[PATCH] First Boot Seed Tool
by Nick Guay
This tool is used to seed the cache with user information and a
temporary password if the system does not have direct connectivity to a
IPA/AD/LDAP provider at first boot. It requires a username and domain to
be specified, and the corresponding domain must be configured in sssd.conf.
https://fedorahosted.org/sssd/ticket/904
11 years, 9 months
Re: [SSSD] [PATCH] Added unit test for sysdb_ssh.c
by Jan Zelený
Adding sssd-devel list back to CC
Dne čtvrtek 26 července 2012 18:14:40, Michal Zidek napsal(a):
> On 07/26/2012 02:25 PM, Jan Zelený wrote:
> > Dne středa 25 července 2012 13:21:01, Michal Zidek napsal(a):
> >> Unit test for src/db/sysdb_ssh.c
> >
> > Nack,
> > you are cleaning the directory TESTS_PATH but what if the directory
> > existed
> > (and maybe wasn't empty) before? The least you should do is to exclude the
> > return code from ret variable.
>
> The TESTS_PATH directory is created only for this unit test needs (it is
> actually tests_sysdb_ssh
> directory). If this directory existed before (unlikely, but possible)
> and contains files other than
> tests_conf.ldb and sssd.ldb, then those will remain untouched (rmdir
> syscall only removes empty
> directories). However, if the file existed before and contained files
> with the same names, then these
> will be overwritten, but I don't think this is a big problem because
> such files are probably only garbage
> from previous unfinished tests where the clean_up function was not
> called (because of segfault or
> something). And unlink and rmdir only returns 0 or -1, so I think it is
> OK to test them the way I did (it
> saves some lines of code).
Ok, I have no big problem with this.
> > Please use the SSSD_MAIN_OPTS macro in the variable long_options instead
> > defining the debug-level manually there?
> >
> > An important code-style comment: please declare all variables at the
> > beginning of functions. There are only a handful exceptions of this rule
> > in the code.
> >
> > Nitpick: you are missing space before SYSDB_OBJECTCLASS in
> > store_one_host_test()
> >
> > Consider checking results of all functions (for example function like
> > talloc_strdup(), talloc_zero(), sysdb_attrs_add_string(), ...) or at least
> > those on which something else is depending (like allocation of structures)
> > so we don't get segfaults. I'm not stating this as a hard requirement
> > sice we don't have it in most of places in sysdb test suite, but it would
> > be nice to make the coding style a little bit more defensive.
> >
> > In delete_nonexisting_host_test():
> > nonexisting -> nonexistent
> > Deleting -> Deletion
> >
> >
> > Other than that the patch is ok.
> >
> > Thanks
> > Jan
>
> Thanks. New patch attached.
Just two more minor things:
src/tests/sysdb_ssh-tests.c: In function ‘main’:
src/tests/sysdb_ssh-tests.c:409:9: warning: unused variable ‘debug’ [-Wunused-
variable]
Bad indentation level on line 285 of the patch.
Thanks
Jan
11 years, 9 months
[PRELIMINARY][PATCHES] Primary server support in SSSD
by Jan Zelený
Hi everybody,
I'm sending some patches which implement the primary server support as I see
it. It it based on comment #6 in the related ticket
https://fedorahosted.org/sssd/ticket/1128
Patch #0001 basically adds the necessary support in failover code
Patches #0002 - #0004 extend this support in each provider
Patch #0005 documents the new concept in failover section in man pages
Patches #0006 - #0008 add new options for each provider which utilize this
concept.
Just briefly about the approach. When adding a new server to the list of
servers related to a service, each server can be marked either as primary or
secondary.
When selecting new server from failover list, the algorithm iterates over the
list twice - first it tries to look for primary server and if none is found, it
tries also secondary server.
If a server is returned from failover, and it is not primary server, a timeout
is set (currently hard-coded for 30 seconds) for primary server lookup. This
timeout is rescheduled until a primary server is found. If a primary server
(either working or neutral) is found after this timeout, status of the backend
is reset, i.e. first all offline and then all online callbacks are called. This
is done to interrupt connection to the secondary server in favor of new
connection to a primary server.
I have just couple concerns about things which I have yet to inspect. First of
all when connection to the old server is interrupted, what if an operation is
currently in progress on this connection? I know ticket #1027 induces similar
scenario. Maybe to kill two birds with one stone I could design an extension
to immediately invoke callbacks of all operations running on existing
connection. What do you think about that?
My second concern is about port status timeout. After some time a port is
marked as neutral if originally marked as not-working. That effectively leads
to second attempt to primary server reconnection being successful even though
the server is still not running. As a result, an unnecessary reconnection to
secondary server is performed once some data are needed from the server.
Thank you very much for your opinions on this
Jan
11 years, 9 months
[PATCHES] If possible, use cache in SELinux rules processing
by Jan Zelený
These three patches provide changes that reduce the amount of data retrieved
from IPA server in case this data is previously retrieved by HBAC access
provider.
