Hi all,
I would like to use public key authentication in my FreeIPA setup for the users coming from the AD domain. I have everything set up correctly, public key authentication works great aside from one edge case that may render this setup unacceptable. When I lock an AD account (I test this by logging in with the wrong password more than allowed amount of times) user in question still can access FreeIPA managed hosts via public key authentication.
According to the information I found regarding this behaviour - https://bugzilla.redhat.com/show_bug.cgi?id=973451 - this is a desired behaviour (it's not a bug, it's a feature). Still, it's not the configuration I am happy about :).
Has anything changed since this bug was closed?
Is there a way FreeIPA supports preventing users who are for whatever reason locked in AD from accessing FreeIPA-managed hosts?
If this is not currently supported by default, maybe someone could point me to a way I could implement this myself? I am thinking of checking if the user is locked in AD, hopefully by looking at his/hers ldap attributes in the 389 ds server in FreeIPA if such attributes exist, then removing any public keys that are present in the Default Trust View for this user. At this point I do not know it is possible, it is just an idea.
I would really appreciate your help.
As far as implementing it yourself you could write your own ssh authorized keys script to lookup the status of the user in LDAP before retrieving their key. If they are locked just exit and don't return their key.
The script is defined in /etc/ssh/sshd_conf as AuthorizedKeysCommand and typically points to /usr/bin/sss_ssh_authorizedkeys. sshd calls this script on login and passes it the username at the first argument.
/usr/bin/sss_ssh_authorizedkeys <username>
So you could wrap this script inside your own with an added ldap search to first check if the user is locked.
freeipa-users@lists.fedorahosted.org