[PATCH] PAM: print the pam status as string, too
by Jakub Hrozek
Hi,
I was debugging a case which could be solved much faster if the PAM
responder was louder about presenting error messages. I wonder if the
other developers are OK with adding -lpam as a new dependency for the
PAM responder, but gived sssd_be has this dependency as well, I hope
it's fine.
9 years, 2 months
[RFC] PAM Conversation for OTP design
by Sumit Bose
Hi,
I have created a design page for the special prompting for long-term
password and one-time password at
https://fedorahosted.org/sssd/wiki/DesignDocs/PAMConversationForOTP
Comments and suggestions are welcome. Please note, there are two open
questions related to configuration.
For your convenience I added the text below as well.
bye,
Sumit
= PAM Conversation for OTP/Two-Factor-Authentication =
Related ticket(s):
* https://fedorahosted.org/sssd/ticket/2335
=== Problem statement ===
Two-Factor-Authentication (2FA) typically uses a long term password or
PIN and an One-Time-Password (OTP) which in general is generated by a
small device. To be backward compatible and to allow 2FA in existing
application both factors can be entered one after the other in a single
password prompt. This single string is then evaluated by the
authentication backend.
On desktop systems where a single password (One-Factor-Authentication -
1FA) is used this password is often used for other purposes to improve
the user experience. For example to
- unlock a keyring
- un-encrypt files or the complete home-directory
- allow authentication even if the authentication backend is not
reachable (offline authentication).
These convenience features are not available if 2FA is used with both
factors combined in a single string because there is no general rule
which would allow to split the long-term and the one-time part. Only the
authentication backend knows how to handle it. To make these features
possible again with 2FA the user must enter the two factor individually
into two separate prompts. This design page will show how this can be
achieved with the help of PAM and SSSD.
Short overview (up to a couple of sentences) of the change being
designed. Might include pointers to reference materials (such as MSDN
articles when designing an AD integration feature) or other information
required to understand what the change is about.
=== Use cases ===
==== Unlock user's keyring ====
Assuming a user with 2FA enabled which log into a desktop session. If
the two factors are entered into a single prompt the resulting string
cannot be used as a password for the desktop keyring application because
it will change at every login. To not create issues SSSD will
automatically remove the password item from the PAM environment in this
case (see #2287 for details).
If the two factors are entered separately the first factor, the
long-term password, can but used as a password for the keyring
application because changes will be rare. In this case SSS can put the
long term password into the PAM environment so that the PAM modules of
the keyring application can pick it up at login time so that there is no
need to unlock the keyring in a separate step.
==== Offline-authentication ====
Assuming a user with 2FA enabled which log into a desktop session which
currently does not have a connection to the central authentication
server. If the two factors are entered into a single prompt the
resulting string can only be processed by the central authentication
server and a loss of connection will make authentication and login
impossible. Even the SSSD offline-authentication feature won't help
because SSSD will only store a hash of the password used for the last
successful authentication and compare it with the hash of the current
password. Since the combined password will change at every login the
current combined password cannot be validated against any previously
used password.
If the two factors are entered separately SSSD can save a hash of the
first factor can can compare the hashes for the first factor when
offline to allow at least access to the local machine. It has to be
noted that the even if krb5_store_password_if_offline is set to true
SSSD will not try to get a TGT when going online again because in the
general case the second factor (OTP) might be already invalid.
Both use-cases mentioned above might only be working if the first factor
(long-term password) is sufficiently long. A 4-digit PIN used by some
OTP systems is not secure enough to be uses as a password for a keyring
or to allow local access.
=== Overview of the solution ===
On of the design principals of SSSD's PAM module pam_sss was that it
should do any decisions on its own but let SSSD do this. As a
consequence pam_sss cannot decide which type of password prompt should
be shown to the user but must ask SSSD first. Currently the first
communication between pam_sss and SSSD's PAM responder happens after the
user entered the password. Hence a new request, a pre-authentication
request, to the PAM responder must be added before the user is prompted
for the password. The pam responder can then relay the request to a
suitable backend where it can be evaluated which type of prompt should
be shown to the user. The result can be send back to pam_sss in a PAM
response message which is already use to return other types of messages
to pam_sss. This message can be used to send addition hints like e.g.
type or vendor of the expected OTP hardware token to the user.
