Hello,
I am in the process of doing a proof-of-concept to use FreeIPA as a
backend for the tac_plus (tacacs+) daemon.
PAM authentication was already built in to the application and works
with FreeIPA. I have added some code to tac_plus to also use the
account section of the pam file and I have a question regarding (maybe
this is PAM specific?) how pam_sss works with HBAC.
I have done the following in FreeIPA:
1. Created a DNS entry for my device: pix.beta.local <-> 192.168.0.1
2. Disabled the 'allow_all' HBAC rule
3. Created an HBAC rule tacacs with the following:
a) who: user group: ciscoadmin - user mike is part of ciscoadmin
b) Accessing: hosts: pix.beta.local
c) via service: tac_plus
d) from: any host
I can successfully login (auth) to a Cisco ASA via the tac_plus daemon
using PAM, but accounting is giving permission denied.
Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:auth):
authentication success; logname=root uid=0 euid=0 tty= ruser=
rhost=192.168.0.1 user=mike
Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:account):
Access denied for user mike: 6 (Permission denied)
NOTE: I have hardcoded the rhost setting with pam_set_item(pam_handle,
PAM_RHOST, "192.168.0.1")
I see the following in my audit.log
type=USER_AUTH msg=audit(1346184814.834:168): user pid=2217 uid=0
auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-
s0:c0.c1023 msg='op=PAM:authentication acct="mike" exe="/home/tacacs/
tacacs+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1
addr=192.168.0.1 terminal=pts/0 res=success'
type=USER_ACCT msg=audit(1346184814.845:169): user pid=2217 uid=0
auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-
s0:c0.c1023 msg='op=PAM:accounting acct="mike" exe="/home/tacacs/tacacs
+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1 addr=192.168.0.1
terminal=pts/0 res=failed'
It seems that the machine the daemon is running on
(ipaserver.beta.local) is being used for the HBAC rule (at least that
is what is looks like from the dirsrv access log)
[28/Aug/2012:16:13:33 -0400] conn=29 op=45 SRCH
base="cn=hbac,dc=beta,dc=local" scope=2
filter="(&(objectClass=ipaHBACRule)(ipaEnabledFlag=TRUE)(|
(hostCategory=all)
(memberHost
=
fqdn
=ipaserver.beta.local,cn=computers,cn=accounts,dc=beta,dc=local)))"
attrs="objectClass cn ipaUniqueID ipaEnabledFlag accessRuleType
memberUser userCategory memberService serviceCategory sourceHost
sourceHostCategory externalHost memberHost hostCategory"
If I add the host (ipaserver.beta.local) the daemon is running on to
the 'Accessing' list or enable the 'allow_all' rule, I am able to login.
NOTE: ipaserver.beta.local is also the IPA server (running all ipa
services)
My questions:
How is 'hostname' & 'addr' in the audit.log being generated? Is PAM
sending these messages to the log (or is this something auditd
specific)? Does one or both of them come via the rhost variable from
pam_set_item?
Is it possible to pass 'hostname' or 'addr' as the variable for
checking the HBAC rule?
Thanks,
Mike
Show replies by date