On ma, 10 helmi 2020, Leon Castellano via FreeIPA-users wrote:
I have a CentOS8 FreeIPA 4.8.0 test environment with a CentOS8 client.
I'm enforcing smart card authentication on the client by setting the
"authentication indicator" to "pkinit" with the command "ipa
<client> --auth-ind=pkinit". This works fine to restrict SSH, GDM and
Console logins to smart card only, however, if I SSH into the client
and try to SUDO, it of course doesn't accept the password anymore, and
since the card is not connected locally to the client, it doesn't
prompt for the pin.
Is there a way to enforce smart card to login, but still allow sudo to
Not so far. This is not possible as it requires a special logic in SSSD
to obtain different service tickets when processing PAM stack requests
depending on a PAM service (and supposedly have different auth
indicators assigned to each Kerberos service). We currently have no such
support in SSSD.
Or to allow sudo to use the ssh-agent auth? (ssh-agent is working
forwarding auth for SSH connections)
You can try to use p11-kit remoting instead, to get PKCS#11 socket
forwardable over ssh.
yum install -y pam_ssh_agent_auth
Defaults env_keep += "SSH_AUTH_SOCK"
auth sufficient pam_ssh_agent_auth.so
But "sudo -i" still prompts for the password.
Any suggestions would be appreciated.
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland