The right HBAC is called *allow_ad_ipa_admins*, that match the IPA group
*ad_ipa_admins*, that is trusted with the group '*IPA Admins*' in Active
Directory.
I tested the *id morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com>*
command both in the client and the server, they differ only for the last
part *,219402407(ad_ipa_admins)*.
I can see it in the client, not in the server.
But the same client, as said last time, sometimes works correctly, please
see these logs captured doing a SSH connection with the AD credential,
after cleaning manually the sssd cache of the client:
*[root@mlv-testipa01 ~]# systemctl stop sssd ; rm -rf /var/lib/sss/db/* ;
systemctl start sssd[root@mlv-testipa01 ~]# tail -f /var/log/sssd/*log |
grep -i allow(Mon Feb 25 15:35:41 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [loginAllowedTimeMap](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[ipa_hbac_rule_info_next] (0x0400): Sending request for next search base:
[
cn=hbac,dc=ipa,dc=mydomain,dc=com][2][(&(objectclass=ipaHBACRule)(ipa...
<
http://mlv-testipa01.ipa.mydomain.com>,cn=computers,cn=accounts,dc=ipa...
Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [sdap_get_generic_ext_step] (0x0400): calling
ldap_search_ext with
[(&(objectclass=ipaHBACRule)(ipaenabledflag=TRUE)(accessRuleType=allow)(|(hostCategory=all)(memberHost=fqdn=mlv-testipa01.ipa.mydomain.com
<
http://mlv-testipa01.ipa.mydomain.com>,cn=computers,cn=accounts,dc=ipa...
Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_attrs_to_rule] (0x1000): Processing rule
[allow_ipa_it_mysite](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_user_attrs_to_rule] (0x1000): Processing
users for rule [allow_ipa_it_mysite](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_user_attrs_to_rule] (0x2000): Added non-POSIX group [ipa_it_mysite]
to rule [allow_ipa_it_mysite](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_service_attrs_to_rule] (0x1000): Processing PAM services for rule
[allo _ipa_it_mysite](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_thost_attrs_to_rule] (0x1000):
Processing target hosts for rule [allow_ipa_it_mysite](Mon Feb 25 15:36:23
2019) [
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule
[allow_ipa_it_mysite](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_attrs_to_rule] (0x1000): Processing rule
[allow_ad_ipa_admins](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_user_attrs_to_rule] (0x1000): Processing
users for rule [allow_ad_ipa_admins](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_user_attrs_to_rule] (0x2000): Added POSIX group
[ad_ipa_admins(a)ipa.mydomain.com <ad_ipa_admins(a)ipa.mydomain.com>] to rule
[allow_ad_ipa_admins](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_service_attrs_to_rule] (0x1000):
Processing PAM services for rule [allo _ad_ipa_admins](Mon Feb 25 15:36:23
2019) [
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_thost_attrs_to_rule] (0x1000): Processing target hosts for rule
[allow_ad_ipa_admins](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_shost_attrs_to_rule] (0x0400):
Processing source hosts for rule [allow_ad_ipa_admins](Mon Feb 25 15:36:23
2019) [
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_attrs_to_rule] (0x1000): Processing rule [allow_bexec](Mon Feb 25
15:36:23 2019) [
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_user_attrs_to_rule] (0x1000): Processing users for rule
[allow_bexec](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_service_attrs_to_rule] (0x1000):
Processing PAM services for rule [allo _bexec](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_service_attrs_to_rule] (0x2000): Added service [sshd] to rule
[allow_bexec](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_thost_attrs_to_rule] (0x1000):
Processing target hosts for rule [allow_bexec](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_shost_attrs_to_rule] (0x0400): Processing source hosts for rule
[allow_bexec](Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_rule_debug_print] (0x2000): RULE
[allow_ipa_it_mysite] [ENABLED]:(Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]] [hbac_evaluate]
(0x0100): The rule [allow_ipa_it_mysite] did not match.(Mon Feb 25 15:36:23
2019) [
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[hbac_rule_debug_print] (0x2000): RULE [allow_ad_ipa_admins]
[ENABLED]:(Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [hbac_evaluate] (0x0100): ALLOWED by rule
[allow_ad_ipa_admins].(Mon Feb 25 15:36:23 2019) [
sssd[be[ipa.mydomain.com
<
http://ipa.mydomain.com>]]] [ipa_hbac_evaluate_rules] (0x0080): Access
granted by HBAC rule [allow_ad_ipa_admins](Mon Feb 25 15:36:23 2019)
[
sssd[be[ipa.mydomain.com <
http://ipa.mydomain.com>]]]
[sdap_get_generic_ext_step] (0x1000): Requesting attrs:
[loginAllowedTimeMap]*
So it's a strange behaviour because sometimes it worked and sometimes not.
