[PATCH 5/7] responder: Use SAFEALIGN macro when checking pam data, validity.
by Michal Židek
On 11/14/2013 01:14 PM, Lukas Slebodnik wrote:>>From
fbc7adbf1331fdb931b43f2b6ffda43565ce442e Mon Sep 17 00:00:00 2001
>> >From: Michal Zidek<mzidek(a)redhat.com>
>> >Date: Wed, 4 Sep 2013 16:17:57 +0200
>> >Subject: [PATCH 5/7] responder: Use SAFEALIGN macro when checking
pam data
>> >validity.
>> >
>> >resolves:
>> >https://fedorahosted.org/sssd/ticket/1359
>> >---
>> >src/responder/pam/pamsrv_cmd.c | 18 +++++++++++++-----
>> >1 file changed, 13 insertions(+), 5 deletions(-)
>> >
>> >diff --git a/src/responder/pam/pamsrv_cmd.c
b/src/responder/pam/pamsrv_cmd.c
>> >index 32efc4b..6418047 100644
>> >--- a/src/responder/pam/pamsrv_cmd.c
>> >+++ b/src/responder/pam/pamsrv_cmd.c
>> >@@ -144,12 +144,20 @@ static int pam_parse_in_data_v2(struct
sss_domain_info *domains,
>> > uint32_t size;
>> > char *pam_user;
>> > int ret;
>> >- uint32_t terminator = SSS_END_OF_PAM_REQUEST;
>> >+ uint32_t start;
>> >+ uint32_t terminator;
>> >
>> >- if (blen < 4*sizeof(uint32_t)+2 ||
>> >- ((uint32_t *)body)[0] != SSS_START_OF_PAM_REQUEST ||
>> >- memcmp(&body[blen - sizeof(uint32_t)], &terminator,
sizeof(uint32_t)) != 0) {
> Function memcmp is also used in the function pam_forwarder_parse_data,
> although there is no alignment warning we should be consistent at
least in the
> same file.
Yes. I modified it to use safealign copy as well in the new patch.
Michal
PS:
Btw. why is the condition to detect unterminated data like this
if (blen >= sizeof(uint32_t)
&& lastfourbytes != END_OF_PAM_REQUEST) {
return error;
}
Shouldn't it be like this?
if (blen < sizeof(uint32_t)
|| lastfourbytes != END_OF_PAM_REQUEST) {
return error;
}
Is it possible that pam request shorter than terminator is valid?
10 years, 4 months
[PATCH 1/7] sss_client: Use SAFEALIGN_COPY_<type> macros where appropriate
by Michal Židek
On 11/14/2013 01:14 PM, Lukas Slebodnik wrote:> On (05/11/13 15:18),
Michal Židek wrote:
>>>>> Thanks for the responses.
>>>>>
>>>>> I decided to reduce the patches for this thread to only
>>>>> similar or simple changes. I think it is still quite enough
>>>>> for a review. I will post patches for the rest of the issues
>>>>> (like the one with
sockaddr) in
>>>>> separate threads. I hope this will make review easier. So
>>>>> after
applying
>>>>> these patches there will still be a lot of warnings.
>>>>>
>>>>> New patches attached.
>>>>>
>>>>> PS: Sorry for delayed answer.
>>>>>
>>>>>
>>>
>>> Sending patches rebased on top of current master.
>>>
>>> Michal
>>>
>> From 93a3b127e24ed26068ca7cfea41992a86440d8c2 Mon Sep 17 00:00:00
>> 2001
>>> From: Michal Zidek<mzidek(a)redhat.com> Date: Wed, 21 Aug 2013
>>> 17:17:06 +0200 Subject: [PATCH 1/7] sss_client: Use
>>> SAFEALIGN_COPY_<type> macros where diff --git
>>> a/src/sss_client/idmap/sss_nss_idmap.c
b/src/sss_client/idmap/sss_nss_idmap.c
>>> index e0faf6e..69f825f 100644 ---
>>> a/src/sss_client/idmap/sss_nss_idmap.c +++
>>> b/src/sss_client/idmap/sss_nss_idmap.c @@ -108,7 +108,7 @@ static
>>> int sss_nss_getyyybyxxx(union input inp,
enum sss_cli_command cmd ,
>>> goto done; }
>>>
>>> - num_results = ((uint32_t *)repbuf)[0]; +
>>> SAFEALIGN_COPY_UINT32(&num_results, repbuf, NULL); if
>>> (num_results == 0) { ret = ENOENT; goto done; @@ -117,7 +117,7 @@
>>> static int sss_nss_getyyybyxxx(union input inp,
enum sss_cli_command cmd ,
>>> goto done; }
>>>
> Please add comment why comment why you skipped one unit32_t There is
> already similar comment on the other place in this patch. /* Skip
> first two 32 bit values (number of results and * reserved padding)
> */
Added.