Based on the response pam_sss will ask the user for a single password or
for the two factors in individual prompts. If only the first factor is
entered and the second is empty the input will be treated as a single
password. This might happen is the user accidentally entered both factor
together or if applications or protocols (ssh, ftp) are configured or
can handle only a single password prompt.
Keep keep the delays due to the new request to a minimum pam_sss should
only run it, if the backend really supports it. Additionally is should
be possilbe to disable the pre-authentication request completely with a
new option for pam_sss.
In addition to the authentication dialog the password change dialog
should respect the splitting of the two factors as well.
=== Implementation details ===
==== Making sure the PAM calls SSSD the ask for credentials for SSSD
users ====
PAM allows to configure multiple different authentication methods but
ideally only ask the user once for a password (or other credentials).
Typically the first configure authentication method will ask for a
password and if the user is not know to the authentication method the
password is passed on to the next authentication method. Obviously this
only works well with a single type of credentials.
In our case we want to prompt the user differently depending on whether
1FA or 2FA is configured for the user. Typically pam_unix is the first
authentication module to make sure the authentication of local users
(especially root) is not affected by other modules. But since pam_unix
does not know anything about SSSD users or 2FA we have to make sure that
pam_unix will not ask for a password for SSSD users. Instead of putting
pam_sss in front of pam_unix we would like to use pam_localuser to skip
pam_unix for non-local users. A PAM auth configuration might look like
this
{{{
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000
quiet_success
auth sufficient pam_sss.so
auth required pam_deny.so
}}}
If the user is in /etc/passwd pam_localuser will return success and
pam_unix will be called. Otherwise the next entry (default=1) will be
skipped which is pam_unix in this case. The next module for a user which
does not come from /etc/passwd if pam_succeed_if. I think it is a good
idea to keep the pam_succeed_if to keep the separation between local
users (uid < 1000) and remote users (uid >= 1000).
For the time being we keep the PAM password section (for password
changes) as is because it is already used to handle changing the
long-term password.
==== Handling the two authentication factors ====
Both the wire protocol between pam_ssd and the pam responder and SSSD
internally with the sss_auth_token struct handle the credentials as a
blob with a length and a type. Currently the blob contains either the
password or is NULL in case of no password (there is a special usage
where it contains a Kerberos credential cache identification).
Adding the two authentication factor to those structure can be achieve
without modifying them by using a new type for 2FA and creating a blob
which starts with two 32bit unsigned integer value containing the size
of the first and second authentication factor respectively followed by
the first factor and finally the second factor.
{{{
uint32_t | uint32_t | uint8_t[6] | uint8_t[5]
---------|----------|------------|-----------
0x06 | 0x06 | abcdef | 12345\0
}}}
As shown the first and second factor may or may not include a trailing
\0 in the blob. But calls which decompose the blob into its component
must assure that that there is a trailing \0 if strings are expected.
With this scheme only packaging and un-packaging the two factors has to
be added to existing or new calls but all other internal handling like
sending the data from the responder to the backends can be left
unchanged.
Backends which should handle 2FA must be made aware of the new
authentication token type.
==== The pre-authentication request ====
The pre-authentication request will follow the same path as the
authentication request with an empty password and with type
SSS_PAM_PREAUTH instead of SSS_PAM_AUTHENTICATE. It is up to the backend
if and how this request will be handled. Currently only the IPA auth
provider will support the pre-auth request in the sense that it can send
different results base on the expected authentication type (1FA, 2FA)
back to the client. Since the IPA provider will basically use the
generic krb5 auth provider the krb5 auth provider will support the
pre-auth request as well.
The IPA provider will send a back a PAM response of the type
SSS_PAM_OTP_INFO in case of 2FA with optional token_id, vendor name and
challenge so that pam_sss can give additional hints to the user and a
unsigned 32bit integer value indication the type of the optional data.
This indicator will make it more easy to add more data in future or just
indicate that the user uses 2FA but the backend is offline.
If 2FA is not enable for the user or errors occur just a PAM_SUCCESS
will be returned. In this case pam_sss will just ask for a single
password.
