restrict sudo su -
by Jannis Mann
Hi,
I've implemented sssd with id, auth and access provider as ldap. So I am
using a binding account and didn't joined the domain with the server.
In general everything works. Only members of mentioned SG within the
sssd.conf can login to the server, just as I wish to.
However, as sudo user I can run something as following
sudo su - UserThatIsNotAllowed
So I (a sudo user) can switch to any user that is within the search base
I've specified in the sssd.conf
But these users are not allowed to use the server.
I understand that not the user himself is logging in but I actually don't
want sudo users to be able to switch to users that aren't allowed on the
server.
I'd like that it is only allowed to switch to users that are allowed on the
server on local accounts of course.
Is this a normal behaviour? Can it be changed?
Thank you!
Jannis
4 years, 3 months
sssd-ldap, ppolicy, ldap_account_expire_policy with SSHD
by Chris Paul
Is it possible to use sssd-ldap (1.16.4-21, CentOS 7.7) with FreeIPA server (4.6.5-11, CentOS 7.7) and have password policy (ldap_access_order=ppolicy) and also account expiration (ldap_account_expire_policy = ipa)? It’s implied that IPA works as why else would “ipa” be an option to ldap_account_expire_policy?
I’m trying this in my lab; can’t get it to work.
Also not perfectly clear from the manual is how to use pwd_expire_policy_reject, pwd_expire_policy_warn, pwd_expire_policy_renew. In the manual, it is written: "Also 'ldap_pwd_policy' must be set to an appropriate password policy.”
What should ldap_pwd_policy be set to for an IPA server?
The docs also say, “for ldap_account_expire_policy=rhds, ipa, 389ds: use the value of ldap_ns_account_lock to check if access is allowed or not.”
On my FreeIPA server, I don’t see the ldap_ns_account_lock attribute set for expired accounts.
Either my reading is deficient or the documentation is. I’d be happy to contribute if I understood. Does anyone have any tips?
thanks,
Chris Paul
4 years, 3 months
No group information displaying and slow persformance while implementing sssd ldap authentication
by capricorn cap
Hi!
I am trying to authentticate my ubuntu users via Active directory and also autofs mounting. May be I am doing something wrong or missing some key attributes but I checked it from last couple of days and decided to write.
I have configured my sssd.conf and using ldaps for communication. After troubleshooting my issue now I am able to get the result for my output like getent passwd AD-username and id AD-username
I am logged on to ubuntu machine with local account and running id AD-Username and getent passwd AD-username and it takes ages to get reply back.
uid=1348(AD-username) gid=100(users) groups=100(users)
when I trun getend group groupname then nothing happens.
I have attached my sssd.conf file.
I am using Ubuntu 18.04
Version: 1.16.1-1ubuntu1.4
Version: 1.16.1-1ubuntu1.4
[sssd]
config_file_version = 2
services = nss, pam, sudo, autofs
domains = mycompany.local
default_domain_suffix = mycompany.local
[nss]
debug_level = 9
filter_groups = root
filter_users = root
reconnection_retries = 3
#If want override the shell for all users uncomment follow line
#override_shell = /bin/bash
[pam]
debug_level = 9
[sudo]
debug_level = 3
[autofs]
[domain/mycompany.local]
debug_level = 9
enumerate = false
case_sensitive = false
cache_credentials = true
min_id = 100
#ldap_id_mapping = True
#ldap_user_primary_group = primaryGroupID
case_sensitive = false
### --- Providers --- ###
id_provider = ldap
auth_provider = ldap
access_provider = simple
chpass_provider = ldap
### --- LDAP GENERAL --- ###
ldap_id_use_start_tls = false
ldap_schema = rfc2307
ldap_tls_cacertdir = /etc/ldap/cacerts
#ldap_tls_cacert = /etc/ssl/dc01.cer
### LDAP user search settings ###
ldap_user_search_base = DC=mycompany,DC=local
# LDAP group search settings
ldap_group_search_base = DC=mycompany,DC=local
