On Fri, Apr 27, 2018 at 8:48 AM, Simo Sorce <simo@redhat.com> wrote:
On Thu, 2018-04-26 at 21:02 -0400, Rob Crittenden via FreeIPA-users
wrote:
> Ildefonso Camargo via FreeIPA-users wrote:
> > Hello,
> >
> > At this point I am mostly looking for confirmation/denial of the
> > following observed behavior:
> >
> > FreeIPA Kerberos will issue service tickets to a user with a valid TGT
> > regardless of access control rules (HBAC).
> >
> > Procedure to observe:
> >
> > 1. Create a test user.
> > 2. Allow that user to login to one host, and just one (via ssh or so),
> > HBAC is used.
> > 3. Check that the user has a TGT (klist),or issue kinit as needed.
> > 4. Try to ssh (or connect to any other Kerberos service) to any other
> > server, you will probably get access denied (PAM-based services) because
> > of HBAC, or even allowed (Kerberos-based services that do not use PAM).
> > 5. Get that ticket list again: you got service ticket for every single
> > host, even the ones to which you do not have access.
> >
> > This is causing me great grieving ( :( ), because I was hoping to
> > control authorization to a Kerberos service using FreeIPA, it turns out
> > it just allows everyone in and now I have to add authorization at the
> > service level, which could eventually use PAM, but... come on, why
> > doesn't FreeIPA inspect access policies before issuing the ticket?
> > (unless it does and I am missing something?)
>
> HBAC enforcement is done per host, on the pam level by service name. So
> if a service does not use PAM then HBAC does not apply.
>
> > So... can you confirm if what I found is the way it is supposed to work
> > in its current state? (version 4.5.0)
>
> Yes it is working as designed.

Let me add a point here that may escape the casual viewer.
Using PAM does not mean "authenticate via PAM", it means that the
software needs to run the PAM *account* stack to check if the user is
allowed to log in.
So you can safely use krb auth and still use HBAC rules provided the
software has switches to check the PAM account stack.

Yes, I know this, but it then requires modifying the service to use PAM in addition to GSS, or just plainly implement its own authorization schema (which is what I ended up doing, adding PAM would've required source code modification), so, for my project FreeIPA is now just an authenticator.  However, there is more, FreeIPA's website and part of documentation makes you believe for most of the time that HBAC is done at the Kerberos level (which I thought was awesome), on main web site it says, and I quote:

"Define Kerberos authentication and authorization policies for your identities."

It is, definitely, NOT kerberos, policies are applied at another level, kerberos seems set to allow everyone to access everything.  I am wondering if I can get a TGT from an unauthorized system, I shall try, I wouldn't be surprised if it succeeded.

On this documentation page, it doesn't mention a thing about PAM:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/configuring-host-access#how-hbac

And here:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/hbac-add-service

It *finally* mentions PAM, but it doesn't sound like a requirement, just like that you kind of can *also* define PAM services.

There is some more:

https://www.freeipa.org/page/V4/Authentication_Indicators

The diagram shows a "Validate Policy" step, and in text it says "Once the KDC has a list of acceptable indicators, it can make the proper policy evaluation."... no, I have not reviewed this last document in depth, but was among the places I visited trying to understand what was going on.

I came to realize HBAC was PAM-based (authorization layer) after several tests failed on me, and when I saw the Kerberos ticket cache (where I saw *all* of the service tickets for every service, allowed or denied): that explained it all, Kerberos was not enforcing Authorization rules.

So, I am not sure I can call this working as "designed", from the way documentation was written, it would seem that by design it was at least intended to have this control at the Kerberos level and, somehow, ended up down to PAM (or maybe the intention was to have them at both places, Kerberos and PAM).

Where did I found documentation that would insinuate that PAM was *required* for HBAC? why, here:

https://www.freeipa.org/page/Web_App_Authentication

Yes, a web application howto... unrelated to the pure Kerberized service I was working on setting up, but that document confirmed my fears.

The takeaway from this is, imo, that documentation needs updating to accurately reflect the way the system behaves, a clear description of *how* HBAC currently works would be greatly appreciated as part of this project's documentation, so that people like me can plan accordingly and avoid wasting a ton of time to find out a feature has additional dependencies.

Sincerely,

Ildefonso
 

Simo.

--
Simo Sorce
Sr. Principal Software Engineer
Red Hat, Inc




--
Ildefonso Camargo
Command Prompt, Inc. - http://www.commandprompt.com/
PostgreSQL Support, Training, Professional Services and Development
High Availability, Oracle Conversion, Postgres-XC
@cmdpromptinc - 509-416-6579