If the backend is offline the PAM responder will tell the client that
only the first factor is needed for local authentication with the help
of a special SSS_PAM_OTP_INFO message. To achieve this the type of the
hashed authentication token in the cache must be saved. Additionally the
length of the second factor should be saved in the cache to allow
splitting a combined password which might be entered by the user
accidentally or via services where special prompting might not be
available like e.g. ssh. If the second factor varies in size this scheme
will fail but saving the length of the first factor will make an offline
attack against the hashed password much easier.
Since the pre-auth request is an additional round-trip from pam_sss to
the KDC and back it might delay the logon process a bit. To avoid this
in environments where only 1FA is used and option the pam_sss,
''disable_preauth'', can disable the pre_auth request completely.
Additionally I would suggest a more dynamic solution where is pre-auth
request is only send if a special file, e.g.
/var/lib/sssd/pubconf/do_pam_preauth, exits. The IPA provider can create
this file at startup if 2FA is supported.
==== Special use of the first factor (long term password) ====
===== Cached password hash for offline-authentication =====
If authentication was successful, the ''cache_credentials'' option is
set to ''true'' and the first factor has at least
''[#minimal_password_length minimal_password_length]'' SSSD will saved a
hashed version of the first factor to the user's cache entry as it is
done for the 1FA password.
===== PAM =====
If authentication is successful and the ''forward_pass'' option is given
for pam_sss the first factor will be saved in the PAM_AUTHTOK item so
that other modules in the PAM stack can use it. '''QUESTION: shall
we(authconfig) add forward_pass by default? Currently is it not.'''
=== Configuration changes ===
==== pam_sss ====
New options:
- ''disable_preauth'' will unconditionally disable the
pre-authentication request
- ''use_2fa'' will always ask for two authentication factor, might be
only useful for testing
==== sssd.conf ====
New option:
- [=#minimal_password_length] ''minimal_password_length'' will let the
pam responder only safe a hash of the password if it has a minimal
length. Additionally it might indicate to pam_sss to remove passwords
from the PAM environment which are shorter. '''Question: We can limit
this option to the first factor of a 2FA authentication. Although it
might be useful for 1FA passwords as well it might introduce a
regression to existing installations.'''
==== Changing the first factor ====
It is already possible to change the long-term password (first factor),
the current scheme will not be changed here.
=== How To Test ===
==== Prerequisites ====
Create an user with 2FA/OTP authentication as e.g. described in
http://www.freeipa.org/page/V4/OTP#Configuration
==== Login prompt ====
If 2FA is enabled for a user there should be two separate prompts for
the two authentication factors for services which can support special
prompting. This includes e.g. gdm and su. ssh can only support this if
''ChallengeResponseAuthentication'' is enabled on the server side.
Nevertheless even if ''ChallengeResponseAuthentication'' is not enabled
ssh should allow login if both factors are given at the password prompt
in a single string.
For users without 2FA the single password prompt should be seen.
{{{
# su - otpuser
First factor:
Second factor:
sh$
}}}
{{{
# su - user
Password:
sh$
}}}
If both factors are entered at the ''First factor'' prompt and the
second factor prompt is empty, authentication should be successful but
it cannot be expected that the user's keyring is unlocked or that
offline-authentication will be available.
==== Unlocking user's keyring ====
If an otpuser logs in with gdm and enters the two authentication factors
separately in the expected prompts the keyring of the user should be
unlocked automatically and no additional password prompt should be seen
after logging in.
==== Offline authentication ====
If an otpuser logs in with an application which supports special
prompting, e.g. gdm or su, and the SSSD configuration option
''cache_credentials'' is set to ''True'' SSSD will save a hash of the
first factor in the cache to allow offline authentication. If later on
the system goes offline authentication should still be possible with the
first authentication factor. Only a prompt for the first factor should
be shown by application which supports special prompting.
=== Authors ===
Sumit Bose <sbose(a)redhat.com>
9 years, 2 months
[PATCH] PAM: do not reject abruptly
by Pavel Reichl
Hello,
please see attached patch. I'm not sure whether using pam_strerror() is
the right thing to do. It might be better to use our own string?
I'm also not sure about using _(STRING) macro on the output of
pam_strerror().
I attached output of sequence of commands to show differences.
1) This is output without patch being applied.
