sssd-devel April 2011

sssd-devel@lists.fedorahosted.org

11 participants
47 discussions

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCH] Add support for ADS pwdLastSet
by Pierre Carrier 06 Sep '11

06 Sep '11

Documented on http://msdn.microsoft.com/en-us/library/cc220785(v=prot.10).aspx Introduced in nss_ldap 208: * add support for native Active Directory password policy attributes (enabled if shadowLastChange is mapped to pwdLastSet) --- src/config/SSSDConfig.py | 1 + src/config/etc/sssd.api.d/sssd-ldap.conf | 1 + src/man/sssd-ldap.5.xml | 15 ++++++++++ src/providers/ldap/ldap_auth.c | 9 +++++- src/providers/ldap/ldap_common.c | 43 ++++++++++++++++++++++++++++++ src/providers/ldap/ldap_common.h | 1 + src/providers/ldap/sdap.h | 1 + 7 files changed, 70 insertions(+), 1 deletions(-) diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py index 5135174..992e1f4 100644 --- a/src/config/SSSDConfig.py +++ b/src/config/SSSDConfig.py @@ -167,6 +167,7 @@ option_strings = { 'ldap_user_modify_timestamp' : _('Modification time attribute'), #replaced by ldap_entry_usn# 'ldap_user_entry_usn' : _('entryUSN attribute'), 'ldap_user_shadow_last_change' : _('shadowLastChange attribute'), + 'ldap_user_ads_last_change' : _('pwdLastSet attribute'), 'ldap_user_shadow_min' : _('shadowMin attribute'), 'ldap_user_shadow_max' : _('shadowMax attribute'), 'ldap_user_shadow_warning' : _('shadowWarning attribute'), diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 5fd0cfb..6700df9 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -51,6 +51,7 @@ ldap_user_member_of = str, None, false ldap_user_modify_timestamp = str, None, false ldap_user_entry_usn = str, None, false ldap_user_shadow_last_change = str, None, false +ldap_user_ads_last_change = str, None, false ldap_user_shadow_min = str, None, false ldap_user_shadow_max = str, None, false ldap_user_shadow_warning = str, None, false diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 2a39732..0db3ce7 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -313,6 +313,21 @@ </varlistentry> <varlistentry> + <term>ldap_user_ads_last_change (string)</term> + <listitem> + <para> + When using ldap_pwd_policy=shadow, this parameter + contains the name of an LDAP attribute corresponding + to pwdLastSet in Active Directory server, fell back to + when ldap_user_shadow_last_change was not available. + </para> + <para> + Default: pwdLastSet + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>ldap_user_shadow_min (string)</term> <listitem> <para> diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c index e45d5b3..5ebd72c 100644 --- a/src/providers/ldap/ldap_auth.c +++ b/src/providers/ldap/ldap_auth.c @@ -286,7 +286,8 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx, return EINVAL; } } else if (strcasecmp(pwd_policy, PWD_POL_OPT_SHADOW) == 0) { - mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL); + mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL) | + ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL); if (mark != NULL) { DEBUG(9, ("Found shadow password expiration attributes.