On Fri, Feb 14, 2020 at 08:50:26PM -0000, Leon Castellano via FreeIPA-users wrote:
Hi Sumit,
Actually, I just got it working without forwarding card:
yum install -y pam_ssh_agent_auth
Hi,
great, if this is sufficient for your environment, even better.
However, if you don't min feel free to open a ticket at
bugzilla.redhat.com to get the issue with the card forwarding fixed as
well. The issue, as you might have seen, is that SSSD tries to access
the forwarded socket as root while the forwarding scheme expects that it
is accessed as the user who forwarded it. It is a bit tricky with
su/sudo with respect to real and effective UIDs but I started to work on
a patch to get the needed information some time ago.
bye,
Sumit
~/.ssh/config:
ForwardAgent yes
/etc/sudoers:
Defaults env_keep += "SSH_AUTH_SOCK"
/etc/pam.d/sudo:
#%PAM-1.0
auth sufficient pam_ssh_agent_auth.so
authorized_keys_command=/usr/bin/sss_ssh_authorizedkeys
auth include system-auth
account include system-auth
password include system-auth
session include system-auth
systemctl restart sshd
systemctl restart sssd
[user@local][~]$ ssh ipaclient
[user@ipaclient][~]$ sudo -i
[root@gs66-ipaclient][~]#
Thanks for your time!
-Leon
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...