$ su john
Password:
su: User account has expired
ssh -l john `hostname`
Connection closed by 192.168.122.166
#not matching key
$ ssh -l john `hostname` -i /tmp/local
john(a)dev.local.test's password:
Connection closed by 192.168.122.166
2) This is output when patch is applied. Please note the duplicity when
using su.
$ su john
Password:
User account has expired
su: User account has expired
$ ssh -l john `hostname`
User account has expired
Connection closed by 192.168.122.166
#not matching key
$ ssh -l john `hostname` -i /tmp/local
john(a)dev.local.test's password:
User account has expired
Connection closed by 192.168.122.166
Thanks for comments.
9 years, 2 months
Announcing SSSD 1.12.4
by Jakub Hrozek
=== SSSD 1.12.4 ===
The SSSD team is proud to announce the release of version 1.12.4 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora 21, 22 and rawhide shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* This is mostly a bug fixing release with only minor enhancements visible
to the end user
* Contains many fixes and enhancements related to the ID views functionality
of FreeIPA servers
* Several fixes related to retrieving AD group membership in an IPA-AD
trust scenario
* Fixes a bug where the GPO access control previously didn't work at all
if debugging was enabled in smb.conf.
* SSSD can now be pinned to a particular AD site instead of autodiscovering
the site
* A regression that caused setting the SELinux context for IPA users to
fail, was fixed
* Fixed a potential crash caused by a double-free error when an SSSD
service was killed by the monitor process
== Packaging Changes ==
* Several patches that allow building the Python code in SSSD with python3
were merged
== Documentation Changes ==
* A new option ad_site was added. When this option is set, SSSD will
attempt to connect to DCs from this particular AD site instead of looking
up the site via DNS
* The ad_gpo_map_permit option now also includes the systemd-user service
to avoid errors in processing of the PAM session stack
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/1991
Make return codes of basic sysdb operations consistent
https://fedorahosted.org/sssd/ticket/2203
Write message to syslog about users with duplicated UID
https://fedorahosted.org/sssd/ticket/2376
Investigate Kerberized NFS4 setup with the new NFS plugin
https://fedorahosted.org/sssd/ticket/2486
[RFE] ad provider dns_discovery_domain option: kerberos discovery is not using this option
https://fedorahosted.org/sssd/ticket/2515
sssd-ad: The man page description to enable GPO HBAC Policies are unclear
https://fedorahosted.org/sssd/ticket/2525
Monitor SIGKILL timer issue and service restart failure
https://fedorahosted.org/sssd/ticket/2527
sssd.conf(5) man page gives bad advice about domains parameter
https://fedorahosted.org/sssd/ticket/2531
sssd_be crashes in nested LDAP code with a use-after-free error
https://fedorahosted.org/sssd/ticket/2542
GPO offline processing rejects access if no applicable GPOs are find in the cache
https://fedorahosted.org/sssd/ticket/2543
GPO code fails if no LDAP URI can be resolved
https://fedorahosted.org/sssd/ticket/2544
GPO: libsmbclient logs to stdout by default, cluttering gpo_child output
https://fedorahosted.org/sssd/ticket/2547
gzip: stdin: file size changed while zipping when rotating logfile
https://fedorahosted.org/sssd/ticket/2548
Document that dyndns_iface only supports a single interface
https://fedorahosted.org/sssd/ticket/2550
libsss_simpleifp should pull sssd-dbus
https://fedorahosted.org/sssd/ticket/2556
add systemd-user to default gpo list
https://fedorahosted.org/sssd/ticket/2557
pam_sss(sshd:auth): authentication failure with user from AD
https://fedorahosted.org/sssd/ticket/2559
PAC responder is called after krb5_child switches to the user logging in
https://fedorahosted.org/sssd/ticket/2560
Users saved throug extop don't have the originalMemberOf attribute
https://fedorahosted.org/sssd/ticket/2563
Need to set different umask in selinux_child
https://fedorahosted.org/sssd/ticket/2564
selinux_child needs to setuid(0) to make libselinux work as non-root
