Hi, I managed to have a freeipa client version 4.9.8 working on Ubuntu 22.04 with the following features: - ssh authentication with ldap. - OTP for ssh authentication with password
For the record, I'm using this docker image docker.io/freeipa/freeipa-server:rocky-9-4.11.0 to run freeipa-server.
I'm struggling to enable sudo authorization using freeipa server policies. The main blocker is that the instructions I found(https://freeipa.readthedocs.io/en/latest/workshop/8-sudorule.html) points to use authselect:
[client]$ sudo authselect enable-feature with-sudo
to reconfigure sssd, but seems that this tool is only available on fedora/redhat flavours, and not for ubuntu. Is there any way to use authselect in ubuntu. Or anybody knows which changes would do authselect in the ubuntu client? Any help would be greatly appreciated.
Hi,
On Fri, Oct 25, 2024 at 1:35 PM Carlos Lopez Molina via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi, I managed to have a freeipa client version 4.9.8 working on Ubuntu 22.04 with the following features:
- ssh authentication with ldap.
- OTP for ssh authentication with password
For the record, I'm using this docker image docker.io/freeipa/freeipa-server:rocky-9-4.11.0 to run freeipa-server.
I'm struggling to enable sudo authorization using freeipa server policies. The main blocker is that the instructions I found( https://freeipa.readthedocs.io/en/latest/workshop/8-sudorule.html) points to use authselect:
[client]$ sudo authselect enable-feature with-sudo
to reconfigure sssd, but seems that this tool is only available on fedora/redhat flavours, and not for ubuntu. Is there any way to use authselect in ubuntu. Or anybody knows which changes would do authselect in the ubuntu client?
Before authselect was available in Fedora, IPA was relying on authconfig. IIRC sudo didn't require any specific setting (the client install would configure /etc/nsswitch.conf with sudoers: sss files unless it was called with --no-sudo).
flo
Any help would be greatly appreciated.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Thank you Florence. In ubuntu systems there is neither authselect nor authconfig. In my current client IPA configuration, there is: /etc/nsswitch.conf sudoers: files sss
Nevertheless, I'm getting this error when I do sudo in the client IPA: $ sudo <whatever> sudo: PAM account management error: Permission denied sudo: a password is required
I'm not even asked for a password, it just fails.
On Пан, 28 кас 2024, Carlos Lopez Molina via FreeIPA-users wrote:
Thank you Florence. In ubuntu systems there is neither authselect nor authconfig. In my current client IPA configuration, there is: /etc/nsswitch.conf sudoers: files sss
Nevertheless, I'm getting this error when I do sudo in the client IPA: $ sudo <whatever> sudo: PAM account management error: Permission denied sudo: a password is required
I'm not even asked for a password, it just fails.
SUDO as an application first uses PAM stack to authenticate the user to access SUDO itself. If this authentication step succeeds, then it looks up rules associated with this user account and then evaluates them.
The error you see means your PAM stack configuration for sudo is reporting that issue.
On Debian-like systems ipa-client-install uses
pam-auth-update --package --enable mkhomedir
if 'ipa-client-install --with-mkhomedir' was used. Otherwise, it does not do anything.
When libsss-pam package is installed, it should pre-configure pam-auth-update to use pam_sss.so. See, for example: https://git.launchpad.net/ubuntu/+source/sssd/tree/debian/libpam-sss.pam-aut...
Account-Type: Additional Account: sufficient pam_localuser.so [default=bad success=ok user_unknown=ignore] pam_sss.so
It basically says that when pam_sss.so is available, it will be tried in account state of PAM stack in case the pam_localuser.so failed.
So you need to look at your PAM stack configuration and understand whether it is properly configured to consult pam_sss.so at all.
Hi Alexander, thank you for your response. After reviewing it, I found that everything was configured properly. I also had sudoers rules and hbac rules put in place. I realized that I didn't add a rule for sudo, there were only rules for sshd. For this reason the sudo authentication was failing. Then, in this case the problema was that there was no hbac rule allowing the use of sudo.
Thank you and best regards.
On Пан, 04 ліс 2024, Carlos Lopez Molina via FreeIPA-users wrote:
Hi Alexander, thank you for your response. After reviewing it, I found that everything was configured properly. I also had sudoers rules and hbac rules put in place. I realized that I didn't add a rule for sudo, there were only rules for sshd. For this reason the sudo authentication was failing. Then, in this case the problema was that there was no hbac rule allowing the use of sudo.
Thanks for the update. I created a ticket for freeipa-healthcheck to find out cases when people have sudo rules but no corresponding HBAC rule to permit access to sudo. This could help preventing situations like this one.
https://github.com/freeipa/freeipa-healthcheck/issues/344
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Carlos Lopez Molina -
Florence Blanc-Renaud