Hi.
I have created a HBAC rule for sysadmins.. One that has all services
enabled.
Logically I would expect only users with the service 'su-l' enabled to be
able to su - [user].
However in reality it is working the opposite way ...
i.e I have 2 users - both are allowed on the server I am testing on
user 1 : mcox - this has all services enabled
user 2: mcox3 - this only has sshd enabled
However - user mcox cannot 'su - mcox3', but user mcox3 can 'su - mcox' -
which seems the wrong way round - I would expect only users with 'su-l'
service to be able to su - ??
- mcox -> mcox3 gets 'su: Permission denied'
hbactest shows I should be granted on mcox and fail on mcox3
Is it my understanding of the rule at fault or someone else ?
Note : user mcox can 'su - mcox' also..
Below are the rules
for user : mcox
# ipa hbactest --user mcox --host ipaclient2.cpgbpc.local --service su-l
--------------------
Access granted: True
--------------------
Matched rules: allow_all_sysadmin
Not matched rules: allow_desktop
Not matched rules: allow_ssh_access
-----------
# ipa hbacrule-show allow_all_sysadmin
Rule name: allow_all_sysadmin
Host category: all
Service category: all
Enabled: TRUE
Users: mcox
User Groups: sysadmin
---------------
For user mcox3
# ipa hbactest --user mcox3 --host ipaclient2.cpgbpc.local --service su-l
---------------------
Access granted: False
---------------------
Not matched rules: allow_all_sysadmin
Not matched rules: allow_desktop
Not matched rules: allow_ssh_access
# ipa hbacrule-show allow_ssh_access
Rule name: allow_ssh_access
Enabled: TRUE
Users: mcox2, mcox3
Hosts: ipaclient2.cpgbpc.local
Services: sshd
And if it helps here is sssd_[domain].log
For when mcox tries to su - mcox3 (and fails)
------------------------------------------
Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[dp_get_account_info_handler] (0x0200): Got request for
[0x3][BE_REQ_INITGROUPS][name=mcox3(a)cpgbpc.local]
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox3(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [ts_cache] attrs.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[sdap_initgr_nested_search] (0x0040): Search for group
ipaUniqueID=2dabbee6-4872-11e8-b88d-5254008ff913,cn=ng,cn=alt,dc=cpgbpc,dc=local,
returned 0 results. Skipping
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[sdap_initgr_nested_search] (0x0040): Search for group
ipaUniqueID=44300e26-495b-11e8-8f22-5254008ff913,cn=hbac,dc=cpgbpc,dc=local,
returned 0 results. Skipping
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox3(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [ts_cache] attrs.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler]
(0x0100): Got request with the following data
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_AUTHENTICATE
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): domain: cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): user: mcox3(a)cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): service: su-l
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): tty: pts/1
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): ruser: mcox
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): rhost:
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): authtok type: 1
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): priv: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): cli_pid: 2269
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): logon name: not set
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [resolve_srv_send]
(0x0200): The status of SRV lookup is resolved
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[be_resolve_server_process] (0x0200): Found address for server
imd2.cpgbpc.local: [192.168.90.201] TTL 727
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler]
(0x0100): child [2271] finished successfully.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0080): Cannot set ts attrs for name=mcox3(a)cpgbpc.local
,cn=users,cn=cpgbpc.local,cn=sysdb
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox3(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [cache] attrs.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0080): Cannot set ts attrs for name=mcox3(a)cpgbpc.local
,cn=users,cn=cpgbpc.local,cn=sysdb
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler]
(0x0100): Got request with the following data
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_ACCT_MGMT
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): domain: cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): user: mcox3(a)cpgbpc.local
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): service: su-l
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): tty: pts/1
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): ruser: mcox
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): rhost:
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): authtok type: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): priv: 0
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): cli_pid: 2269
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): logon name: not set
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[ipa_hostgroup_info_done] (0x0200): Dereferenced host group:
ipa-test-clients
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [get_ipa_groupname]
(0x0020): Expected cn in RDN, got uid
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[hbac_user_attrs_to_rule] (0x0020):
[uid=mcox2,cn=users,cn=accounts,dc=cpgbpc,dc=local] does not map to either
a user or group. Skipping
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category]
(0x0200): Category is set to 'all'.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category]
(0x0200): Category is set to 'all'.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): [< hbac_evaluate()
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): The rule [allow_ssh_access] did not match.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): The rule [allow_all_sysadmin] did not match.
