Hi.
I have a test freeipa server setup.
It is generally working fine, however I have found one major issue.
Even though a user only has 1 service enabled 'sshd' that user can su / su-
to root.
I can confirm I have deleted the allow_all HBAC rule, and can confirm
generally rules are working.
i.e if I remove sshd from allowed services the user cannot login.
Using ipa hbactest - sshd is granted, su is not
Also I have tested the user cannot su / su - [non-root-user]
------------------
[mcox@ipaclient2 ~]$ su - mcox2
Password:
su: Permission denied
------------------
but they can su - (to root).
When I su I see in /var/log/secure
----------------
Apr 26 17:26:28 ipaclient2 su: pam_unix(su:session): session opened for
user root by mcox2(uid=1374400008)
----------------
Looking at the logs in /var/log/sssd when I su only the sssd_nss.log seems
to grow
debug_log = 9 is enabled
--------------------------
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [get_client_cred] (0x4000): Client
creds: euid[0] egid[1374400008] pid[1759].
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [setup_client_idle_timer] (0x4000):
Idle timer re-set for client [0x55937ee13a10][21]
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [accept_fd_handler] (0x0400): Client
connected!
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [sss_cmd_get_version] (0x0200):
Received client version [1].
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [sss_cmd_get_version] (0x0200):
Offered version [1].
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [nss_getby_name] (0x0400): Input
name: root
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_set_plugin] (0x2000): CR
#52: Setting "Initgroups by name" plugin
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_send] (0x0400): CR #52:
New request 'Initgroups by name'
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_process_input] (0x0400):
CR #52: Parsing input name [root]
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [sss_parse_name_for_domains]
(0x0200): name 'root' matched without domain, user is root
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_set_name] (0x0400): CR
#52: Setting name [root]
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_select_domains] (0x0400):
CR #52: Performing a multi-domain search
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_search_domains] (0x0400):
CR #52: Search will check the cache and check the data provider
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_validate_domain_type]
(0x2000): Request type POSIX-only for domain cpgbpc.local type POSIX is
valid
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_set_domain] (0x0400): CR
#52: Using domain [cpgbpc.local]
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_prepare_domain_data]
(0x0400): CR #52: Preparing input data for domain [cpgbpc.local] rules
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_search_send] (0x0400): CR
#52: Looking up root(a)cpgbpc.local
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400):
CR #52: Checking negative cache for [root(a)cpgbpc.local]
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [sss_ncache_check_str] (0x2000):
Checking negative cache for [NCE/USER/cpgbpc.local/root(a)cpgbpc.local]
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_search_ncache] (0x0400):
CR #52: [root(a)cpgbpc.local] does not exist (negative cache)
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [cache_req_process_result] (0x0400):
CR #52: Finished: Not found
(Thu Apr 26 17:27:52 2018) [sssd[nss]] [nss_protocol_done] (0x4000):
Sending reply: not found
(Thu Apr 26 17:27:54 2018) [sssd[nss]] [client_idle_handler] (0x2000):
Terminating idle client [0x55937ee0faf0][22]
(Thu Apr 26 17:27:54 2018) [sssd[nss]] [client_close_fn] (0x2000):
Terminated client [0x55937ee0faf0][22]
(Thu Apr 26 17:27:54 2018) [sssd[nss]] [client_idle_handler] (0x2000):
Terminating idle client [0x55937ee12d80][23]
(Thu Apr 26 17:27:54 2018) [sssd[nss]] [client_close_fn] (0x2000):
Terminated client [0x55937ee12d80][23]
--------------------------
Can anyone help me prevent a user being able to su / su - to root ?
If it helps my /etc/pam.d/system-auth config is here :
https://pastebin.com/J3THY44c
Regards