Hi.

I have created a HBAC rule for sysadmins.. One that has all services enabled.

Logically I would expect only users with the service 'su-l' enabled to be able to su - [user].

However in reality it is working the opposite way ...

i.e I have 2 users - both are allowed on the server I am testing on

user 1 : mcox - this has all services enabled user 2: mcox3 - this only has sshd enabled

However - user mcox cannot 'su - mcox3', but user mcox3 can 'su - mcox' - which seems the wrong way round - I would expect only users with 'su-l' service to be able to su - ??

- mcox -> mcox3 gets 'su: Permission denied'

hbactest shows I should be granted on mcox and fail on mcox3

Is it my understanding of the rule at fault or someone else ?

Note : user mcox can 'su - mcox' also..

Below are the rules

for user : mcox

# ipa hbactest --user mcox --host ipaclient2.cpgbpc.local --service su-l -------------------- Access granted: True -------------------- Matched rules: allow_all_sysadmin Not matched rules: allow_desktop Not matched rules: allow_ssh_access -----------

# ipa hbacrule-show allow_all_sysadmin Rule name: allow_all_sysadmin Host category: all Service category: all Enabled: TRUE Users: mcox User Groups: sysadmin ---------------

For user mcox3

# ipa hbactest --user mcox3 --host ipaclient2.cpgbpc.local --service su-l --------------------- Access granted: False --------------------- Not matched rules: allow_all_sysadmin Not matched rules: allow_desktop Not matched rules: allow_ssh_access

# ipa hbacrule-show allow_ssh_access Rule name: allow_ssh_access Enabled: TRUE Users: mcox2, mcox3 Hosts: ipaclient2.cpgbpc.local Services: sshd

And if it helps here is sssd_[domain].log

For when mcox tries to su - mcox3 (and fails)

------------------------------------------ Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=mcox3@cpgbpc.local] (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=2dabbee6-4872-11e8-b88d-5254008ff913,cn=ng,cn=alt,dc=cpgbpc,dc=local, returned 0 results. Skipping (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=44300e26-495b-11e8-8f22-5254008ff913,cn=hbac,dc=cpgbpc,dc=local, returned 0 results. Skipping (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox3@cpgbpc.local (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost: (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 1 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2269 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [be_resolve_server_process] (0x0200): Found address for server imd2.cpgbpc.local: [192.168.90.201] TTL 727 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler] (0x0100): child [2271] finished successfully. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=mcox3@cpgbpc.local ,cn=users,cn=cpgbpc.local,cn=sysdb (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox3@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [cache] attrs. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0080): Cannot set ts attrs for name=mcox3@cpgbpc.local ,cn=users,cn=cpgbpc.local,cn=sysdb (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox3@cpgbpc.local (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost: (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2269 (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [ipa_hostgroup_info_done] (0x0200): Dereferenced host group: ipa-test-clients (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [get_ipa_groupname] (0x0020): Expected cn in RDN, got uid (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_user_attrs_to_rule] (0x0020): [uid=mcox2,cn=users,cn=accounts,dc=cpgbpc,dc=local] does not map to either a user or group. Skipping (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): [< hbac_evaluate() (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): The rule [allow_ssh_access] did not match. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): The rule [allow_all_sysadmin] did not match. (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): hbac_evaluate() >] (Mon Oct 22 17:32:04 2018) [sssd[be[cpgbpc.local]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules

------------------------------------------

And here is the same log from user mcox3 - 'su - mcox' (which works but shouldn't?)

------------------------------------------

(Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [dp_get_account_info_handler] (0x0200): Got request for [0x3][BE_REQ_INITGROUPS][name=mcox@cpgbpc.local] (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs. (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=d779890a-4870-11e8-a91e-5254008ff913,cn=ng,cn=alt,dc=cpgbpc,dc=local, returned 0 results. Skipping (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group cn=sysadmin,cn=roles,cn=accounts,dc=cpgbpc,dc=local, returned 0 results. Skipping (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sdap_initgr_nested_search] (0x0040): Search for group ipaUniqueID=e6f310d8-4959-11e8-a91e-5254008ff913,cn=hbac,dc=cpgbpc,dc=local, returned 0 results. Skipping (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs. (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_AUTHENTICATE (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost: (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 1 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [be_resolve_server_process] (0x0200): Found address for server imd2.cpgbpc.local: [192.168.90.201] TTL 727 (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler] (0x0100): child [2296] finished successfully. (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'imd2.cpgbpc.local' as 'working' (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [set_server_common_status] (0x0100): Marking server 'imd2.cpgbpc.local' as 'working' (Mon Oct 22 17:33:37 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [ts_cache] attrs. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [name=mcox@cpgbpc.local,cn=users,cn=cpgbpc.local,cn=sysdb] has set [cache, ts_cache] attrs. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_ACCT_MGMT (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost: (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [ipa_hostgroup_info_done] (0x0200): Dereferenced host group: ipa-test-clients (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [get_ipa_groupname] (0x0020): Expected cn in RDN, got uid (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_user_attrs_to_rule] (0x0020): [uid=mcox2,cn=users,cn=accounts,dc=cpgbpc,dc=local] does not map to either a user or group. Skipping (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_get_category] (0x0200): Category is set to 'all'. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): [< hbac_evaluate() (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): The rule [allow_ssh_access] did not match. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): ALLOWED by rule [allow_all_sysadmin]. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [hbac_evaluate] (0x0100): hbac_evaluate() >] (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [allow_all_sysadmin] (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [sysdb_set_entry_attr] (0x0200): Entry [cn=selinux,cn=cpgbpc.local,cn=sysdb] has set [cache] attrs. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [child_sig_handler] (0x0100): child [2298] finished successfully. (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_SETCRED (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost: (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [dp_pam_handler] (0x0100): Got request with the following data (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): command: SSS_PAM_OPEN_SESSION (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): domain: cpgbpc.local (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): user: mcox@cpgbpc.local (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): service: su-l (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): tty: pts/1 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): ruser: mcox3 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): rhost: (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): authtok type: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): newauthtok type: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): priv: 0 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): cli_pid: 2294 (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [pam_print_data] (0x0100): logon name: not set (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [remove_tree_with_ctx] (0x0020): Cannot open /var/lib/sss/deskprofile/cpgbpc.local/mcox: [2]: No such file or directory (Mon Oct 22 17:33:38 2018) [sssd[be[cpgbpc.local]]] [ipa_pam_session_handler_done] (0x0040): No Desktop Profile rules found

------------------------------------------

So it this not working correctly or is it my understanding of the rule ?

Also one other thing - I seem to not be able to sign up at https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... - I can subscribe to the list but not sign up ...