\n")) spwd = talloc_zero(mem_ctx, struct spwd); @@ -297,6 +298,12 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx, val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL); ret = string_to_shadowpw_days(val, &spwd->sp_lstchg); + + /* Fallback to pwdLastSet for ADS */ + if (ret != EOK) { + val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL); + ret = ads_pwdlastset_to_shadowpw_days(val, &spwd->sp_lstchg); + } if (ret != EOK) goto shadow_fail; val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_MIN, NULL); diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 9eb9cc3..22c9bb7 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -163,6 +163,7 @@ struct sdap_attr_map rfc2307bis_user_map[] = { { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL }, { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL }, { "ldap_user_shadow_last_change", "shadowLastChange", SYSDB_SHADOWPW_LASTCHANGE, NULL }, + { "ldap_user_ads_last_change", "pwdLastSet", SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL }, { "ldap_user_shadow_min", "shadowMin", SYSDB_SHADOWPW_MIN, NULL }, { "ldap_user_shadow_max", "shadowMax", SYSDB_SHADOWPW_MAX, NULL }, { "ldap_user_shadow_warning", "shadowWarning", SYSDB_SHADOWPW_WARNING, NULL }, @@ -878,6 +879,48 @@ errno_t string_to_shadowpw_days(const char *s, long *d) return EOK; } +errno_t ads_pwdlastset_to_shadowpw_days(const char *s, long *d) +{ + long long ll; + long days; + char *endptr; + + if (s == NULL || *s == '\0') { + *d = -1; + return EOK; + } + + errno = 0; + ll = strtoll(s, &endptr, 10); + if (errno != 0) { + DEBUG(1, ("strtoll failed [%d][%s].\n", errno, strerror(errno))); + return errno; + } + + if (*endptr != '\0') { + DEBUG(1, ("Input string [%s] is invalid.\n", s)); + return EINVAL; + } + + /* Magic value for password reset */ + if (ll = 0LL) { + DEBUG(9, ("Magic pwdLastSet date 0, password change forced.\n")); + *d = 0L; + return EOK; + } + + days = ll / 864000000000LL - 134774LL; + + if (days < 0L) { + DEBUG(1, ("Date is before Jan 1, 1970 [%d].\n", ll)); + return EINVAL; + } + + *d = days; + + return EOK; +} + errno_t get_sysdb_attr_name(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, size_t map_size, diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index 9146da5..cf301de 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -146,6 +146,7 @@ int setup_child(struct sdap_id_ctx *ctx); errno_t string_to_shadowpw_days(const char *s, long *d); +errno_t ads_pwdlastset_to_shadowpw_days(const char *s, long *d); errno_t get_sysdb_attr_name(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 32dc344..fdd5b7a 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -115,6 +115,7 @@ struct sdap_ppolicy_data { }; #define SYSDB_SHADOWPW_LASTCHANGE "shadowLastChange" +#define SYSDB_SHADOWPW_ADS_LASTCHANGE "pwdLastSet" #define SYSDB_SHADOWPW_MIN "shadowMin" #define SYSDB_SHADOWPW_MAX "shadowMax" #define SYSDB_SHADOWPW_WARNING "shadowWarning" -- 1.7.4.4

