[PATCH] pyhbac: Do not convert int to bool
by Jakub Hrozek
The conversion blew up on Big Endian machines. The setter (which is the
correct way to go) was added as a review suggestion and I didn't realize
it wasn't used in __init__.
12 years, 8 months
[PATCH] Memberof plugin rewritten
by Jan Zelený
Hi,
after several weeks of work and couple failed concepts, I'm sending rewritten
memberof plugin with reference counter support. For now I'm just interested in
concept ack, since the plugin has still some heisenbugs and isn't stable at
all.
The recompute task also isn't ready, I don't want to do it before I have the
concept acked and the rest of plugin stable.
Many thanks in advance for any kind of review
Jan
12 years, 8 months
Announcing SSSD 1.6.0
by Stephen Gallagher
The SSSD team is proud to announce the version 1.6.0 release of the
System Security Services Daemon.
As always, it can be downloaded from https://fedorahosted.org/sssd/
== Highlights ==
* Add host access control support for LDAP (similar to pam_host_attr)
* Finer-grained control on principals used with Kerberos (such as for
FAST or validation)
* Added a new tool {{{sss_cache}}} to allow selective expiring of
cached entries
* Added support for LDAP DEREF and ASQ controls
* This will result in a marked speedup when dealing with initgroups
requests of users in many groups
* Added access control features for Novell Directory Server
* FreeIPA dynamic DNS update now checks first to see if an update is
needed
* Previously we would always issue an update upon any 'going online'
event
* Complete rewrite of the HBAC library
* New libraries: libipa_hbac and libipa_hbac-python
== Detailed Changelog ==
Gowrishankar Rajaiyan (2):
* removing password option functionality
* updating sss_obfuscate man page accordingly
Jakub Hrozek (92):
* Use realm for basedn instead of IPA domain
* Reset server status after timeout
* Prevent segfault in failover code
* Always expire host name resolution
* Run callbacks if server IP changes
* Mention Samba libraries URLs in BUILD.txt
* Fix LDAP search filter for nested initgroups
* Add originalDN to fake groups
* Use fake groups during IPA schema initgroups
* Return from functions in LDAP provider after marking request as
failed
* Fix typo in sdap_nested_group_process_step
* Mark transaction as done when cancelled
* Only save members for successfully saved groups
* Do not attempt to resolve nameless servers
* Don't pass NULL to printf for TLS errors
* Fix unchecked return values of pam_add_response
* Remove detection of duplicates from SRV result processing
* Use safe alignment macros for in-tree SRV record parsing
* The systemd unit file should not require DBus
* Provide a configuration option to use systemd unit file
* Only check systemd unit dir if systemd is selected
* Set same status for duplicate servers
* Add user and group search LDAP filter options
* Case insensitive originalDN test
* Require openssl-devel is libcrypto backend is selected
* Warn that some crypto features are implemented in NSS only
* Disable libcrypto code
* Do not leak LDAP paging controls
* Fix order of arguments in select_principal_from_keytab() call
* Do not leak pcre context
* Do not leak LDAP URI with high log level
* Do not leak netgroups hash table
* Remove unused constants from data_provider.h
* Use a temporary memory context in expand_ccname_template
* Set c-ares to retry nameservers
* Remove append_attrs_to_array
* Rename label in expand_ccname_template
* Add a new option to override primary GID number
* Add a new option to override home directory value
* Add new options to override shell value
* sdap_get_generic_ext
* Generic dereference data structures and utilities
* Add support for Attribute Scoped Queries
* OpenLDAP dereference searches
* Generic dereference search
* Change sysdb_add_fake_user to add OriginalDN
