Hi.

I have created a HBAC rule for sysadmins.. One that has all services enabled.

Logically I would expect only users with the service 'su-l' enabled to be able to su - [user].

However in reality it is working the opposite way ... 

i.e I have 2 users - both are allowed on the server I am testing on

user 1 : mcox - this has all services enabled
user 2: mcox3 - this only has sshd enabled 

However - user mcox cannot 'su - mcox3', but user mcox3 can 'su - mcox' - which seems the wrong way round - I would expect only users with 'su-l' service to be able to su -  ??

- mcox -> mcox3 gets 'su: Permission denied'

hbactest shows I should be granted on mcox and fail on mcox3

Is it my understanding of the rule at fault or someone else ?

Note : user mcox can 'su - mcox' also..

Below are the rules

for user : mcox

# ipa hbactest --user mcox --host ipaclient2.cpgbpc.local --service su-l
--------------------
Access granted: True
--------------------
  Matched rules: allow_all_sysadmin
  Not matched rules: allow_desktop
  Not matched rules: allow_ssh_access
-----------

# ipa hbacrule-show allow_all_sysadmin
  Rule name: allow_all_sysadmin
  Host category: all
  Service category: all
  Enabled: TRUE
  Users: mcox
  User Groups: sysadmin
---------------

For user mcox3

# ipa hbactest --user mcox3 --host ipaclient2.cpgbpc.local --service su-l
---------------------
Access granted: False
---------------------
  Not matched rules: allow_all_sysadmin
  Not matched rules: allow_desktop
  Not matched rules: allow_ssh_access

# ipa hbacrule-show allow_ssh_access
  Rule name: allow_ssh_access
  Enabled: TRUE
  Users: mcox2, mcox3
  Hosts: ipaclient2.cpgbpc.local
  Services: sshd

And if it helps here is sssd_[domain].log

For when mcox tries to su - mcox3 (and fails)


------------------------------------------
Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=mcox3@cpgbpc.local]
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=2dabbee6-4872-11e8-b88d-5254008ff913,cn=ng,cn=alt,dc=cpgbpc,dc=local, returned 0 results. Skipping
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=44300e26-495b-11e8-8f22-5254008ff913,cn=hbac,dc=cpgbpc,dc=local, returned 0 results. Skipping
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox3@cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost:
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 1
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2269
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [be_resolve_server_process] (0x0200): Found address for server imd2.cpgbpc.local: [192.168.90.201] TTL 727
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler] (0x0100): child [2271] finished successfully.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [cache] attrs.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox3@cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost:
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2269
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [ipa_hostgroup_info_done] (0x0200): Dereferenced host group: ipa-test-clients
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [get_ipa_groupname] (0x0020): Expected cn in RDN, got uid
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_user_attrs_to_rule] (0x0020): [uid=mcox2,cn=users,cn=accounts,dc=cpgbpc,dc=local] does not map to either a user or group. Skipping
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): [< hbac_evaluate()
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): The rule [allow_ssh_access] did not match.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): The rule [allow_all_sysadmin] did not match.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): hbac_evaluate() >]
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules

------------------------------------------


And here is the same log from user mcox3 - 'su - mcox' (which works but shouldn't?)


------------------------------------------

(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=mcox@cpgbpc.local]
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs.
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=d779890a-4870-11e8-a91e-5254008ff913,cn=ng,cn=alt,dc=cpgbpc,dc=local, returned 0 results. Skipping
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group cn=sysadmin,cn=roles,cn=accounts,dc=cpgbpc,dc=local, returned 0 results. Skipping
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=e6f310d8-4959-11e8-a91e-5254008ff913,cn=hbac,dc=cpgbpc,dc=local, returned 0 results. Skipping
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs.
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost:
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 1
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [be_resolve_server_process] (0x0200): Found address for server imd2.cpgbpc.local: [192.168.90.201] TTL 727
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler] (0x0100): child [2296] finished successfully.
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'imd2.cpgbpc.local' as 'working'
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [set_server_common_status] (0x0100): Marking server 'imd2.cpgbpc.local' as 'working'
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [cache, ts_cache] attrs.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost:
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [ipa_hostgroup_info_done] (0x0200): Dereferenced host group: ipa-test-clients
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [get_ipa_groupname] (0x0020): Expected cn in RDN, got uid
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_user_attrs_to_rule] (0x0020): [uid=mcox2,cn=users,cn=accounts,dc=cpgbpc,dc=local] does not map to either a user or group. Skipping
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): [< hbac_evaluate()
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): The rule [allow_ssh_access] did not match.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): ALLOWED by rule [allow_all_sysadmin].
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): hbac_evaluate() >]
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [allow_all_sysadmin]
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [cn=selinux,cn=cpgbpc.local,cn=sysdb] has set [cache] attrs.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler] (0x0100): child [2298] finished successfully.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_SETCRED
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost:
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_OPEN_SESSION
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost:
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [remove_tree_with_ctx] (0x0020): Cannot open /var/lib/sss/deskprofile/cpgbpc.local/mcox: [2]: No such file or directory
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [ipa_pam_session_handler_done] (0x0040): No Desktop Profile rules found

------------------------------------------



So it this not working correctly or is it my understanding of the rule ?


Also one other thing - I seem to not be able to sign up at https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/ - I can subscribe to the list but not sign up ...