believe that this cannot
be made to work. If you allow key based logins, you cannot lock
accounts out using PAM+LDAP. That means that if you want to lock out a
user, you must completely invalidate their account. The big drawback
would be that a user who mistypes their password too many times will
probably stop receiving email (assuming you've tied your email system to
LDAP).
Well that is usefull to know at least. I have'nt played around with pam_filter yet but
may be able to utilize it for something else.
I believe you can do that in /etc/ldap.conf:
nss_base_passwd ou=People..?sub?!(nsRoleDN=...)
>> I still don't understand pam as well as I should but it would make
>> sense to me for PAM to "check" LDAP before checking ssh...
Remember that OpenSSH is maintained by the OpenBSD developers, where
there is no PAM. PAM support is added by the Portable OpenSSH group.
Support for PAM is probably imperfect.
It is unfortunate. It would be nice if you could do a logical AND in PAM to utilize two
sources of authentication. My understanding was that PAM is the bastion for all
authentication and that nothing happens without its say so.
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________