>
>>> - out->type = ((uint32_t *)repbuf)[2]; +
>>> SAFEALIGN_COPY_UINT32(&out->type, repbuf + 2 *
sizeof(uint32_t), NULL);
>>>
>>> data_len = replen - DATA_START;
>>>
>>> diff --git a/src/sss_client/nss_group.c
>>> b/src/sss_client/nss_group.c index e6ea54b..a7fb093 100644 ---
>>> a/src/sss_client/nss_group.c +++ b/src/sss_client/nss_group.c @@
>>> -298,7 +298,7 @@ enum nss_status _nss_sss_initgroups_dyn(const
char *user, gid_t group,
>>> }
>>>
>>> /* no results if not found */ - num_ret = ((uint32_t
>>> *)repbuf)[0]; + SAFEALIGN_COPY_UINT32(&num_ret, repbuf,
>>> NULL); if (num_ret == 0) { free(repbuf); nret =
>>> NSS_STATUS_NOTFOUND; @@ -328,9 +328,13 @@ enum nss_status
>>> _nss_sss_initgroups_dyn(const
char *user, gid_t group,
>>> *size = newsize; }
>>>
> The same issue is here.
>>> - rbuf = &((uint32_t *)repbuf)[2]; + /* Skip first two 32
>>> bit values (number of results and + * reserved padding) */
^^^^^^^^^^^^^^^^^^^^^
The comment was there. Maybe I missed something?
>>> + buf_index = 2 * sizeof(uint32_t); + for (l = 0; l < max_ret;
>>> l++) { - (*groups)[*start] = rbuf[l]; +
>>> SAFEALIGN_COPY_UINT32(&(*groups)[*start], repbuf + buf_index, +
>>> &buf_index); *start += 1; }
>>>
> Otherwise, conditions look much nicer with variables like a
> "num_results" instead of "buffer magic" (((uint32_t *)repbuf)[0] ==
> 0)
New patch attached.
Michal
10 years, 4 months
[PATCH] - Improved detection of user domain
by Pavel Reichl
Hello,
First patch improves domain detection taking matched length into account
as proposed and elaborated by Jakub.
Second patch is a simple unit test testing sss_ldap_dn_in_search_bases
and sdap_domain_get_by_dn.
Pavel Reichl
10 years, 4 months
kerberos problems with 2008R2 AD
by Greg Lehmann
Hi All,
I'm after some help tracking this problem down. I am seeing this from a few different OSes all with the same AD realm: CentOS 6.4, SLES 11SP3 and opensuse 13.1 all of which run sssd 1.9.x and SLES 11 SP2 running sssd 1.5.11. The ldap side of things seems to be working OK as getent passwd is returning what I expect. The kerberos side of things is not, although kinit as a user works:
client:/var/log/sssd # kinit user
Password for user(a)DOM.COMPANY.COM:
client:/var/log/sssd #
It looks like the realm is being truncated somehow so DOM.COMPANY.COM is getting truncated to COMPANY.COM for the kerberos lookups. I see this in the krb5_child.log file:
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [main] (0x0400): krb5_child started.
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [unpack_buffer] (0x1000): total buffer size: [104]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [unpack_buffer] (0x0100): cmd [241] uid [67657] gid [67657] validate [false] offline [false]
UPN [user(a)COMPANY.COM]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_67657_XXXXXX] keytab: [/etc/krb5.keytab]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0400): Will perform online auth
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sss_child_set_krb5_tracing] (0x0100): krb5 tracing is not available
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment.
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from environment.
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_set_canonicalize] (0x0100): SSSD_KRB5_CANONICALIZE is set to [false]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sss_krb5_get_init_creds_opt_set_canonicalize] (0x0040): Kerberos principal canonicalization
is not available!
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [krb5_child_setup] (0x0100): Not using FAST.
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [tgt_req_child] (0x1000): Attempting to get a TGT
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sss_krb5_get_init_creds_opt_set_expire_callback] (0x0200): krb5_get_init_creds_opt_set_expi
re_callback not available.
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [COMPANY.COM]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [get_and_save_tgt] (0x0020): 977: [-1765328230][Cannot find KDC for requested realm]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [kerr_handle_error] (0x0020): 1030: [-1765328230][Cannot find KDC for requested realm]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [prepare_response_message] (0x0400): Building response for result [-1765328230]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [pack_response_packet] (0x2000): response packet size: [48]
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [sendresponse] (0x4000): Response sent.
