[SSSD] [PATCH] Add option allowed_users to the PAM responder
Sumit Bose
sbose at redhat.com
Wed Feb 24 12:42:09 UTC 2010
Hi,
this patch should fix #392 by adding a new option to the PAM responder
which holds a list of allowed users.
bye,
Sumit
-------------- next part --------------
From 8b2bff856ce2b17652310daecf22b4dabd7def90 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 24 Feb 2010 13:05:38 +0100
Subject: [PATCH] Add option allowed_users to the PAM responder
---
src/confdb/confdb.h | 1 +
src/config/SSSDConfig.py | 1 +
src/config/etc/sssd.api.conf | 1 +
src/man/sssd.conf.5.xml | 13 ++++++++
src/responder/pam/pamsrv_cmd.c | 61 +++++++++++++++++++++++++++++++++++++++-
5 files changed, 76 insertions(+), 1 deletions(-)
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 06faa43..c5b3c0b 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -78,6 +78,7 @@
#define CONFDB_DEFAULT_PAM_FAILED_LOGIN_ATTEMPTS 0
#define CONFDB_PAM_FAILED_LOGIN_DELAY "offline_failed_login_delay"
#define CONFDB_DEFAULT_PAM_FAILED_LOGIN_DELAY 5
+#define CONFDB_PAM_ALLOWED_USERS "allowed_users"
/* Data Provider */
#define CONFDB_DP_CONF_ENTRY "config/dp"
diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py
index 2697c71..073525d 100644
--- a/src/config/SSSDConfig.py
+++ b/src/config/SSSDConfig.py
@@ -63,6 +63,7 @@ option_strings = {
'offline_credentials_expiration' : _('How long to allow cached logins between online logins (days)'),
'offline_failed_login_attempts' : _('How many failed logins attempts are allowed when offline'),
'offline_failed_login_delay' : _('How long (minutes) to deny login after offline_failed_login_attempts has been reached'),
+ 'allowed_users' : _('Comma separated list of users who are allowed to log in.'),
# [provider]
'id_provider' : _('Identity provider'),
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 14ec308..8a0ee01 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -33,6 +33,7 @@ pwfield = str, None, false
offline_credentials_expiration = int, None, false
offline_failed_login_attempts = int, None, false
offline_failed_login_delay = int, None, false
+allowed_users = string, None, false
[provider]
#Available provider types
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 171d261..24c5e8c 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -379,6 +379,19 @@
</para>
</listitem>
</varlistentry>
+
+ <varlistentry>
+ <term>allowed_users (string)</term>
+ <listitem>
+ <para>
+ A comma separated list of users who are allowed to
+ log in.
+ </para>
+ <para>
+ Default: EMPTY (all users are allowed to log in)
+ </para>
+ </listitem>
+ </varlistentry>
</variablelist>
</refsect2>
</refsect1>
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 8d67da1..ef46072 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -32,7 +32,56 @@
static void pam_reply(struct pam_auth_req *preq);
-static int extract_authtok(uint32_t *type, uint32_t *size, uint8_t **tok, uint8_t *body, size_t blen, size_t *c) {
+static errno_t check_if_user_is_allowed(struct cli_ctx *cctx, const char *user)
+{
+ int ret;
+ int i;
+ TALLOC_CTX *tmp_ctx;
+ char **allowed_user_list;
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(1, ("talloc_new failed.\n"));
+ return ENOMEM;
+ }
+
+ ret = confdb_get_string_as_list(cctx->rctx->cdb, tmp_ctx,
+ CONFDB_PAM_CONF_ENTRY,
+ CONFDB_PAM_ALLOWED_USERS,
+ &allowed_user_list);
+ if (ret == ENOENT || allowed_user_list == NULL ||
+ *allowed_user_list == NULL) {
+ DEBUG(9, ("Allowed user list is empty, access granted.\n"));
+ ret = EOK;
+ goto done;
+ }
+
+ if (ret != EOK) {
+ DEBUG(1, ("confdb_get_string_as_list failed.\n"));
+ goto done;
+ }
+
+ for (i = 0; allowed_user_list[i]; i++) {
+ DEBUG(9, ("Comparing [%s] with [%s].\n", user, allowed_user_list[i]));
+ if (strcmp(user, allowed_user_list[i]) == 0) {
+ DEBUG(3, ("User [%s] is in the list of allowed users, "
+ "access granted.\n", user));
+ ret = EOK;
+ goto done;
+ }
+ }
+
+ DEBUG(3, ("User [%s] not found in the list of allowed users, "
+ "access denied.\n", user));
+ ret = EPERM;
+
+done:
+ talloc_free(tmp_ctx);
+ return ret;
+}
+
+static int extract_authtok(uint32_t *type, uint32_t *size, uint8_t **tok,
+ uint8_t *body, size_t blen, size_t *c) {
uint32_t data_size;
if (blen-(*c) < 2*sizeof(uint32_t)) return EINVAL;
@@ -777,6 +826,12 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
goto done;
}
+ ret = check_if_user_is_allowed(cctx, pd->user);
+ if (ret != EOK) {
+ DEBUG(3, ("check_if_user_is_allowed failed for user [%s].\n", pd->user));
+ goto done;
+ }
+
/* now check user is valid */
if (pd->domain) {
for (dom = cctx->rctx->domains; dom; dom = dom->next) {
@@ -846,8 +901,12 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
done:
if (ret != EOK) {
switch (ret) {
+ case EPERM:
+ pd->pam_status = PAM_PERM_DENIED;
+ break;
case ENOENT:
pd->pam_status = PAM_USER_UNKNOWN;
+ break;
default:
pd->pam_status = PAM_SYSTEM_ERR;
}
--
1.6.6
More information about the sssd-devel
mailing list