# LDAP Class settings
### --- LDAP Class settings --- ####
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_gecos = displayName
#ldap_user_principal = userPrincipalName
ldap_user_home_directory = unixHomeDirectory
ldap_user_member_of = memberOf
ldap_group_object_class = group
ldap_group_name = sAMAccountName
ldap_group_member = memberUid
ldap_network_timeout = 3
#ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount))
ad_server = dc01.mycompany.local
### --- LDAP connection settings --- ###
ldap_uri = ldaps://dc01.mycompany.local:636
ldap_default_bind_dn = CN=serviceaccount,OU=ServiceAccounts,DC=mycompany,DC=local
ldap_default_authtok_type = password
ldap_default_authtok = mypassword
# Access settings via simple
# simple_allow_groups = lusers
simple_allow_groups = Users
## Temp TEst
ldap_opt_timeout = 20
dns_resolver_timeout = 10
### AutoFS
autofs_provider = ldap
ldap_autofs_entry_key = cn
ldap_autofs_entry_object_class = nisObject
ldap_autofs_entry_value = nisMapEntry
ldap_autofs_map_name = nisMapName
ldap_autofs_map_object_class = nisMap
ldap_autofs_search_base = ou=automount,DC=mycompany,dc=local
Thanks
4 years, 3 months
Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied
by Michael Barkdoll
Hi, my sssd is service is crashing on CentOS 8 it looks like something is changing the file permissions on /var/lib/sss/db/config.ldb
$ systemctl status sssd.service
● sssd.service - System Security Services Daemon
Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Mon 2020-01-13 16:30:16 CST; 15h ago
Process: 874 ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER} (code=exited, status=1/FAILURE)
Main PID: 874 (code=exited, status=1/FAILURE)
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876393 2020) [sssd[nss]] [ldb] (0x0020): Unable to open tdb '/var/lib/sss/db/config.ldb': Permission denied
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876628 2020) [sssd[nss]] [ldb] (0x0020): Failed to connect to '/var/lib/sss/db/config.ldb' with backend 'tdb': Unable to >
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876641 2020) [sssd[nss]] [confdb_init] (0x0010): Unable to open config database [/var/lib/sss/db/config.ldb]
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: (Mon Jan 13 16:30:16:876654 2020) [sssd[nss]] [server_setup] (0x0010): The confdb initialization failed
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[874]: Exiting the SSSD. Could not restart critical service [nss].
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[be[ad.siu.edu]][943]: Shutting down
Jan 13 16:30:16 sp20client.ad.siu.edu sssd[be[implicit_files]][942]: Shutting down
Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: sssd.service: Main process exited, code=exited, status=1/FAILURE
Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: sssd.service: Failed with result 'exit-code'.
Jan 13 16:30:16 sp20client.ad.siu.edu systemd[1]: Failed to start System Security Services Daemon.
something is changing the file permissions of file /var/lib/sss/db/config.ldb to:
$ ls -la /var/lib/sss/db/config.ldb
-rw-------. 1 1767801122 1767800513 1286144 Jan 13 16:30 /var/lib/sss/db/config.ldb
$
$ id 1767801122
id: ‘1767801122’: no such user
$ getent passwd 1767801122
$ echo $?
2
$
$ systemctl restart sssd
$ ls -lan /var/lib/sss/db/config.ldb
-rw-------. 1 0 0 1286144 Jan 14 08:00 /var/lib/sss/db/config.ldb
$ ls -la /var/lib/sss/db/config.ldb
-rw-------. 1 root root 1286144 Jan 14 08:00 /var/lib/sss/db/config.ldb
$
I've joined this machine to an Active Directory Domain using packages:
realmd_prereq_packages:
- realmd
- sssd
- adcli
- oddjob
- oddjob-mkhomedir
- samba-common
- samba-common-tools
- krb5-workstation
realm join -vvvv --computer-ou="ou=Computers,dc=sample,dc=college,dc=edu" --user-principal=nfs/sp20client.sample.college.edu(a)AD.SIU.EDU --os-name=CentOS --user=account SAMPLE.COLLEGE.EDU
Things have been odd with the sssd authentication in other ways as well. One time when I tried to su root it wasn't working until I rebooted CentOS 8.