#168: modify hbac_get_cached_rules() so it can be used out of the HBAC code
#169: use cache for HBAC rules
#170: use cache for host record
Thanks
Jan
11 years, 9 months
[PATCH] Unbreak SASL
by Pavel Březina
Patch bc76428246c4ce532abd0eadcd539069fc1d94a8 changed the data
type of sasl_minssf from int to ber_len_t. Unfortunately, default
value of ldap_sasl_minssf is -1 but ber_len_t is defined as
unsigned long. This made SASL mechanism inoperative.
11 years, 9 months
Legacy Systems Gateway Scenario
by George McCollister
I'd appreciate any feedback/ideas anyone might have on a possible
solution for a scenario I'm finding quite frequently when FreeIPA is
proposed for centralized security.
In this scenario legacy systems which don't support centralized access
control (or are hopelessly incompatible) co-exist with modern Linux
systems. One possible solution is to place the legacy systems behind a
gateway server to meet increased security requirements until they can be
phased out. For each legacy system the gateway would have an Apache
vhost front-end which would be exposed on the enterprise network. The
intent is to control access to individual front-ends using FreeIPA HBAC
rules as if they were real hosts. When a user attempts to login to the
front end the front end would use a currently non-existent sss client
library to perform authentication and check if the user has access to
the service on the vhost. In order to do this, the sss client library
must be able to pass the hostname of the vhost to SSSD. SSSD must then
use the passed hostname instead of the machine's actual hostname when
performing access checks. Currently SSSD's struct pam_data doesn't
include a field for destination host so even if a custom client library
and responder where created that were capable of passing on the hostname
the responder would have no way of passing the hostname to the data
provider (ipa).
The front-end application running under the Apache vhost forwards client
requests to the legacy host over an isolated vlan or other link and then
forwards responses from the legacy host back to the client.
Does anyone oppose the idea of changing struct pam_data to include a
field for the destination host and modifying the ipa provider (and other
if appropriate) to fill such requests?
A similar approach could be used to provide remote terminal access to
legacy hosts.
Has anyone else seen a need to do something like this?
Alternative Solutions (may not be feasible in some or all situations):
Use a hypervisor to run separate OS instances for each legacy system
front-end.
A custom solution could be created to retrieve and cache the necessary
information from FreeIPA and perform the checks instead of using SSSD
but this is undesirable for many reasons.
Thanks,
George McCollister
11 years, 9 months
[PATCH] Write SELinux config files in responder instead of PAM module
by Jan Zelený
Without this change, a process linking our PAM module would do the writing.
That could be potentially problematic because everych such process will
probably have its own selinux context. That would need rule in the policy for
every process that is linked with PAM modules.
With this change, the context of process writing to the config file will be
sssd_t, which makes life easier for SELinux policy maintainers.
Thanks
Jan
11 years, 9 months
Announcing SSSD 1.9.0 beta 4
by Jakub Hrozek
The SSSD team is proud to announce the fourth of six preview releases of
version 1.9 of the System Security Services Daemon.
We added a new Beta release, called Beta 5, and renamed the previous Beta
5 to Beta 6. Beta 5 will be released next week, tentatively scheduled for
next Tuesday, July 17th. This release will include several fixes that
the FreeIPA project needs for their next release.
Beta 6 will be released on July 31st and will contain a new tool for
"seeding" accounts with a temporary password for sending machines to
remotees as well as introducing a concept of primary vs. secondary
servers.
After Beta 6, no new features will be added to SSSD 1.9.0 and we will
focus on stability and our backlog of bugfixes until the final release
around September 1st. We will most likely issue a series of release
candidate builds prior to that, but these have not yet been scheduled.
As always, you can download the latest sources at
https://fedorahosted.org/sssd/
== Highlights ==
* Add a new AD provider to improve integration with Active Directory
2008 R2 or later servers
* SUDO integration was completely rewritten. The new implementation
works with multiple domains and uses an improved refresh mechanism to
download only the necessary rules
* The IPA authentication provider now supports subdomains
* Fixed regression for setups that were setting default_tkt_enctypes
manually by reverting a previous workaround.
