-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/20/2010 06:24 AM, Eric Doutreleau wrote:
hi
i m using sssd sssd-1.2.2-19 on Fedora 13 machine and i m a bit puzzled
by how ldap_access_filter work
...
but when i want to log as test user with the good password i
can't log
i see in the secure log file
Aug 20 12:15:00 rst-9119 sshd[2888]: pam_sss(sshd:auth): authentication
success; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.159.21.234 user=test
Aug 20 12:15:00 rst-9119 sshd[2888]: pam_sss(sshd:account): Access
denied for user test: 6 (Permission denied)
is it supposed to work like that?
it s a bit different from the parameter pam_filter in the ldap.conf file.
Yes, this is behaving as expected. The ldap_access_filter is an
access-control filter, not a user-id filter. There's actually no value
in filtering out normal LDAP lookups (since if it's not denied by ACIs
on the server side, it would be trivial to look up with ldapsearch,
making it useless as a security measure).
Basically, functionality works like this:
ID lookups are unaffected. If the user's account is viewable in LDAP, it
will be returned by NSS
If a user attempts to log in, PAM goes through two steps: auth and
account. The former is authentication; this step proves that you are who
you say you are. Since you entered a valid password for this user, that
part of login completes successfully. "account" is access-control, as in
"Now that we know you're you, are you supposed to have access?". This is
where the ldap filter is used. We do another lookup against the LDAP
server with that filter included. If we still get the user back, then
the user is allowed in.
There are two reasons that we do this in the account step rather than
the auth step.
1) It's less confusing. They both return the same error code, so if it
happened in auth, it would look in /var/log/secure like they were
entering the wrong password or something. The admin trying to resolve
the helpdesk call would have to eliminate more possibilities.
2) It allows the admin to set up ldap_access_filter even when not using
LDAP authentication. For example, if using LDAP for identities and
Kerberos for authentication, ldap_access_filter can still be used in the
access-control step.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkxuZbIACgkQeiVVYja6o6Nq/gCfW+Fxp323HFihrNWRYNyKrwJo
WdYAnjjSsoDlbwYy+lpcah2cBLPar8fq
=eENg
-----END PGP SIGNATURE-----