From 2a1eae3d00a85adaf66f2660489d0cbc028f4c9b Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 28 Apr 2016 10:31:45 +0200 Subject: [PATCH] SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a local user If an IPA client uses the SSH integration and a local user logs in with SSH, the sss_ssh_authorizedkeys looks up their keys in the SSH responder, which doesn't find the user and returns ENOENT. The sss_ssh_authorizedkeys reports a failure on any error, including ENOENT which produced a confusing error message in the logs. This patch adds a new error code that handles users that are not found by SSSD but exist on the system and also special cases root with the same error code. Therefore, logging in as a local user no longer prints an error message. Resolves: https://fedorahosted.org/sssd/ticket/3003 --- src/responder/ssh/sshsrv_cmd.c | 22 ++++++++++++++++++---- src/sss_client/ssh/sss_ssh_authorizedkeys.c | 7 ++++++- src/util/util_errors.c | 1 + src/util/util_errors.h | 1 + 4 files changed, 26 insertions(+), 5 deletions(-) diff --git a/src/responder/ssh/sshsrv_cmd.c b/src/responder/ssh/sshsrv_cmd.c index af385fde8b382da513dbac29f496462a90c4c269..d1386719a588547c061d5588f14d80631b7e7a0f 100644 --- a/src/responder/ssh/sshsrv_cmd.c +++ b/src/responder/ssh/sshsrv_cmd.c @@ -67,7 +67,7 @@ sss_ssh_cmd_get_user_pubkeys(struct cli_ctx *cctx) cmd_ctx->name, cmd_ctx->domname ? cmd_ctx->domname : ""); if (strcmp(cmd_ctx->name, "root") == 0) { - ret = ENOENT; + ret = ERR_NON_SSSD_USER; goto done; } @@ -168,6 +168,20 @@ ssh_user_pubkeys_search_dp_callback(uint16_t err_maj, void *ptr); static errno_t +ssh_user_handle_not_found(const char *username) +{ + struct passwd *pwd; + + pwd = getpwnam(username); + if (pwd != NULL) { + DEBUG(SSSDBG_TRACE_ALL, "%s is a non-SSSD user\n", username); + return ERR_NON_SSSD_USER; + } + + return ENOENT; +} + +static errno_t ssh_user_pubkeys_search(struct ssh_cmd_ctx *cmd_ctx) { struct tevent_req *req; @@ -182,7 +196,7 @@ ssh_user_pubkeys_search(struct ssh_cmd_ctx *cmd_ctx) if (!cmd_ctx->domain) { DEBUG(SSSDBG_OP_FAILURE, "No matching domain found for [%s], fail!\n", cmd_ctx->name); - return ENOENT; + return ssh_user_handle_not_found(cmd_ctx->name); } /* refresh the user's cache entry */ @@ -256,10 +270,10 @@ ssh_user_pubkeys_search_next(struct ssh_cmd_ctx *cmd_ctx) return ssh_user_pubkeys_search(cmd_ctx); } - DEBUG(SSSDBG_OP_FAILURE, + DEBUG(SSSDBG_MINOR_FAILURE, "No attributes for user [%s] found.\n", cmd_ctx->name); - return ENOENT; + return ssh_user_handle_not_found(cmd_ctx->name); } cmd_ctx->result = res->msgs[0]; diff --git a/src/sss_client/ssh/sss_ssh_authorizedkeys.c b/src/sss_client/ssh/sss_ssh_authorizedkeys.c index 89eda2371363bf712afa7e717b93c6b69c5bf9bd..782a9f44379bff5346c896b3e03570720632c0be 100644 --- a/src/sss_client/ssh/sss_ssh_authorizedkeys.c +++ b/src/sss_client/ssh/sss_ssh_authorizedkeys.c @@ -86,7 +86,12 @@ int main(int argc, const char **argv) /* look up public keys */ ret = sss_ssh_get_ent(mem_ctx, SSS_SSH_GET_USER_PUBKEYS, pc_user, pc_domain, NULL, &ent); - if (ret != EOK) { + if (ret == ERR_NON_SSSD_USER) { + DEBUG(SSSDBG_MINOR_FAILURE, + "The user %s is valid, but not handled by sssd\n", pc_user); + ret = EXIT_SUCCESS; + goto fini; + } else if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "sss_ssh_get_ent() failed (%d): %s\n", ret, strerror(ret)); ERROR("Error looking up public keys\n"); diff --git a/src/util/util_errors.c b/src/util/util_errors.c index 59ae63ab8d6e834a772349b162bf282f9a4f1c72..0d955b558c1fd03b688c279cf7ff56a6c3e24c7e 100644 --- a/src/util/util_errors.c +++ b/src/util/util_errors.c @@ -84,6 +84,7 @@ struct err_string error_to_str[] = { { "Subdomain is inactive" }, /* ERR_SUBDOM_INACTIVE */ { "Account is locked" }, /* ERR_ACCOUNT_LOCKED */ { "AD renewal child failed" }, /* ERR_RENEWAL_CHILD */ + { "The user is not handled by SSSD" }, /* ERR_NON_SSSD_USER */ { "ERR_LAST" } /* ERR_LAST */ }; diff --git a/src/util/util_errors.h b/src/util/util_errors.h index 05791f2f08f107a8b4830b810b8826983763174f..99a61638a27ffcc3670a81962ae009b397b13753 100644 --- a/src/util/util_errors.h +++ b/src/util/util_errors.h @@ -106,6 +106,7 @@ enum sssd_errors { ERR_SUBDOM_INACTIVE, ERR_ACCOUNT_LOCKED, ERR_RENEWAL_CHILD, + ERR_NON_SSSD_USER, ERR_LAST /* ALWAYS LAST */ }; -- 2.4.11