On Fri, 29 Jul 2011, Stephen Gallagher wrote:
So my view is that your LDAP entries are wrong and should be fixed.
That
said, I do see at least two possibly valid case for being able to veto a
shell as a login shell. If dash (a variant of the bourne shell used for
scripts but not logins) is present in /etc/shells for support of some
scripts on the system, we probably want to be able to ensure that it is
never used as a login shell by any user (since it's not designed to
handle this well). Granted, that's still probably another case of the
user in LDAP being misconfigured.
The second possibility is that some platforms may have an implementation
of a particular shell with serious known issues (for example, a copy
of /bin/tcsh that does not in fact include the full tcsh extensions to
csh). If an OS contains such a known-broken shell that it cannot remove
for one reason or another (such as support for a broken legacy script),
we'd want to be able to forcibly veto this as well.
I agree in our case the LDAP tree contains duff information and should be
fixed. That's a separate line of attack I'm pursuing.
So, I suppose I'm willing to see this added. John, would you be
willing
to do the legwork on this if we show you where things need to be added?
I'd be happy to help on this, yes.
This is the patch I'd produced internally based on what was added already for
the override_shell stuff:
diff -ur sssd-1.5.11.orig/src/confdb/confdb.h sssd-1.5.11/src/confdb/confdb.h
--- sssd-1.5.11.orig/src/confdb/confdb.h 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/confdb/confdb.h 2011-07-28 15:39:55.455556158 +0100
@@ -74,6 +74,7 @@
#define CONFDB_NSS_FILTER_GROUPS "filter_groups"
#define CONFDB_NSS_PWFIELD "pwfield"
#define CONFDB_NSS_OVERRIDE_HOMEDIR "override_homedir"
+#define CONFDB_NSS_VETOED_SHELL "vetoed_shells"
#define CONFDB_NSS_ALLOWED_SHELL "allowed_shells"
#define CONFDB_NSS_SHELL_FALLBACK "shell_fallback"
diff -ur sssd-1.5.11.orig/src/config/SSSDConfig.py sssd-1.5.11/src/config/SSSDConfig.py
--- sssd-1.5.11.orig/src/config/SSSDConfig.py 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/config/SSSDConfig.py 2011-07-28 15:41:35.106569862 +0100
@@ -60,6 +60,7 @@
'pwfield' : _('The value of the password field the NSS provider should
return'),
'override_homedir' : _('Override homedir value from the identity
provider with this value'),
'allowed_shells' : _('The list of shells users are allowed to log in
with'),
+ 'vetoed_shells' : _('The list of shells that will be ignored, and
replaced with the fallback shell'),
'shell_fallback' : _('If a shell stored in central directory is allowed
but not available, use this fallback'),
# [pam]
diff -ur sssd-1.5.11.orig/src/man/sssd.conf.5.xml sssd-1.5.11/src/man/sssd.conf.5.xml
--- sssd-1.5.11.orig/src/man/sssd.conf.5.xml 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/man/sssd.conf.5.xml 2011-07-28 15:48:23.780656479 +0100
@@ -424,6 +424,14 @@
</listitem>
</varlistentry>
<varlistentry>
+ <term>vetoed_shells (string)</term>
+ <listitem>
+ <para>
+ Replace any instance of these shells with the fallback_shell
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
<term>shell_fallback (string)</term>
<listitem>
<para>
diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv.c
sssd-1.5.11/src/responder/nss/nsssrv.c
--- sssd-1.5.11.orig/src/responder/nss/nsssrv.c 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv.c 2011-07-28 15:47:05.574269965 +0100
@@ -188,6 +188,10 @@
&nctx->allowed_shells);
if (ret != EOK && ret != ENOENT) goto done;
+ ret = confdb_get_string_as_list(cdb, nctx, CONFDB_NSS_CONF_ENTRY,
+ CONFDB_NSS_VETOED_SHELL,
+ &nctx->vetoed_shells);
+ if (ret != EOK && ret != ENOENT) goto done;
ret = nss_get_etc_shells(nctx, &nctx->etc_shells);
if (ret != EOK) goto done;
diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c
sssd-1.5.11/src/responder/nss/nsssrv_cmd.c
--- sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv_cmd.c 2011-07-28 15:46:10.787877792 +0100
@@ -314,7 +314,18 @@
user_shell = ldb_msg_find_attr_as_string(msg, SYSDB_SHELL, NULL);
if (!user_shell) return NULL;
- if (!nctx->allowed_shells) return talloc_strdup(mem_ctx, user_shell);
+ if (!nctx->allowed_shells && !nctx->vetoed_shells) return
talloc_strdup(mem_ctx, user_shell);
+
+ if (nctx->vetoed_shells)
+ {
+ for (i=0; nctx->vetoed_shells[i]; i++) {
+ if (strcmp(nctx->vetoed_shells[i], user_shell) == 0) {
+ DEBUG(5, ("The shell '%s' is vetoed. "
+ "Using fallback\n", user_shell));
+ return talloc_strdup(mem_ctx, nctx->shell_fallback);
+ }
+ }
+ }
for (i=0; nctx->etc_shells[i]; i++) {
if (strcmp(user_shell, nctx->etc_shells[i]) == 0) {
diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv.h
sssd-1.5.11/src/responder/nss/nsssrv.h
--- sssd-1.5.11.orig/src/responder/nss/nsssrv.h 2011-07-05 18:41:13.000000000 +0100
+++ sssd-1.5.11/src/responder/nss/nsssrv.h 2011-07-28 15:42:00.332070919 +0100
@@ -60,6 +60,7 @@
char *override_homedir;
char **allowed_shells;
+ char **vetoed_shells;
char **etc_shells;
char *shell_fallback;
};