On Fri, Apr 27, 2018 at 8:48 AM, Simo Sorce <simo(a)redhat.com> wrote:
On Thu, 2018-04-26 at 21:02 -0400, Rob Crittenden via FreeIPA-users
> Ildefonso Camargo via FreeIPA-users wrote:
> > Hello,
> > At this point I am mostly looking for confirmation/denial of the
> > following observed behavior:
> > FreeIPA Kerberos will issue service tickets to a user with a valid TGT
> > regardless of access control rules (HBAC).
> > Procedure to observe:
> > 1. Create a test user.
> > 2. Allow that user to login to one host, and just one (via ssh or so),
> > HBAC is used.
> > 3. Check that the user has a TGT (klist),or issue kinit as needed.
> > 4. Try to ssh (or connect to any other Kerberos service) to any other
> > server, you will probably get access denied (PAM-based services)
> > of HBAC, or even allowed (Kerberos-based services that do not use PAM).
> > 5. Get that ticket list again: you got service ticket for every single
> > host, even the ones to which you do not have access.
> > This is causing me great grieving ( :( ), because I was hoping to
> > control authorization to a Kerberos service using FreeIPA, it turns out
> > it just allows everyone in and now I have to add authorization at the
> > service level, which could eventually use PAM, but... come on, why
> > doesn't FreeIPA inspect access policies before issuing the ticket?
> > (unless it does and I am missing something?)
> HBAC enforcement is done per host, on the pam level by service name. So
> if a service does not use PAM then HBAC does not apply.
> > So... can you confirm if what I found is the way it is supposed to work
> > in its current state? (version 4.5.0)
> Yes it is working as designed.
Let me add a point here that may escape the casual viewer.
Using PAM does not mean "authenticate via PAM", it means that the
software needs to run the PAM *account* stack to check if the user is
allowed to log in.
So you can safely use krb auth and still use HBAC rules provided the
software has switches to check the PAM account stack.
Yes, I know this, but it then requires modifying the service to use PAM in
addition to GSS, or just plainly implement its own authorization schema
(which is what I ended up doing, adding PAM would've required source code
modification), so, for my project FreeIPA is now just an authenticator.
However, there is more, FreeIPA's website and part of documentation makes
you believe for most of the time that HBAC is done at the Kerberos level
(which I thought was awesome), on main web site it says, and I quote:
"Define Kerberos authentication and authorization policies for your
It is, definitely, NOT kerberos, policies are applied at another level,
kerberos seems set to allow everyone to access everything. I am wondering
if I can get a TGT from an unauthorized system, I shall try, I wouldn't be
surprised if it succeeded.
On this documentation page, it doesn't mention a thing about PAM:
It *finally* mentions PAM, but it doesn't sound like a requirement, just
like that you kind of can *also* define PAM services.
There is some more:
The diagram shows a "Validate Policy" step, and in text it says "Once the
KDC has a list of acceptable indicators, it can make the proper policy
evaluation."... no, I have not reviewed this last document in depth, but
was among the places I visited trying to understand what was going on.
I came to realize HBAC was PAM-based (authorization layer) after several
tests failed on me, and when I saw the Kerberos ticket cache (where I saw
*all* of the service tickets for every service, allowed or denied): that
explained it all, Kerberos was not enforcing Authorization rules.
So, I am not sure I can call this working as "designed", from the way
documentation was written, it would seem that by design it was at least
intended to have this control at the Kerberos level and, somehow, ended up
down to PAM (or maybe the intention was to have them at both places,
Kerberos and PAM).
Where did I found documentation that would insinuate that PAM was
*required* for HBAC? why, here:
Yes, a web application howto... unrelated to the pure Kerberized service I
was working on setting up, but that document confirmed my fears.
The takeaway from this is, imo, that documentation needs updating to
accurately reflect the way the system behaves, a clear description of *how*
HBAC currently works would be greatly appreciated as part of this project's
documentation, so that people like me can plan accordingly and avoid
wasting a ton of time to find out a feature has additional dependencies.
Sr. Principal Software Engineer
Red Hat, Inc
Command Prompt, Inc. - http://www.commandprompt.com/
PostgreSQL Support, Training, Professional Services and Development
High Availability, Oracle Conversion, Postgres-XC
@cmdpromptinc - 509-416-6579