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): hbac_evaluate() >]
(Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]]
[ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules
------------------------------------------
And here is the same log from user mcox3 - 'su - mcox' (which works but
shouldn't?)
------------------------------------------
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[dp_get_account_info_handler] (0x0200): Got request for
[0x3][BE_REQ_INITGROUPS][name=mcox(a)cpgbpc.local]
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [ts_cache] attrs.
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[sdap_initgr_nested_search] (0x0040): Search for group
ipaUniqueID=d779890a-4870-11e8-a91e-5254008ff913,cn=ng,cn=alt,dc=cpgbpc,dc=local,
returned 0 results. Skipping
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[sdap_initgr_nested_search] (0x0040): Search for group
cn=sysadmin,cn=roles,cn=accounts,dc=cpgbpc,dc=local, returned 0 results.
Skipping
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[sdap_initgr_nested_search] (0x0040): Search for group
ipaUniqueID=e6f310d8-4959-11e8-a91e-5254008ff913,cn=hbac,dc=cpgbpc,dc=local,
returned 0 results. Skipping
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [ts_cache] attrs.
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler]
(0x0100): Got request with the following data
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_AUTHENTICATE
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): user: mcox(a)cpgbpc.local
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): service: su-l
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): tty: pts/1
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): ruser: mcox3
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): rhost:
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): authtok type: 1
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): priv: 0
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): cli_pid: 2294
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): logon name: not set
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA'
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [resolve_srv_send]
(0x0200): The status of SRV lookup is resolved
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[be_resolve_server_process] (0x0200): Found address for server
imd2.cpgbpc.local: [192.168.90.201] TTL 727
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler]
(0x0100): child [2296] finished successfully.
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [fo_set_port_status]
(0x0100): Marking port 389 of server 'imd2.cpgbpc.local' as 'working'
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]]
[set_server_common_status] (0x0100): Marking server 'imd2.cpgbpc.local' as
'working'
(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [ts_cache] attrs.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [name=mcox(a)cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb]
has set [cache, ts_cache] attrs.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler]
(0x0100): Got request with the following data
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_ACCT_MGMT
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): user: mcox(a)cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): service: su-l
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): tty: pts/1
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): ruser: mcox3
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): rhost:
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): authtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): priv: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): cli_pid: 2294
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): logon name: not set
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]]
[ipa_hostgroup_info_done] (0x0200): Dereferenced host group:
ipa-test-clients
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [get_ipa_groupname]
(0x0020): Expected cn in RDN, got uid
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]]
[hbac_user_attrs_to_rule] (0x0020):
[uid=mcox2,cn=users,cn=accounts,dc=cpgbpc,dc=local] does not map to either
a user or group. Skipping
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category]
(0x0200): Category is set to 'all'.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category]
(0x0200): Category is set to 'all'.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): [< hbac_evaluate()
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): The rule [allow_ssh_access] did not match.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): ALLOWED by rule [allow_all_sysadmin].
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate]
(0x0100): hbac_evaluate() >]
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]]
[ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule
[allow_all_sysadmin]
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr]
(0x0200): Entry [cn=selinux,cn=cpgbpc.local,cn=sysdb] has set [cache] attrs.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler]
(0x0100): child [2298] finished successfully.
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler]
(0x0100): Got request with the following data
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_SETCRED
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): user: mcox(a)cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): service: su-l
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): tty: pts/1
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): ruser: mcox3
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): rhost:
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): authtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): priv: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): cli_pid: 2294
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): logon name: not set
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler]
(0x0100): Got request with the following data
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): command: SSS_PAM_OPEN_SESSION
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): domain: cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): user: mcox(a)cpgbpc.local
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): service: su-l
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): tty: pts/1
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): ruser: mcox3
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): rhost:
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): authtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): newauthtok type: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): priv: 0
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): cli_pid: 2294
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data]
(0x0100): logon name: not set
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [remove_tree_with_ctx]
(0x0020): Cannot open /var/lib/sss/deskprofile/cpgbpc.local/mcox: [2]: No
such file or directory
(Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]]
[ipa_pam_session_handler_done] (0x0040): No Desktop Profile rules found
------------------------------------------
So it this not working correctly or is it my understanding of the rule ?
Also one other thing - I seem to not be able to sign up at
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
- I can subscribe to the list but not sign up ...