Here is my sssd.conf:
[sssd]
domains = sample.college.edu
config_file_version = 2
services = nss, pam
#default_domain_suffix = SAMPLE.COLLEGE.EDU
[domain/sample.college.edu]
ad_domain = sample.college.edu
krb5_realm = SAMPLE.COLLEGE.EDU
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
# The following pulls ldap uid,gid from AD
#ldap_id_mapping = False
# The following uses xxxxxxx(a)sample.college.edu for login name if default_domain_suffix is not set.
#use_fully_qualified_names = True
# The following allows xxxxxxx to login with default_domain_suffix is not set.
use_fully_qualified_names = False
fallback_homedir = /home/%u@%d
access_provider = ad
subdomain_inherit = ignore_group_members, ldap_purge_cache_timeout
ignore_group_members = True
krb5_lifetime = 7h
krb5_renewable_lifetime = 7d
krb5_renew_interval = 60s
dyndns_update = true
dyndns_refresh_interval = 60
dyndns_update_ptr = true
dyndns_ttl = 60
debug_level = 9
dyndns_iface = enp0s3
#dyndns_auth = none
dyndns_server = 131.x.x.x
ad_hostname = sp20client.sample.college.edu
4 years, 3 months
Is there a way to disable Mozilla NSS?
by Sad Clouds
When I build sssd from source, I specify "--with-crypto=libcrypto" during configure stage, however during the build and install stage, sssd is linked with both libcrypto.so and libnss3.so+libnssutil3.so
Is there a way to completely disable all Mozilla NSS libraries with sssd?
4 years, 3 months
Provider clarifications
by Lars Francke
Hi,
I've got a question that seems pretty trivial to me so it feels like I'm
missing something obvious.
I know that there are different provider types: id, auth, chpass, access
(and maybe others)
But what I don't quite understand is what they actually do.
The documentation says:
id -> "The identification provider"
auth -> "The authentication provider"
access -> "The access control provider"
chpass -> "The provider which should handle change password operations for
the domain."
(The first three are not very helpful ;-) )
I understand chpass and I can make a guess about the others but I'm not
sure:
id: Just returns information about some object
auth: Validates credentials for an object
access: Checks authorization?
But I'm very vague on the details. Is there any more information I can
refer to? What are the differences/can anyone point me at an API
description or some other documentation?
One very specific question for example: What does the krb5 auth mean? Does
it retrieve a ticket and try to decrypt that?
Thank you!
Cheers,
Lars
4 years, 3 months
managing authorization without AD/LDAP
by francois-oss@avalenn.eu
Hello,
I have a use case of ssh authentication to some server which for
various reasons (one of them being network isolation) cannot access to
Directory.
With ssh I can use ssh certificates to do the authentication part
"offline" without the need for the server to access any centralized
service.
But I still need LDAP connexion to get directory information (numeric
uid, groups, etc.)
I would like a mechanic which allows to transmit this information
along with the connexion initiation.
For example the ssh certificate could have some extension options like
uid(a)example.com=1234 and groups(a)example.com=wheel,admin,mygroup and
this certificate would create the corresponding entries in SSSD in
passwd and groups databases which would be valid for the duration of
the certificate.
Do anyone knows of such a setup or have any pointer to similar ideas ?