* Use fake users during RFC2307bis nested group processing
* Refactor RFC2307bis nested group processing
* Use dereference when processing RFC2307bis nested groups
* Fix bad comparison in sdap_has_deref_support
* Fix uninitialized pointer read in sdap_x_deref_parse_entry
* Fix uninitialized scalar variable in sdap_nested_group_check_cache
* Separate return paths for success and failure in
sdap_nested_group_check_cache
* Add utility function to return IP address as string
* Add a utility function to escape IPv6 address for use in URIs
* Use escaped IP addresses in LDAP provider
* Escape IPv6 IP addresses in the IPA provider
* Make parse_args skip extra spaces
* Unit test for parge_args
* Add new resolv_hostent data structure and utility functions
* Resolve hosts by name from files into resolv_hostent
* Resolve hosts by name from DNS into resolv_hostent
* Switch resolver to using resolv_hostent and honor TTL
* Provide TTL structure names for c-ares < 1.7
* Test NULL server hostname in fail over tests
* Log nsupdate message
* ipa_dyndns: Use sockaddr_storage for storing IP addresses
* Provide python bindings for the HBAC evaluator library
* Move IP adress escaping from the LDAP namespace
* Escape IP address in kdcinfo
* Do not hardcode default resolver timeout
* Split reading resolver family order into a separate function
* Allow returning arbitrary address from resolv_hostent as string
* Check DNS records before updating
* Remove unused krb5_service structure member
* Use ares_search instead of ares_query for hostname resolution
* Fixes for python HBAC bindings
* Fix python HBAC bindings for python <= 2.4
* Do not add a NULL host parsed from LDAP URI
* Only print server address if one is available
* Rename fo_get_server_name to fo_get_server_str_name
* fo_get_server_name() getter for a server name
* Fix indexing of skipped groups
* Set gidNumber of non-posix groups to 0 even on updates
* Explicitly ignore groups with gidNumber=0
* Remove dead code from python HBAC bindings
* Handle allocation error in python HBAC bindings
* UTF8 HBAC test
* Wrong paramater to sysdb_attrs_add_uint32
* Change the default value of ldap_tls_cacert in IPA provider
* HBAC rule validation Python bindings
* Request password control unconditionally during bind
Jan Zeleny (28):
* Remove unused be_check_online() SBUS call
* Remove unused sysdb_attrs object
* Fix one unlikely case of failure in sdap_id_op module
* Add last usn checking after reconnection
* Extend and move function for finding principal in keytab
* Allow new option to specify principal for FAST
* Don't use negative cache in netgroup lookup
* Configuration parsing updates
* Added originalDN to attributes with case-insensitive search
* Modify principal selection for keytab authentication
* Fixed lastUSN checking improvements
* Make sysdb_ctx_list public structure
* Add a function for searching netgroups with custom filter
* Cache cleaning tool
* Some minor fixes and changes in sysdb_ops
* Man page for sss_cache
* Added some kerberos functions for building on RHEL5
* Fixed --debug-to-files for nss and pam services
* Fixed wrong variable in sdap_initgr_nested_store
* Possible memory leak fixed
* Fixed unitialized return value in match_principal
* Fixed unitialized pointer in select_principal_from_keytab
* Fixed uninitialized value in sss_cache
* Fixed copying of pam_data structure
* Added sysdb_attrs_get_bool() function
* Non-posix group processing - sysdb changes
* Non-posix group processing - ldap provider and nss responder
* Fall back to polling when inotify fails
John Hodrien (1):
* Add vetoed_shells option
Kaushik Banerjee (1):
* Changing default to Default for consistency
Matthew Ife (1):
* Replace system() function with fork and execl call.
Pierre Ossman (1):
* Add host access control support
Simo Sorce (8):
* Check that the socket is really ours before attempting to close it.
