On Wed, 30 Jul 2014 08:46:36 -0700
Simo Sorce <ssorce(a)redhat.com> wrote:
On Wed, 2014-07-30 at 16:23 +0200, Daniel Gollub wrote:
> On Wed, 30 Jul 2014 03:59:48 -0700
> Simo Sorce <ssorce(a)redhat.com> wrote:
>
> > On Wed, 2014-07-30 at 10:58 +0200, Jakub Hrozek wrote:
> > > On Tue, Jul 29, 2014 at 04:59:23PM +0200, Daniel Gollub wrote:
> > > > Hi Jakub,
> > > >
> > > > On Tue, 29 Jul 2014 07:32:58 -0700
> > > > Jakub Hrozek <jhrozek(a)redhat.com> wrote:
> > > >
> > > > > On Tue, Jul 29, 2014 at 04:15:16PM +0200, Daniel Gollub
> > > > > wrote:
> > > > > > Fixes:
> > > > > >
https://fedorahosted.org/sssd/ticket/1021
> > > > >
> > > > > Thanks a lot for the patch!
> > > > >
> > > > > I wonder, though if you read the discussion in the ticket
> > > > > where Simo and Sumit argued this functionality should be
> > > > > implemented in sssd.conf rather than the pam module?
> > > > >
> > > > > If you saw the discussion, what prompted you to continue
> > > > > the pam option way?
> > > >
> > > > What I plan to do is following:
> > > >
> > > > Have a sssd.conf with multiple domains configured of different
> > > > types and configuration configured - e.g.
> > > >
> > > > - "emea.example.com", "hq.example.com" both as
LDAP domain
> > > > - "it.example.com" as Local-domain
> > > >
> > > > With that I want to enable PAM-aware services to use pam_sss
> > > > to authenticate not against all but against expliclty selected
> > > > combination. By creating multiple pam configuration/service
> > > > for multiple e.g. VPN endpoints on the same host. Counting on
> > > > that example:
> > > >
> > > > VPN service #1 is configured to use PAM configuration/service:
> > > > /etc/pam.d/vpn-sales-dep.conf
> > > >
> > > > Which consists of:
> > > > {auth,account} ... pam_sss.so
> > > >
domains=emea.example.com,hq.example.com
> > > >
> > > > VPN service #2 is ocnfigued to use PAM configuration/service:
> > > > /etc/pam.d/vpn-it.conf
> > > >
> > > > Which consists of:
> > > > {auth,account} ... pam_sss.so
domains=it.example.com
> > > >
> > > > And a completely different service / e.g. Webserver which
> > > > should grant access for all SSSD domains:
> > > > /etc/pam.d/random-intranet.conf
> > > >
> > > > Which consists of:
> > > > {auth,account} ... pam_sss.so
> > > >
> > > >
> > > >
> > > > And so on ... everything on the same machine.
> > > >
> > > > This VPN service (e.g. OpenVPN) requires no modification to
> > > > support this. For each of those PAM configuration another
> > > > OpenVPN daemon gets started with a different PAM plugin
> > > > configuration (and different routing options and such).
> > > >
> > > >
> > > > I am not quite sure how this could be done by moving the
> > > > domains= configuration inside sssd.conf, without modifying
> > > > the existing PAM-aware services - like OpenSSH, OpenVPN, ...
> > >
> > > My understanding was that the domain section would grow a new
> > > parameter, something like allowed_pam_services. Then in your
> > > case you would have:
> > >
> > > [
domain/emea.example.com]
> > > allowed_pam_services = vpn-sales-dep
> > >
> > > [
domain/hq.example.com]
> > > allowed_pam_services = vpn-sales-dep
> > >
> > > [
domain/it.example.com]
> > > allowed_pam_services = vpn-it
> > >
> > > I see the point that your configuration is more flexible,
> > > though.
> > >
> > > However, we had some discussion around this effort internally
> > > with Jan and Simo couple of weeks ago. I added them to the CC
> > > list so they can check of your approach would work for them..
> >
> > How do you trust what is claimed by a client ?
>
> By client you mean a pam-client/-application - right?
>
> Isn't trusting /etc/pam.d/<service_name> file safe enough? Do you
> see here any specific attack vector / security risk? (By
> service_name is meant what the client application is providing to
> pam_start(3))
Pam can be run by any user, so anything can be faked, unless we force
to accept only connections from the root user.
What could the non-root user fake here so it becomes a security with
the introduction of this additional parameter?
Having a different pam configuration with different pam_sss.so
parameter? What are the security implication with that and the
introduction of the domains= parameter?
Could you give a example?
> > Is this list a filter or is it meant as an access control to avoid
> > divulging other domains information to specific processes ?
>
> This is primarily meant as "access filter" for authentication - not
> quite sure but maybe the later one is meant by this.
>
> The idea is that a pam-client gets configured to a specific PAM
> service, which consists of pam_sss.so
domains=ldap.example.com and
> only allows authentication against this
ldap.example.com SSSD
> domain.
>
> This is not targeted that any other process/client on the same
> system as SSSD is running, is restricted/avoided to retrieve
> information from any other SSSD domains. If some non-root user
> wants to retrieves via NSS information from
emea.example.com ...
> even if this user got logged in via SSH and authenticated against
> pam_sss.so
domains=emea.examples.com. This user will not be prevent
> to retrieve information from
domains=id.example.com via NSS or so.
The questions is: is this mechanism intended to prevent authentication
attempts against other domains ?
Yes.
If pam_sss.so
domains=emea.examples.com is set only this sssd domain
should be used for authentication - not any other domain.
VPN-endpoint example:
OpenVPN is configured to use /etc/pam.d/it-dep for authentication (via
auth-pam plugin). it-dep file consists of:
"{auth,account} required pam_sss.so domains=it.example.com"
User "alice" exists in the
emea.examples.com domain, but not in
the
it.example.com domain. User "bob" exists in "it.example.com".
Expected behavior:
User "bob" is able to authenticate on that particular OpenVPN instance
which is configured to use PAM service "it-dep". User "alice"
authentication via OpenVPN would fail, since there is no user in the
"it.example.com" domain, and no further domains get queried for
authentication by pam_sss.so
A second OpenVPN instance on the same system could be configured with a
different PAM service "emea":
"{auth,account required pam_sss.so domains=emea.example.com,it.example.com"
... which would only grant access for "alice" and for "bob".
Do you see here any potential way to fake and break something?
I guess there are other scenarios, especially if those provide shell
access to that system. Obviously I do not want to introduce
something which could break any other usage scenarios - security wise.
If I would run the same example with multiple SSH daemons and grant
access to "alice" and "bob" via two different sssd domains which have
two different PAM services configured which authenticate explicitly
against dedicated sssd domains ... how could non-root users fake
something and gain privileges?
Or is it merely a way to avoid mistakes but not a security measure ?
No.
Thanks!
Daniel