4 11

[PATCH] Cache cleaning utility
by Jan Zelený 04 May '11

04 May '11

I'm sending three patches with the cache-cleaning utility and some updates in sysdb which this utility depends on. Thanks Jan

4 15

[PATCH] Last USN patches
by Jan Zelený 04 May '11

04 May '11

I'm sending two patches related to the last USN detection (ticket #734). I did some testing and they seem to work just fine. The only thing I'm not sure about is if I got right what Simo exactly meant by the ticket, but I hope I got it right. Thanks Jan

4 16

[PATCH] Override config file debug_level with command-line
by Stephen Gallagher 04 May '11

04 May '11

Running the SSSD from the command-line with -d N would not override a value set in the sssd.conf. This was due to a few bad architecture decisions around how to handle the debug_level. This patch also makes the following changes: 1) The [sssd] debug_level setting no longer acts as a default for all other sections. This was always accidental, and was never documented to behave this way, so I think it's an acceptable change, even if it is a backwards-compatibility break. 2) We will now skip passing the debug argument to the child processes from the master unless the SSSD was run with a command-line argument for the debug level. https://fedorahosted.org/sssd/ticket/764

2 2

SSSD Security Release 1.5.7
by Stephen Gallagher 29 Apr '11

29 Apr '11

====== SSSD Security Release 1.5.7 ========================== = = Subject: User impersonation attack = = CVE ID#: CVE-2011-1758 = = Summary: The current stable and development version = of SSSD are vulnerable to a user = impersonation attack. = = Impact: moderate = = Affects default = configuration: Negative = = Introduced with: 1.5.0 = =============================================================== ============ DESCRIPTION The current stable and development version of SSSD are vulnerable to a user impersonation attack. A malicious user can log in as a legitimate user by using a well-known plain text under specific circumstances. The user's legitimate credentials are *not* disclosed. The vulnerability is present if the automatic ticket renewal option is enabled, and only if a ticket renewal operation for the user has been recently performed without any further authentication from the legitimate user taking place since. The vulnerability is exploitable only if the SSSD daemon is authenticating in offline mode (servers not reachable), and offline authentication is enabled. The vulnerability is rated moderate due to the fact the vulnerability is present only in non default configurations and the vulnerability is available only after a very specific set of circumstances materializes. ================== PATCH AVAILABILITY A patch addressing this issue is available at: http://git.fedorahosted.org/git/?p=sssd.git;a=commitdiff_plain;h=fffdae8165… =========== WORKAROUND Disable automatic ticket renewal and flush sssd caches to remove bad cached credentials. ======================= ADDITIONAL INFORMATION The automatic ticket renewal service in SSSD operates by providing the active credential cache to the kerberos libraries in order to renew the user's TGT on their behalf by using their existing credentials. Internally, SSSD treats this as a standard authentication, which upon success will update the cached credentials of the user. The side-effect here is that the user's credentials in the context of this renewal are actually the path to the credential cache file, instead of their real password. So as a result, the user's cached credentials have now become a different string. The security issue is that this new cached-credential string is now predictable. Another user on the local system would now be capable of logging in as the first user by performing an 'ls /tmp' and seeing what the first user's cache file is called. The problem gets further complicated if the administrators has modified the SSSD config option 'krb5_ccache_template' to remove the mkstemp() suffix. This would then make the credential cache's name predictable to a network attacker as well. With this release, we no longer erroneously set the credential cache path as the user's cached credentials, removing this vulnerability and restoring the user's ability to log in properly in offline mode. ======== CREDITS Thanks to Marko Myllynen (Red Hat) for reporting and to Stephen Gallagher for identifying the actual problem. The SSSD team. ====================================

1 0

[PATCH] Fix order of arguments in select_principal_from_keytab() call
by Jakub Hrozek 29 Apr '11

29 Apr '11

The incorrect order caused that SSSD tried to load a nonexistent keytab and failed.

2 1

[PATCH] Fix bad password caching when using automatic TGT renewal
by Stephen Gallagher 29 Apr '11

29 Apr '11

When the internal ticket renewal process runs, it has the Kerberos credential cache saved into the 'authtok' member attribute of the PAM data. So after it successfully renews the ticket, we're saving this value to the cache. We need to skip updating the cached password if it's happening during automatic ticket renewal. Fixes https://fedorahosted.org/sssd/ticket/856

2 2

[PATCH] Fix segfault in IPA provider
by Stephen Gallagher 29 Apr '11

29 Apr '11

We were trying to request the krb5 keytab from the auth provider configuration, but it hasn't yet been set up. Much better to use the value in the ID provider.

1 1

SSSD & sudo
by Andy Kannberg 29 Apr '11

29 Apr '11

Hi all, Currently, we run SSSD on a RHEL5 update 4 box. SSSD version is 1.2.1. For the main purpose we need it, caching credentials, it works like a charm. Now, we have a custom compiled sudo version (sudo 1.6) which does query LDAP for the sudo rules. I was testing if sudo still worked while using cached credentials. (Which is one of the requirements of the project, as users are not allowed root access) and it did work. I simply pulled the network cable out of the network interface, rebooted the machine, logged in with cached credentials and tried a sudo su - (Which I am allowed to do). And it worked. Is this intended behaviour, am I looking at the wrong things or did I discover a 'hidden feature/anomaly'due to the custom sudo version ? I tried searching on sudo and sssd with google, I only read articles that sudo and sssd are not integrated yet(but in the works), so I am wondering how this works. cheers, Andy

4 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2011