(Thu Nov 28 18:17:38 2013) [[sssd[krb5_child[24911]]]] [main] (0x0400): krb5_child completed successfully
sssd.conf:
[sssd]
config_file_version = 2
debug_level = 10
reconnection_retries = 3
sbus_timeout = 30
services = nss,pam
domains = DOM.COMPANY.COM
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
debug_level = 10
offline_credentials_expiration = 3
[domain/DOM.COMPANY.COM]
debug_level = 10
filter_groups = root
filter_users = root
description = LDAP domain with AD server
cache_credentials = false
enumerate = false
min_id = 65537
ldap_uri = ldap://dc1.dom.comany.com
ldap_sasl_mech = GSSAPI
ldap_krb5_keytab = /etc/krb5.keytab
ldap_sasl_authid = CLIENT$(a)DOM.COMPANY.COM
ldap_search_base = dc=dom,dc=company,dc=com
ldap_schema = rfc2307bis
id_provider = ldap
ldap_user_search_base = ou=People,dc=dom,dc=company,dc=com
ldap_group_search_base = ou=Groups,dc=dom,dc=company,dc=com
ldap_group_name = msSFU30Name
ldap_group_nesting_level = 5
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_force_upper_case_realm = true
auth_provider = krb5
krb5_realm = DOM.COMPANY.COM
krb5_server = dc.dom.company.com
krb5.conf:
[libdefaults]
clockskew = 300
default_realm = DOM.COMPANY.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5
default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5
preferred_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
[realms]
DOM.COMPANY.COM = {
default_domain = dom.company.com
admin_server = dc1.dom.company.com
kpasswd_server = dc1.dom.company.com
kdc = dc1.dom.company.com
}
[domain_realm]
.dom.company.com = DOM.COMPANY.COM
dom.company.com = DOM.COMPANY.COM
[logging]
default = SYSLOG:NOTICE:DAEMON
[appdefaults]
pam = {
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
debug = true
krb4_convert = false
}
10 years, 4 months
[PATCH] KRB5: Go offline in case of clock skew
by Jakub Hrozek
Hi,
while testing the offline subdomain logins, I found out that clock skew
(which is still an issue in trusted environments even after the recent
MIT Kerberos changes) results in System Error.
The attached patch simply treats the skew as networking error, which
results in failover and if no good serve is found, then in offline
operation. It didn't seem necessary to me to add new error code, but if
other developers would like ie better error reporting, I can add it
easily.
10 years, 5 months
sssd_be not telling user account is locked?
by Viviano, Brad
Hello,
I have a RHEL6 server running sssd 1.9.2-129 (Redhat RPM). I've configured it to talk to my LDAP server, which is OpenLDAP. OpenLDAP doesn't nativly support account locking via ldap_ns_account_lock so I added a schema extension so I could set a an account locked when needed. Everything is working fine having ldap_account_expire_policy set to rhds, but I was wondering if there was an option in sssd to provide a message to the user directly that the account is locked when they try and login. All the user sees is (as an example):
$ ssh -o bviviano@myhost
bviviano@myhost's password:
Your password will expire in 6 day(s).
Connection closed
If I look in /var/log/secure I see this message:
Nov 27 10:03:44 smtools sshd[17267]: pam_sss(sshd:account): system info: [The user account is locked on the server]
I can see the account is locked and my sssd log for that domain shows the account is locked:
(Wed Nov 27 10:03:44 2013) [sssd[be[default]]] [sdap_account_expired_rhds] (0x0400): Performing RHDS access check for user [bviviano]
(Wed Nov 27 10:03:44 2013) [sssd[be[default]]] [sdap_account_expired_rhds] (0x4000): Account for user [bviviano] is locked.
(Wed Nov 27 10:03:44 2013) [sssd[be[default]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 6, <NULL>) [Success]
I'd just like to provide that information back to the user directly in this case, if its an option.
Thanks,
-Brad Viviano
===================================================
Brad Viviano
High Performance Computing & Scientific Visualization
Lockheed Martin, Supporting the EPA
Research Triangle Park, NC
919-541-2696
HSCSS Task Order Lead - Ravi Nair
919-541-5467 - Nair.Ravi(a)epa.gov
High Performance Computing Subtask Lead - Durward Jones
919-541-5043 - Jones.Durward(a)epa.gov
Environmental Modeling and Visualization Lead - Heidi Paulsen
919-541-1834 - Paulsen.Heidi(a)epa.gov
10 years, 5 months