[SSSD] [PATCH] Add option allowed_users to the PAM responder

Sumit Bose sbose at redhat.com
Wed Feb 24 12:42:09 UTC 2010


Hi,

this patch should fix #392 by adding a new option to the PAM responder
which holds a list of allowed users.

bye,
Sumit
-------------- next part --------------
From 8b2bff856ce2b17652310daecf22b4dabd7def90 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 24 Feb 2010 13:05:38 +0100
Subject: [PATCH] Add option allowed_users to the PAM responder

---
 src/confdb/confdb.h            |    1 +
 src/config/SSSDConfig.py       |    1 +
 src/config/etc/sssd.api.conf   |    1 +
 src/man/sssd.conf.5.xml        |   13 ++++++++
 src/responder/pam/pamsrv_cmd.c |   61 +++++++++++++++++++++++++++++++++++++++-
 5 files changed, 76 insertions(+), 1 deletions(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 06faa43..c5b3c0b 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -78,6 +78,7 @@
 #define CONFDB_DEFAULT_PAM_FAILED_LOGIN_ATTEMPTS 0
 #define CONFDB_PAM_FAILED_LOGIN_DELAY "offline_failed_login_delay"
 #define CONFDB_DEFAULT_PAM_FAILED_LOGIN_DELAY 5
+#define CONFDB_PAM_ALLOWED_USERS "allowed_users"
 
 /* Data Provider */
 #define CONFDB_DP_CONF_ENTRY "config/dp"
diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 2697c71..073525d 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -63,6 +63,7 @@ option_strings = {
     'offline_credentials_expiration' : _('How long to allow cached logins between online logins (days)'),
     'offline_failed_login_attempts' : _('How many failed logins attempts are allowed when offline'),
     'offline_failed_login_delay' : _('How long (minutes) to deny login after offline_failed_login_attempts has been reached'),
+    'allowed_users' : _('Comma separated list of users who are allowed to log in.'),
 
     # [provider]
     'id_provider' : _('Identity provider'),
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 14ec308..8a0ee01 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -33,6 +33,7 @@ pwfield = str, None, false
 offline_credentials_expiration = int, None, false
 offline_failed_login_attempts = int, None, false
 offline_failed_login_delay = int, None, false
+allowed_users = string, None, false
 
 [provider]
 #Available provider types
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 171d261..24c5e8c 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -379,6 +379,19 @@
                         </para>
                     </listitem>
                 </varlistentry>
+
+                <varlistentry>
+                    <term>allowed_users (string)</term>
+                    <listitem>
+                        <para>
+                            A comma separated list of users who are allowed to
+                            log in.
+                        </para>
+                        <para>
+                            Default: EMPTY (all users are allowed to log in)
+                        </para>
+                    </listitem>
+                </varlistentry>
             </variablelist>
         </refsect2>
     </refsect1>
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 8d67da1..ef46072 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -32,7 +32,56 @@
 
 static void pam_reply(struct pam_auth_req *preq);
 
-static int extract_authtok(uint32_t *type, uint32_t *size, uint8_t **tok, uint8_t *body, size_t blen, size_t *c) {
+static errno_t check_if_user_is_allowed(struct cli_ctx *cctx, const char *user)
+{
+    int ret;
+    int i;
+    TALLOC_CTX *tmp_ctx;
+    char **allowed_user_list;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(1, ("talloc_new failed.\n"));
+        return ENOMEM;
+    }
+
+    ret = confdb_get_string_as_list(cctx->rctx->cdb, tmp_ctx,
+                                    CONFDB_PAM_CONF_ENTRY,
+                                    CONFDB_PAM_ALLOWED_USERS,
+                                    &allowed_user_list);
+    if (ret == ENOENT || allowed_user_list == NULL ||
+                        *allowed_user_list == NULL) {
+        DEBUG(9, ("Allowed user list is empty, access granted.\n"));
+        ret = EOK;
+        goto done;
+    }
+
+    if (ret != EOK) {
+        DEBUG(1, ("confdb_get_string_as_list failed.\n"));
+        goto done;
+    }
+
+    for (i = 0; allowed_user_list[i]; i++) {
+        DEBUG(9, ("Comparing [%s] with [%s].\n", user, allowed_user_list[i]));
+        if (strcmp(user, allowed_user_list[i]) == 0) {
+            DEBUG(3, ("User [%s] is in the list of allowed users, "
+                      "access granted.\n", user));
+            ret = EOK;
+            goto done;
+        }
+    }
+
+    DEBUG(3, ("User [%s] not found in the list of allowed users, "
+              "access denied.\n", user));
+    ret = EPERM;
+
+done:
+    talloc_free(tmp_ctx);
+    return ret;
+}
+
+static int extract_authtok(uint32_t *type, uint32_t *size, uint8_t **tok,
+                           uint8_t *body, size_t blen, size_t *c) {
     uint32_t data_size;
 
     if (blen-(*c) < 2*sizeof(uint32_t)) return EINVAL;
@@ -777,6 +826,12 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
         goto done;
     }
 
+    ret = check_if_user_is_allowed(cctx, pd->user);
+    if (ret != EOK) {
+        DEBUG(3, ("check_if_user_is_allowed failed for user [%s].\n", pd->user));
+        goto done;
+    }
+
     /* now check user is valid */
     if (pd->domain) {
         for (dom = cctx->rctx->domains; dom; dom = dom->next) {
@@ -846,8 +901,12 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
 done:
     if (ret != EOK) {
         switch (ret) {
+        case EPERM:
+            pd->pam_status = PAM_PERM_DENIED;
+            break;
         case ENOENT:
             pd->pam_status = PAM_USER_UNKNOWN;
+            break;
         default:
             pd->pam_status = PAM_SYSTEM_ERR;
         }
-- 
1.6.6



More information about the sssd-devel mailing list