Hello,
Apologies if I am misunderstanding and this is incorrect, but users who
log in via SSH keys do not get Kerberos tickets by default, which is why
your pam_sss_sudo isn't working. You can reference this issue here:
https://pagure.io/freeipa/issue/4000/
I have been wondering the same thing myself lately for our Ansible
environment as we are moving to Kerberized NFS home directories. I may
try your suggestion, or just have a script to generate a ticket for the
ansible user via a keytab when/if the admin 'su's to ansible.
It would be nice if ansible.cfg had keytab support
On 7/15/2022 6:37 AM, Sam Morris via FreeIPA-users wrote:
> On 08/07/2022 07:57, Sigbjorn Lie-Soland wrote:
>>
>>
>>> On 8 Jun 2022, at 10:26, Sam Morris via FreeIPA-users
>>> <freeipa-users(a)lists.fedorahosted.org> wrote:
>>>
>>> On 03/06/2022 08:19, Sigbjorn Lie via FreeIPA-users wrote:
>>>> Hi list,
>>>> When I have a 2FA enabled user account, I receive the two password
>>>> prompt for sudo at a host, even on hosts where 2FA is not required.
>>>> This breaks Ansible for me, when using "become" with Ansible.
>>>
>>> A way forward might be to use GSSAPIAuthentication to authenticate
>>> to the remote server, GSSAPIDelegateCredentials to forward your
>>> Kerberos TGT to the remote server, and (on the server side)
>>> configure pam_sss_gss in sudo's PAM stack so that users with a valid
>>> Kerberos TGT do not get prompted for their passwords at all.
>>>
>>
>> This is an option. Have you done this yourself and perhaps has an
>> example of what such a PAM stack looks like?
>
> On the server side (assuming RHEL), you need:
>
> [user@host ~]$ cat /etc/pam.d/sudo
> #%PAM-1.0
> auth sufficient pam_sss_gss.so
> auth include system-auth
> account include system-auth
> password include system-auth
> session include system-auth
>
> and
>
> [user@host ~]$ sudo crudini --format=ini --get /etc/sssd/sssd.conf pam
> [pam]
> pam_gssapi_services = sudo, sudo-i
>
> On the client side:
>
> $ ansible --ssh-common-args='-o GSSAPIDelegateCredentials=yes' -b -i
>
host.example.com, all -m id
>
> Note that there is a bug in RHEL 8.6 that prevents this from working:
> <
https://bugzilla.redhat.com/show_bug.cgi?id=2088817> (I'm hoping for
> a bugfix advisory soon...) :)
>
> Things to check if it doesn't work:
>
> * Do you have a valid TGT on the client? (klist -s && echo OK)
> * Does 'ssh -o GSSAPIAuthentication=yes host.example.com' work?
> * Add 'debug' to the PAM module configuration and watch syslog &
> sssd_pam.log to see why the PAM module might not work
>