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/1239
[RFE] sudo: send username and uid while requesting default options
https://fedorahosted.org/sssd/ticket/1299
Per domain formats for qualified user names
https://fedorahosted.org/sssd/ticket/1352
[RFE] Add the subdomain functionality to IPA auth provider
https://fedorahosted.org/sssd/ticket/1377
[RFE] Add AD provider
https://fedorahosted.org/sssd/ticket/1382
pac responder interface needs checks
https://fedorahosted.org/sssd/ticket/1385
heimdal: compile time diference
https://fedorahosted.org/sssd/ticket/1398
Dependency issue while "yum update libsss_sudo"
https://fedorahosted.org/sssd/ticket/1403
Combine keytab options for AD provider
https://fedorahosted.org/sssd/ticket/1404
AD provider should default to case-insensitive operation
https://fedorahosted.org/sssd/ticket/1407
Revert sssd patch for limiting enctypes to keytab
== Detailed Changelog ==
George McCollister (1):
* libcrypto fully implemented
Jakub Hrozek (3):
* Print based on pointer contents not address
* Cast uid_t to unsigned long long in DEBUG messages
* Update translations for 1.9.0 beta 4 release
Pavel Březina (53):
* sudo api: remove EOK
* sudo responder: remove code duplication in commands
* sudo responder: get rid of dctx where possible
* sudo sysdb: make sysdb_get_sudo_user_info more configurable
* sudo api: send uid, username and domainname
* sudo responder: change protocol version to 1
* libsss_sudo: bump version to 2:0:1
* sudo responder: discard in-memory cache
* sudo ldap provider: move async routines to sdap_async_sudo.c
* sudo ldap provider: give sdap_sudo_refresh_send() search and purge filters
* confdb: add entry_cache_sudo_timeout option
* sudo ldap provider: add sysdb ctx in sdap_sudo_refresh_state
* sudo ldap provider: add domain info in sdap_sudo_refresh_state
* sudo ldap provider: add expiration time to each rule
* sysdb: add getter/setter for last sudo full refresh time
* sudo ldap provider: provide API for full refresh
* sudo ldap provider: add support for on demand full refresh
* sudo ldap provider: provide API for refresh of specific rules
* sudo ldap provider: add support for on demand refresh of specific rules
* sudo backend - support only on demand full refresh
* sudo backend - add support for on demand refresh of specific rules
* sudo provider: add ldap_sudo_full_refresh_interval
* sudo provider: remove old timer
* sudo ldap provider: add new timer API
* sysdb: remove sudo_set/get_refreshed
* sudo ldap provider: support periodical full refresh
* ldap provider: add sudo usn value
* sudo ldap provider: find highest USN
* sudo ldap provider: add sdap_sudo_set_usn()
* sudo ldap provider: remember highest usn after full refresh
* sudo ldap provider: add smart refresh API
* sudo ldap provider: when sysdb filter is NULL remove downloaded rules
* sudo provider: add ldap_sudo_smart_refresh_interval
* sudo ldap provider: add periodical smart refresh API
* sudo ldap provider: support periodical smart refresh
* sudo responder: new request enum type
* sudo sysdb: add expiration time to the filter
* sudo responder: allow fetching only expired rules in sudosrv_get_sudorules_query_cache()
* sudo responder: update dp interface
* sudo responder: refresh expired rules
* sudo ldap provider: return number of downloaded rules in sdap_sudo_refresh_recv()
* sudo ldap provider: notify responder when an expired rule has been deleted
* sudo responder: schedule OOB full refresh when expired rule is deleted
* sudo: clean up
* sudo ldap provider: modify highest USN in sdap_sudo_rules_refresh_done()
* sdap_sudo.c: move _recv after _done
* sudo ldap provider: pass sudo_ctx instead of id_ctx
* sudo: add host info options
* sudo ldap provider: load host filter configuration on init
* sudo ldap provider: mark sdap_sudo_setup_periodical_refresh() as static
* sudo ldap provider: do per-host updates
* sudo ldap provider: support autoconfiguration of IP addresses
* sudo: manpage updated
Rambaldi (2):
* heimdal: fix compile error in krb5-child-test
* heimdal: use sss_krb5_princ_realm to access realm
Simo Sorce (1):
* Fix segfault when sudo is not configured.
Stef Walter (2):
* Fix crash when interface doesn't have an address
* Revert commit 4c157ecedd52602f75574605ef48d0c48e9bfbe8
Stephen Gallagher (33):
* Bumping version to 1.9.0 beta 4
* TESTS: Print messages when LDAP options do not match
* DEBUG: Log to syslog if we are unable to open a debug fd
* KRB5: Initialize the credential cache type properly
* IPA: Don't hang onto memory longer than necessary
* LDAP: Print extended failure message for SASL bind
* MAN: Unify "SEE ALSO" sections
* KRB5: Some logging enhancements for krb5_child
* KRB5_LOCATOR: Print the filename that couldn't be opened
* KRB5: Drop memctx parameter of krb5_try_kdcip
* KRB5: Create a common init routine for krb5_child options
* LDAP: Rename user and group maps for AD
* AD: Add AD identity provider
* AD: Add AD auth and chpass providers
* AD: Add AD access-control provider
* AD: Add AD provider to the spec file
* AD: use krb5_keytab for validation and GSSAPI
* AD: Add manpages and SSSDConfig entries
* CONFDB: Add the ability to set a boolean value in the confdb
* AD: Force case-insensitive operation in AD provider
* Fix use-after-free
* Fix uninitialized variable
* Fix potential NULL-dereference
* Fix potential NULL-dereference
* Fix incorrect return value in tests
* Fix potential NULL-dereference
* Fix uninitialized value return
* Fix uninitialized memcpy error
* Avoid NULL-dereference in error-handling
* Add missing return value check
* Check for errors from krb5_unparse_name
* Fix incorrect error-check
* Fix segfault when using local provider
Sumit Bose (5):
* Fix SSSDConfigTest for separate build directories
* Set file descriptor limits in pac responder
* Remove resource leak in sssdpac_import_authdata
* Remove dead code in ipa_subdomains_handler_done()
* pac responder: limit access by checking UIDs
11 years, 9 months