* Use neutral name for functions used by both pam and nss
* sysdb: use header defined macros instead of explicit values
* memberof: fix calculation of replaced members
* memberof: free delete operation apyload once done
* clients: use poll instead of select
* fix typos
* sss_client: avoid leaking file descriptors
Stephen Gallagher (96):
* Update version to 1.5.2dev
* Sanitize search filters for nested group lookups
* Bumping version to 1.6.0dev
* Wrap cleanup task in a sysdb transaction
* Add additional indexing for sysdb
* Make the domain argument mandatory in sss_obfuscate
* Gracefully handle permission errors in sss_obfuscate
* Make SSSDConfig API configuration readable
* Only print "no matching service rule" when appropriate
* Clear up -Wunused-but-set-variable warnings
* Fix cleanup transaction
* Fix module registration with newer LDB libraries.
* Verify LDAP file descriptor validity
* Minor specfile changes
* Detect the proper location for memberof.so
* Fix specfile for RHEL5
* Do not attempt to use START_TLS on SSL connections
* Point the IPA provider at the compat tree for netgroups
* Remove cached user entry if initgroups returns ENOENT
* Perform initgroups lookups for all domains
* IPA provider: remove deleted groups during initgroups()
* Allow krb5_realm to override ipa_domain
* Add krb5_realm to the basic IPA options
* Fix uninitialized value error in ipa_get_id_options()
* Add transifex_client configuration
* Add new translations from Transifex
* Update translation sources
* Require existence of GID number and name in group searches
* Require existence of username, uid and gid for user enumeration
* Add support for krb5 access provider to SSSDConfig API
* Fix incorrect return value check
* Create sysdb_get_rdn() function
* Add sysdb_attrs_primary_name()
* Ignore aliases for users
* RFC2307: Ignore aliases for groups
* RFC2307bis: Ignore aliases for groups
* Use sysdb_attrs_primary_name() in sdap_initgr_nested_store_group
* Add sysdb_attrs_primary_name_list() routine
* Don't crash if we get a multivalued name without an origDN
* Don't crash on error if _name parameter unspecified
* Check result of talloc_strdup() properly
* sss_obfuscate: Avoid traceback on ctrl+d
* sss_obfuscate: abort on ctrl+c
* Always complete the transaction in sdap_process_group_members_2307
* RFC2307: Ignore zero-length member names in group lookups
* Fall back to cn if gecos is not available
* Never remove gecos from the sysdb cache
* Do not throw a DP error when failing to delete a nonexistent entity
* Add debug logging to the negative cache
* Fix a regression with the negative cache in multi-domain
configurations
* Fix regression where nonexistent entries were never added to the
negative cache
* Don't leak memory if sysdb_domain_init() fails
* Run all appropriate upgrades
* Reopen the LDB after modifying it
* Always generate kpasswdinfo file
* Add value of the last USN to server configuration
* simple provider: Don't treat primary GID lookup failures as fatal
* Log the LDAP message type we're processing
* Enable paging support for LDAP
* Add ldap_page_size configuration option
* Add "description" option to SSSDConfig API
* Regular translation update
* Fix IPA config bug with SDAP_KRB5_REALM
* Fix segfault in IPA provider
* Fix bad password caching when using automatic TGT renewal
* Fix minor typo in error message
* Override config file debug_level with command-line
* Include manpage for sss_cache
* Create common sss_monitor_init()
* Allow changing the log level without restart
* IPA Provider: don't fail if user is not a member of any groups
* Build SSSD plugins without a version number
* Build sssd utils as a libtool helper library
* Import config.h earlier
* Make "password" the default for ldap_default_authtok_type
* Add more detail to ldap_uri manpage entry
* Fix typo in initgroups negative cache check
* Ensure that SSSD always Requires: the primary-arch sssd-client
* Do not attempt to close() a file descriptor < 0
* Add helper function msgs2attrs_array
* Add HBAC evaluator and tests
* Add helper functions for looking up HBAC rule components
* Remove old HBAC implementation
* Add new HBAC lookup and evaluation routines
* Add ipa_hbac_refresh option
* Add ipa_hbac_treat_deny_as option
* Treat NULL or empty rhost as unknown