Which logs shoul be useful now?
Please let me know, thanks
Il giorno lun 25 feb 2019 alle ore 09:45 Sumit Bose <sbose(a)redhat.com> ha
scritto:
On Mon, Feb 25, 2019 at 09:02:30AM +0100, Morgan Marodin wrote:
> No, it's not true. It's random ... it not depends (maybe) from the
server.
> You can find attached the debug logs from the test client, thanks
Hi,
at the end of the logs you can see the evaluation of the HBAC rules:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate]
(0x0100): [< hbac_evaluate()
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_req_debug_print] (0x2000): REQUEST:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): service [sshd]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): service_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): user [morgan.marodin]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): user_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): targethost [
mlv-testipa01.ipa.mydomain.com]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): targethost_group
(none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): srchost
[192.168.100.252]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): srchost_group (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_req_debug_print] (0x2000): request time 2019-02-21
16:04:23
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_debug_print] (0x2000): RULE [allow_ipa_it_mysite] [ENABLED]:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_debug_print] (0x2000): services:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000): category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_debug_print] (0x2000): users:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000): category [0] [NONE]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000): users_names (none)
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000): users_groups:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000):
[ipa_it_mysite]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_debug_print] (0x2000): targethosts:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000): category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_debug_print] (0x2000): srchosts:
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_rule_element_debug_print] (0x2000): category [0x1] [ALL]
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]] [hbac_evaluate]
(0x0100): The rule [allow_ipa_it_mysite] did not match.
......
The allow_ipa_it_mysite and all other rules do not match because
(Thu Feb 21 16:04:23 2019) [sssd[be[ipa.mydomain.com]]]
[hbac_request_element_debug_print] (0x2000): user_group (none)
Earlier in the logs, when the group memberships of the user are looked up:
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): Received [7] groups in group list from
IPA Server
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [morgan.marodin(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [local proxy exclusion(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [mysite signature(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [mysite users(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [ipa admins(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [mysite it(a)mydomain.com].
(Thu Feb 21 16:04:13 2019) [sssd[be[ipa.mydomain.com]]]
[ipa_s2n_get_user_done] (0x0400): [domain users(a)mydomain.com].
there are only groups from the AD domain and the IPA group memberships are
missing.
I would expect that 'id morgan.marodin(a)mydomain.com' only returns the
groups
listed above both on the client and on the server. Since the client gets
the
group-memberships from the server the next step would be to check the
server
logs.
For this please call 'sss_cache -E' on the server to invalidate the cache
on
the server and then 'id morgan.marodin(a)mydomain.com' on the server and
send the
logs covering the time of the id request. Please do not forget to set
debug_level=9 in the [nss] and [domain/...] sections on the IPA server.
bye,
Sumit
>
> Il giorno gio 21 feb 2019 alle ore 16:01 Sumit Bose via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org> ha scritto:
>
> > On Thu, Feb 21, 2019 at 03:47:15PM +0100, Morgan Marodin via
FreeIPA-users
> > wrote:
> > > I did some tests, because some times SSH logins worked ... and
sometimes
> > > not.
> > >
> > > It seems that the problem is not client side:
> > > - if I stop the 1st IPA server I'm able to login via SSH via AD
> > credentials
> > > - if I stop the 2nd one (after started the other one, naturally) the
> > issue
> > > appears again
> > >
> > > With only the issued server started the I'm able to do a *kinit*
> > correctly.
> > > What could I check server side?
> >
> > I think it would be better to check the SSSD logs on the client side.
> > Please add debug_level=9 to the [pam] and [domain/...] sections of
> > sssd.conf, restart SSSD and retry the login with only the 1st server
> > running to reproduce the issue.
> >
> > According to the log snippet you send earlier, it is expected that
kinit
> > works fine because the authentication step 'pam_sss(sshd:auth)' was
> > successful. This is the step which does a similar operation as kinit.
> > The failure was in the next step 'pam_sss(sshd:access)' which is
access
> > control.
> >
> > bye,
> > Sumit
> >
> > >
> > > Please let me know, thanks.
> > > Morgan
> > >
> > > Il giorno mar 19 feb 2019 alle ore 19:57 Sumit Bose via
FreeIPA-users <
> > > freeipa-users(a)lists.fedorahosted.org> ha scritto:
> > >
> > > > On Tue, Feb 19, 2019 at 06:19:18PM +0100, Morgan Marodin via
> > FreeIPA-users
> > > > wrote:
> > > > > Hi everybody.