Do you think it would be possible for SSSD to be extended to support
this use case ? Would it be easy to implement ? (a bunch of
AuthorizedKeyCommand shell scripts interacting with SSSD D-Bus
interface would suit me)
François
4 years, 3 months
Realm permit with bogus AD domain disallows any subsequent legal login
by Spike White
All,
Another engineer fat-fingered a ‘realm permit’ invocation and discovered
this problem. Brought this to my attention. (This is on RHEL7).
We are using the simple access provider in sssd.conf. So we have
simple_allow_groups and simple_allow_users lines in sssd.conf:
Example allow lines:
simple_allow_groups = amerlinuxeng(a)amer.company.com,
amerlinuxengtfssupt(a)amer.company.com, amerlinuxsup(a)amer.company.com,
amerlnxsvcdelauttfs(a)amer.company.com, fnms_ops(a)amer.company.com,
gbllinuxsuppw(a)amer.company.com, pptsupportpac(a)amer.company.com,
scheduling_global(a)amer.company.com, unv_legato_admins(a)amer.company.com,
zabbix-support(a)amer.company.com, apaclinuxeng(a)apac.company.com,
apaclinuxsup(a)apac.company.com, emealinuxeng(a)emea.company.com,
emealinuxsup(a)emea.company.com, vra_users(a)amer.company.com
simple_allow_users = processdaceaccount(a)amer.company.com,
processdisco05(a)amer.company.com, processdisco06a(a)amer.company.com,
processehcprofiler(a)amer.company.com, processfoglight(a)amer.company.com,
svc_prdprofoglight01(a)amer.company.com, john2_nolan(a)emea.company.com
<john2_nolan(a)emea.dell.com>
amer.company.com and emea.company.com are legal AD child domains.
If we mistakenly do a ‘realm permit’ for any bogus AD domain, it breaks any
subsequent legal logins.
Examples:
realm permit processdaceaccount(a)us.company.com
<processdaceaccount(a)us.dell.com>
realm permit -g vra_users(a)us.company.com <vra_users(a)us.dell.com>
If I attempt to log in now, the authentication fails. (& my login is
legal – I’m a member of a couple of these permitted AD groups.)
Here’s the log lines from /var/log/secure:
Jan 9 11:21:54 spikev2stest01 sshd[68160]: pam_sss(sshd:auth):
authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=
spikev2stest01.us.company.com user=admspike_white
Jan 9 11:21:54 spikev2stest01 sshd[68160]: Accepted password for
admspike_white from 10.179.253.197 port 47334 ssh2
Jan 9 11:21:54 spikev2stest01 sshd[68160]: pam_sss(sshd:account): Access
denied for user admspike_white: 6 (Permission denied)
Jan 9 11:21:54 spikev2stest01 sshd[68160]: fatal: Access denied for user
admspike_white by PAM account configuration
So the PAM auth phase still succeeds, but now the access phase fails. This
is for a legal login.
If I remove the bogus entries, access of legal logins again succeeds.
realm permit -x processdaceaccount(a)us.company.com
<processdaceaccount(a)us.dell.com>
realm permit -g -x vra_users(a)us.company.com <vra_users(a)us.dell.com>
Now my legal login again succeeds.
Here’s the auth and access section of the /etc/pam.d/system-auth file:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
# OL7 version. Per Company I/T's stated policy for service & process
accounts, lock-out time = 30 mins
auth required pam_tally2.so deny=5 onerr=fail unlock_time=1800
auth sufficient pam_sss.so forward_pass
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account [default=ignore success=ok perm_denied=bad user_unknown=ignore]
pam_sss.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
Spike
4 years, 3 months
Exclude users who will become root from SSSD control
by Soham Chakraborty
Hi all,
I have a requirement where my client is requesting to exclude all users who will become root (by sudo) out of SSSD control.
The way I think it is possible is to not add those users into the sudo rule. Or create those users on the linux side and not keep them on AD at all. Has anyone encountered something like this?
I am trying to gather information as to why they need this. In the meantime if anyone knows how to achieve this, it would be much appreciated.
Thanks,
4 years, 3 months