https://fedorahosted.org/sssd/ticket/2566
Uncached SIDs cannot be resolved
https://fedorahosted.org/sssd/ticket/2567
Same member saved as ghost and as member in IPA server mode
https://fedorahosted.org/sssd/ticket/2571
IPA initgroups don't work correctly in non-default view
https://fedorahosted.org/sssd/ticket/2572
[abrt] sssd-common: talloc_abort(): sssd killed by SIGABRT
https://fedorahosted.org/sssd/ticket/2586
user_attributes missing from ifp schema
== Detailed Changelog ==
Bohuslav Kabrda (1):
* Python3 support in SSSD
Jakub Hrozek (23):
* Updating the version to the 1.12.4 release
* GPO: Ignore ENOENT result from sysdb_gpo_get_gpo_result_setting()
* TESTS: Cover sysdb_gpo.c with unit tests
* GPO: Set libsmb debugging to stderr
* UTIL: Allow dup-ing child pipe to a different FD
* GPO: Don't use stdout for output in gpo_child
* GPO: Extract server hostname after connecting
* krb5_child: Return ERR_NETWORK_IO on KRB5_KDCREP_SKEW
* Open the PAC socket from krb5_child before dropping root
* IPA: Use attr's dom for users, too
* SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to root
* SELINUX: Set and reset umask when caling set_seuser from deamon code
* LDAP: Add UUID when saving incomplete groups
* IPA: Resolve IPA user groups' overrideDN in non-default view
* LDAP: Rename the _res output parameter to avoid clashing with libresolv in tests
* RESOLV: Add an internal function to read TTL from a DNS packet
* resolv: Fix a typo
* SELINUX: Check the return value of setuid and setgid
* BUILD: Include python-test.py in the tarball
* GPO: Better debugging for gpo_child's mkdir
* LDAP: Add better DEBUG messages to the cleanup task
* LDAP: Handle ENOENT better in the cleanup task
* Updating translations for the 1.12.4 release
Lukas Slebodnik (11):
* logrotate: Fix warning file size changed while zipping
* PROXY: Fix use after free
* pysss: Fix double free
* MONITOR: Fix double free
* SSSDConfig: Remove unused exception name
* SSSDConfig: Port missing parts to python3
* Remove strict requirements of python2
* sbus_codegen: Port to python3
* Add missing new lines to debug messages
* CONFIGURE: Do not use macro AC_PROG_MKDIR_P twice
* RESPONDERS: Warn to syslog about colliding objects
Pavel Březina (1):
* spec: sifp requires sssd-dbus
Pavel Reichl (6):
* GPO: add systemd-user to gpo default permit list
* MAN: dyndns_iface supports only one interface
* MAN: add dots as valid character in domain names
* AD: add new option ad_site
* AD: support for AD site override
* MAN: amend sss_ssh_authorizedkeys
Rob Crittenden (1):
* Add user_attributes to ifp section of API schema
Sumit Bose (24):
* IPA: add get_be_acct_req_for_user_name()
* IPA: resolve ghost members if a non-default view is applied
* sysdb: fix group members with overridden names
* IPA: ipa_resolve_user_list_send() take care of overrides
* IPA: do not look up overrides on client with default view
* IPA: make version check more precise
* IPA: add missing break
* IPA: process_members() optionally return missing members list
* IPA: rename ipa_s2n_get_groups_send() to ipa_s2n_get_fqlist_send()
* IPA: resolve missing members
* IPA: set SYSDB_INITGR_EXPIRE for RESP_USER_GROUPLIST
* krb5: fix entry order in MEMORY keytab
* nss: make fill_orig() multi-value aware
* nss: refactor fill_orig()
* nss: Add original DN and memberOf to origbyname request
* views: fix GID overrride for mpg domains
* IPA: properly handle mixed-case trusted domains
* nss: fix SID lookups
* sysdb: remove ghosts in all sub-domains as well
* IPA: resolve IPA group-memberships for AD users
* IPA: process_members() add ghosts only once
* ipa_s2n_save_objects: properly handle fully-qualified group names
* AD: use GC for SID requests as well
* fill_id() fix LE/BE issue with wrong data type
9 years, 2 months
[PATCH] Two trivial cleanup task patches
by Jakub Hrozek
Hi,
I was recently looking into a case where the cleanup task failed, but
without any indication why or where. Attached is a patch that adds more
DEBUG statements to the code. Another patch makes the case with no
expired entries more readable.
9 years, 2 months