* Allow NULL memctx in sysdb_custom_subtree_dn
* libipa_hbac: Support case-insensitive comparisons with UTF8
* Fix memory leak in ipa_hbac_evaluate_rules
* Fix incorrect NULL check in ipa_hbac_common.c
* Converge accept_fd_handler and accept_priv_fd_handler
* Require matched version and release for libipa_hbac
* Remove incorrect private variable
* Add rule validator to libipa_hbac
* Allow LDAP to decide when an expiration warning is warranted
Sumit Bose (38):
* Fix handling of translated man pages in spec file
* Remove LDAP_DEPRECATED
* Make 'make check' look nice again
* Introduce sysdb_ldb_connect()
* Check LDB_MODULES_PATH for sysdb
* Fix for generating lists of translated man pages
* Remove renewal item if it is not re-added
* Check ccache file for renewable TGTs at startup
* Do not try to delete sysbd memberOf attribute
* Fixes for dynamic DNS update
* Add missing name to struct getent_ctx for missing netgroup
* Refactor set_netgroup_entry()
* Change state of hash entry if netgroup cannot be parsed
* Release handle if not connected
* Sanitize DN when searching the original DN in the cache
* Read only rootDSE data if rootDSE is available
* Initialise srv_opts even if rootDSE is missing
* Initialise rootdse to NULL if not available
* Return pam data to the renewal item if renewal fails
* Add support for openldap24 package on RHEL 5.7
* Set _GNU_SOURCE globally
* Remove unused defines from configure.ac
* Include string.h in sss_cli.h
* Sanitize username during initgroups call
* Add online callback only once for TGT renewal
* Delete cached ccache file if password is expired
* Fix two typos
* Add missing libsss_util to proxy provider
* Fix proxy provider return code for secondary missing groups
* Do not check pwdAttribute
* Add sockaddr_storage to sdap_service
* Add sdap_call_conn_cb() to call add connection callback directly
* Use name based URI instead of IP address based URIs
* Use ldap_init_fd() instead of ldap_initialize() if available
* Do not access state after tevent_req_done() is called.
* Call ldap_install_tls() on ldaps connections
* Add support for experimental features
* Add LDAP access control based on NDS attributes
pbrezina (1):
* silence compilation warnings on RHEL5
12 years, 8 months
Shell overrides
by John Hodrien
I've just been playing with the allowed_shells stuff. I'm using a very large
LDAP tree. It contains mostly good data, but has some users shells set to
/bin/sh and /bin/csh. For these users I want to override the shell to
something more sane (like /bin/bash). But I don't want to actually remove
those shells from systems, as I want them to be available for local accounts
and scripts.
So on the client I have local accounts that make use of /bin/sh and /bin/csh
and an /etc/shells of:
/bin/sh
/bin/bash
/sbin/nologin
/bin/tcsh
/bin/csh
If I don't edit /etc/shells it'll use those shells, which isn't what I want.
If I remove it from /etc/shells, and set allowed_shells to an approved list,
it'll switch their shell to nologin.
Is there a way I can deal with this using the current setup? I couldn't see a
way.
I was wondering about adding a new config option to allow you to mark certain
shells as being vetoed, such that the fallback shell is used instead. Is this
in any way sane?
Ignoring the trimmings, the meat of it is just:
diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c sssd-1.5.11/src/responder/nss/nsssrv_cmd.c
--- sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv_cmd.c 2011-07-28 15:46:10.787877792 +0100
@@ -314,7 +314,18 @@
user_shell = ldb_msg_find_attr_as_string(msg, SYSDB_SHELL, NULL);
if (!user_shell) return NULL;
- if (!nctx->allowed_shells) return talloc_strdup(mem_ctx, user_shell);
+ if (!nctx->allowed_shells && !nctx->vetoed_shells) return talloc_strdup(mem_ctx, user_shell);
+
+ if (nctx->vetoed_shells)
+ {
+ for (i=0; nctx->vetoed_shells[i]; i++) {
+ if (strcmp(nctx->vetoed_shells[i], user_shell) == 0) {
+ DEBUG(5, ("The shell '%s' is vetoed. "
+ "Using fallback\n", user_shell));
+ return talloc_strdup(mem_ctx, nctx->shell_fallback);
+ }
+ }
+ }
By all means tell me I'm mad and there are much better ways of achieving what
I'm trying to do. I'm new to sssd, but it looks like it offers a whole raft
of advantages over nss_ldap (which I'm currently using) that makes it look
irresistable.
