Am Fri, Jul 08, 2022 at 09:28:34PM +0200 schrieb Sigbjorn Lie-Soland:
> On 8 Jul 2022, at 12:18, Sumit Bose <sbose(a)redhat.com> wrote:
>
> Am Fri, Jul 08, 2022 at 11:47:13AM +0200 schrieb Sigbjorn Lie-Soland:
>>
>>
>>> On 8 Jul 2022, at 08:38, Sumit Bose <sbose(a)redhat.com> wrote:
>>>
>>> Am Fri, Jun 03, 2022 at 09:19:51AM +0200 schrieb Sigbjorn Lie via
FreeIPA-users:
>>>> Hi list,
>>>>
>>>> When I have a 2FA enabled user account, I receive the two password
prompt
>>>> for sudo at a host, even on hosts where 2FA is not required. This
breaks
>>>> Ansible for me, when using "become" with Ansible.
>>>>
>>>> I am testing the [prompting/2fa] options in sssd to remediate this. I
have
>>>> the following configuration:
>>>>
>>>> ---
>>>> [prompting/2fa/sudo]
>>>> first_prompt = 'Please enter your password and optional OTP token
value: '
>>>> single_prompt = True
>>>> ---
>>>>
>>>> This provides me with a single prompt, with the configured text when I
run
>>>> sudo on this host.
>>>>
>>>> However the 2FA OTP code is no longer optional. If I do not enter both
my
>>>> password and an OTP code, the authentication fails. So still this does
not
>>>> fix Ansible for me.
>>>>
>>>> From var/log/secure:
>>>> ---
>>>> Jun 3 09:15:16 myhost.mydomain.tld sudo[2289804]: pam_sss(sudo:auth):
>>>> authentication failure; logname=myusername uid=12345678 euid=0
>>>> tty=/dev/pts/1 ruser= myusername rhost= user= myusername
>>>> Jun 3 09:15:16 myhost.mydomain.tld sudo[2289804]: pam_sss(sudo:auth):
>>>> received for user myusername: 7 (Authentication failure)
>>>> Jun 3 09:15:18 myhost.mydomain.tld sudo[2289804]: myusername : 1
incorrect
>>>> password attempt ; TTY=pts/1 ; PWD=/home/myusername ; USER=root ;
>>>> COMMAND=list
>>>> ---
>>>>
>>>>
>>>> The only change performed is to add the above prompting configuration
to
>>>> sssd.conf. If I remove the prompting configuration from sssd.conf, I can
now
>>>> authentiate using only my password, even though with two prompts.
>>>>
>>>> In either way, I am unable to run Ansible anymore.
>>>>
>>>> Any suggestions on how to fix this?
>>>
>>> Hi,
>>>
>>> I think this can be only "fixed" by an additional option for the
>>> prompting configuration. The reason is that on the Kerberos level
>>> 1fa password authentication and 2fa with the same password and a second
>>> factor are handled differently. So we must know in advance if we have a
>>> string with only the password or with the password and a second factor
>>> to use the right scheme. Try and error are imo not a good idea because
>>> there would be a fair chance to increase error counters which might lock
>>> the password.
>>>
>>> Currently there is no option to determine the order if the different
>>> prompts and a heuristic is used. If Smartcard authentication is
>>> possible, it is preferred. Otherwise 2fa if available is tried before
>>> password authentication. A configuration to tell SSSD to ask only for
>>> the password first (and only do 2fa if the password is empty) for sudo
>>> might help in your use case. An alternative would be to add an option
>>> for the 2fa part like e.g. 'single_prompt_only_has_password' but
imo
>>> this looks odd in a 2fa part. So I think a new option for the order
>>> would be better and might offer other use-cases as well.
>>>
>>
>>
>> This is happening on machines where 2FA requirement is not configured.
>> (OTP indicator *not* set on the host in IPA). Is it possible to have
>> just the 1FA prompt when the host object in IPA is not configured to
>> require OTP?
>
> Hi,
>
> this would required code changes as well and I'm not even sure if SSSD
> currently has the permissions to read the authentication requirements of
> the host objects.. Additionally, even if the host does not require 2FA
> itself, the user might want to do 2FA e.g. because the next service he
> wants to access from this host requires 2FA.
>
> bye,
> Sumit
>
Hi,
Having a 2FA prompt on all servers regardless of the server being configured to require
OTP is not very practical. Novice users do not understand if they need to enter the OTP
code for every server or not.
I do understand the option of having the 2FA prompt if they need to use 2FA for their
next service, however I do see this being relevant for sudo. At least having a sssd.conf
option to exclude the OTP prompt and keep only the password prompt for a certain PAM
services, such as sudo, would be very beneficial.
What do you think?
Hi,
please open a ticket at
https://github.com/SSSD/sssd/issues/new to add
an option to allow ordering the different prompts so that 1FA password
authentcation can be preferred against 2FA.
bye,
Sumit
Regards,
Siggi