> > > > >
> > > > > I have just upgraded my cluster from FreeIPA 4.4.0-14 to
4.6.4-10.
> > > > > All is good, logging via IPA credentials, HBAC and sudo rules
are
> > > > working.
> > > > > I have only a issue logging via SSH with AD credentials. Before
the
> > > > upgrade
> > > > > all was working well.
> > > > >
> > > > > I think that the trust is ok, because *kinit*, *ipa hbactest*
and
> > *ipa
> > > > > trustdomain-find* (on both ipa servers) are working well:
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > *[root@mlv-ipasrv01 ~]# ipa trustdomain-find
MYDOMAIN.COM
> > > > > <
http://MYDOMAIN.COM> Domain name:
mydomain.com <
> >
http://mydomain.com>
> > > > > Domain NetBIOS name: MYDOMAIN Domain Security Identifier:
> > > > > S-1-5-21-3367759252-2451474351-126822339 Domain enabled:
> > > > > True----------------------------Number of entries returned
> > > > > 1----------------------------[root@mlv-ipasrv01 ~]# ipa
hbactest
> > > > > --user=morgan.marodin(a)mydomain.com
<morgan.marodin(a)mydomain.com>
> > > > > --host=mlv-testipa01.ipa.mydomain.com
> > > > > <
http://mlv-testipa01.ipa.mydomain.com>Service:
> > > > > sshd--------------------Access granted:
True--------------------
> > Matched
> > > > > rules: allow_ad_ipa_admins Not matched rules:
allow_ad_ipa_apps Not
> > > > > matched rules: allow_ipa_it_mysite[root@mlv-testipa01 ~]# kinit
> > > > > morgan.marodin(a)mydomain.com <morgan.marodin(a)mydomain.com
>Password
> > for
> > > > > morgan.marodin(a)mydomain.com
> > > > > <morgan.marodin@mydomain.com>:[root@mlv-testipa01 ~]#
klistTicket
> > cache:
> > > > > KEYRING:persistent:0:0Default principal:
morgan.marodin(a)MYDOMAIN.COM
> > > > > <morgan.marodin(a)MYDOMAIN.COM>Valid starting Expires
> > > > > Service principal02/19/2019 17:55:23 02/20/2019 03:55:23
> > > > > krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM
<MYDOMAIN.COM(a)MYDOMAIN.COM>
> > > > renew
> > > > > until 02/20/2019 17:55:18*
> > > > >
> > > > > This is the error log:
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > *[root@mlv-testipa01 ~]# tail -f /var/log/secureFeb 19 18:03:21
> > > > > mlv-testipa01 sshd[378408]: pam_sss(sshd:auth): authentication
> > success;
> > > > > logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.0.252
> > > > > user=morgan.marodin(a)mydomain.com
<morgan.marodin(a)mydomain.com>Feb
19
> > > > > 18:03:21 mlv-testipa01 sshd[378408]: pam_sss(sshd:account):
Access
> > denied
> > > > > for user morgan.marodin(a)mydomain.com <
morgan.marodin(a)mydomain.com>:
> > 6
> > > > > (Permission denied)
> > > >
> > > > This is returned by SSSD, please add debug_level=9 to the
[domain/...]
> > > > section of sssd.conf, restart, SSSD and try to login again. In the
> > > > domain log you should find the evaluation of the HBAC rules which
might
> > > > explain why access was denied.
> > > >
> > > > > Feb 19 18:03:21 mlv-testipa01 sshd[378401]: error: PAM:
> > > > > User account has expired for morgan.marodin(a)mydomain.com
> > > > > <morgan.marodin(a)mydomain.com> from 192.168.100.252
> > > >
> > > > I'm not sure where this message comes from. I had a short look
at
the
> > > > ssh and PAM source code, but so far didn't find a matching
messages.
> > > >
> > > > bye,
> > > > Sumit
> > > >
> > > > > Feb 19 18:03:21
> > > > > mlv-testipa01 sshd[378401]: fatal: monitor_read: unpermitted
request
> > 104*
> > > > >
> > > > > It seems a problem with pam and sssd.
> > > > > Do you have any suggestions?
> > > > >
> > > > > Thanks, bye.
> > > > > Morgan
> > > >
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> > > > > To unsubscribe send an email to
> > > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > > > List Guidelines:
> >
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > > List Archives:
> > > >
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > > List Guidelines:
> >
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > >
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > > >
> >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> >
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>