Thanks,
jh
12 years, 8 months
[PATCHES] HBAC access control rewrite
by Stephen Gallagher
While attempting to extract the SSSD's HBAC rule evaluation into a
common library, I discovered several shortcomings. Some were related to
extracting the library, others were related to the rule evaluation
itself.
Related to extracting the library, I needed for the code to be able to
identify and resolve without having direct access to LDAP or the LDB.
This meant I could not rely on the memberOf objects to be valid.
As for the rule evaluation, I discovered that we were only caching for
offline use those remote hosts that had previously attempted to log in.
This meant that if the IPA server was unreachable, valid users would be
unable to log in from some valid machines.
After careful consideration (and a few false starts), I decided that a
total rewrite was necessary. So here it is.
The major changes are these:
1) We have moved to always performing a full enumeration of known IPA
hosts and HBAC services. This actually results in a net reduction in
round-trips to the LDAP server, which was a primary bottleneck.
Additionally, this means that we also have a full understanding when
offline as to whether a remote host is permitted access or not.
2) I've added a configurable timeout for hbac rule refreshes to the LDAP
server. Previously, if we were online, EVERY pam_account() request would
result in at least one LDAP round-trip. By default, we'll only refresh
the HBAC rules every five seconds now.
3) I broke the acquisition and processing of the rules, hosts and
services into separate C files, as ipa_access.c was getting to be much
to large to manage.
The overall view of the code (when online) is this:
A request comes in, we call to LDAP to get, in order, the set of known
hosts, the set of known PAM services and then finally the set of
*enabled* rules with the current ipa_hostname as the targethost.
And now, the patches:
Patch 0001: The new standalone evaluator library. It's very simple at
the moment (but it will become much more complex in the near future when
timerule evaluation is added). Jakub, Rob and I agreed on the interface
and Jakub is creating Python bindings for it.
Patch 0002: This is the meat of the new IPA access backend. All of the
helper functions necessary for looking up, storing and converting the
hosts, rules and services are in this patch.
Patch 0003: This is not really a patch as much as it is a trash can. I
split this from Patch 0004 to make the latter more reviewable. Patch
0003 contains only the deletions of the old access provider
implementation.
Patch 0004: Adds the new IPA access provider, taking advantage of the
helper functions from Patch 0002.
Patch 0005: Adds a refresh timeout to reduce round-trips to IPA while
online.
12 years, 9 months
[PATCH] Provide python bindings for the HBAC evaluator library
by Jakub Hrozek
Hi,
the attached patch provides a new python module "pyhbac" that implements
python bindings for the HBAC evaluator library.
The patch depends on Stephen's last patches which are on review as of
now, but the test suite passed, so I think the bindings can be reviewed
in parallel.
"make check" loads the built python module from tree by doing some
sys.path magic. If you'd like to experiment with the module yourself,
you must either install it or set PYTHONPATH to $SSSD_BUILD_DIR/.libs
12 years, 9 months
[PATCH] Coverity issues in python HBAC bindings
by Jakub Hrozek
[PATCH 1/2] Remove dead code from python HBAC bindings
As Coverity noticed, we check for s != NULL in both if and else branches.
[PATCH 2/2] Handle allocation error in python HBAC bindings
This is kinda embarrassing, but the body of a NULL check was completely
missing.
12 years, 9 months