[SSSD] [PATCHES] Better default logging of access denials

Sumit Bose sbose at redhat.com
Thu Jan 6 14:20:28 UTC 2011


Hi,

in trac ticket #751 it was requested to add syslog messages telling the
admin why access was denied for a specific user with LDAP access
provider.

The following two patches add this for the check based on the shadow
expire attribute and the authorized service check.

bye,
Sumit
-------------- next part --------------
From 31d15a60582cbd49e08533f594b9da23c2f66627 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 4 Jan 2011 17:54:19 +0100
Subject: [PATCH 1/2] Add syslog message to shadow access check

---
 src/providers/ldap/sdap_access.c |   20 ++++++++++++++------
 1 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
index 4767812..f031032 100644
--- a/src/providers/ldap/sdap_access.c
+++ b/src/providers/ldap/sdap_access.c
@@ -70,7 +70,7 @@ static struct tevent_req *sdap_account_expired_send(TALLOC_CTX *mem_ctx,
                                              struct tevent_context *ev,
                                              struct be_ctx *be_ctx,
                                              struct sdap_access_ctx *access_ctx,
-                                             const char *username,
+                                             struct pam_data *pd,
                                              struct ldb_message *user_entry);
 static errno_t sdap_access_service_recv(struct tevent_req *req,
                                         int *pam_status);
@@ -237,7 +237,7 @@ static errno_t select_next_rule(struct tevent_req *req)
         case LDAP_ACCESS_EXPIRE:
             subreq = sdap_account_expired_send(state, state->ev, state->be_ctx,
                                                state->access_ctx,
-                                               state->pd->user,
+                                               state->pd,
                                                state->user_entry);
             if (subreq == NULL) {
                 DEBUG(1, ("sdap_account_expired_send failed.\n"));
@@ -297,8 +297,9 @@ static void next_access_rule(struct tevent_req *req)
     return;
 }
 
+#define SHADOW_EXPIRE_MSG "Account expired according to shadow attributes"
 
-static errno_t sdap_account_expired_shadow(const char *username,
+static errno_t sdap_account_expired_shadow(struct pam_data *pd,
                                            struct ldb_message *user_entry,
                                            int *pam_status)
 {
@@ -307,7 +308,7 @@ static errno_t sdap_account_expired_shadow(const char *username,
     long sp_expire;
     long today;
 
-    DEBUG(6, ("Performing access shadow check for user [%s]\n", username));
+    DEBUG(6, ("Performing access shadow check for user [%s]\n", pd->user));
 
     val = ldb_msg_find_attr_as_string(user_entry, SYSDB_SHADOWPW_EXPIRE, NULL);
     if (val == NULL) {
@@ -325,6 +326,13 @@ static errno_t sdap_account_expired_shadow(const char *username,
     today = (long) (time(NULL) / (60 * 60 * 24));
     if (sp_expire > 0 && today > sp_expire) {
         *pam_status = PAM_ACCT_EXPIRED;
+
+        ret = pam_add_response(pd, SSS_PAM_SYSTEM_INFO,
+                               sizeof(SHADOW_EXPIRE_MSG),
+                               (const uint8_t *) SHADOW_EXPIRE_MSG);
+        if (ret != EOK) {
+            DEBUG(1, ("pam_add_response failed.\n"));
+        }
     } else {
         *pam_status = PAM_SUCCESS;
     }
@@ -340,7 +348,7 @@ static struct tevent_req *sdap_account_expired_send(TALLOC_CTX *mem_ctx,
                                              struct tevent_context *ev,
                                              struct be_ctx *be_ctx,
                                              struct sdap_access_ctx *access_ctx,
-                                             const char *username,
+                                             struct pam_data *pd,
                                              struct ldb_message *user_entry)
 {
     struct tevent_req *req;
@@ -365,7 +373,7 @@ static struct tevent_req *sdap_account_expired_send(TALLOC_CTX *mem_ctx,
         goto done;
     } else {
         if (strcasecmp(expire, LDAP_ACCOUNT_EXPIRE_SHADOW) == 0) {
-            ret = sdap_account_expired_shadow(username, user_entry,
+            ret = sdap_account_expired_shadow(pd, user_entry,
                                               &state->pam_status);
             if (ret != EOK) {
                 DEBUG(1, ("sdap_account_expired_shadow failed.\n"));
-- 
1.7.3.3

-------------- next part --------------
From 10fb3a4a6c4566d3d707c616c3ffc54172f20928 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 4 Jan 2011 18:26:44 +0100
Subject: [PATCH 2/2] Add syslog messages to authorized service access check

---
 src/providers/ldap/sdap_access.c |   32 +++++++++++++++++++++++++++++++-
 1 files changed, 31 insertions(+), 1 deletions(-)

diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
index f031032..ce2d535 100644
--- a/src/providers/ldap/sdap_access.c
+++ b/src/providers/ldap/sdap_access.c
@@ -796,6 +796,12 @@ struct sdap_access_service_ctx {
     int pam_status;
 };
 
+#define AUTHR_SRV_MISSING_MSG "Authorized service attribute missing, " \
+                              "access denied"
+#define AUTHR_SRV_DENY_MSG "Access denied by authorized service attribute"
+#define AUTHR_SRV_NO_MATCH_MSG "Authorized service attribute has " \
+                               "no matching rule, access denied"
+
 static struct tevent_req *sdap_access_service_send(
         TALLOC_CTX *mem_ctx,
         struct tevent_context *ev,
@@ -820,6 +826,14 @@ static struct tevent_req *sdap_access_service_send(
     el = ldb_msg_find_element(user_entry, SYSDB_AUTHORIZED_SERVICE);
     if (!el || el->num_values == 0) {
         DEBUG(1, ("Missing authorized services. Access denied\n"));
+
+        ret = pam_add_response(pd, SSS_PAM_SYSTEM_INFO,
+                               sizeof(AUTHR_SRV_MISSING_MSG),
+                               (const uint8_t *) AUTHR_SRV_MISSING_MSG);
+        if (ret != EOK) {
+            DEBUG(1, ("pam_add_response failed.\n"));
+        }
+
         ret = EOK;
         goto done;
     }
@@ -831,8 +845,17 @@ static struct tevent_req *sdap_access_service_send(
             /* This service is explicitly denied */
             state->pam_status = PAM_PERM_DENIED;
             DEBUG(4, ("Access denied by [%s]\n", service));
+
+            ret = pam_add_response(pd, SSS_PAM_SYSTEM_INFO,
+                                   sizeof(AUTHR_SRV_DENY_MSG),
+                                   (const uint8_t *) AUTHR_SRV_DENY_MSG);
+            if (ret != EOK) {
+                DEBUG(1, ("pam_add_response failed.\n"));
+            }
+
             /* A denial trumps all. Break here */
-            break;
+            ret = EOK;
+            goto done;
 
         } else if (strcasecmp(pd->service, service) == 0) {
             /* This service is explicitly allowed */
@@ -855,6 +878,13 @@ static struct tevent_req *sdap_access_service_send(
         DEBUG(4, ("No matching service rule found\n"));
     }
 
+    ret = pam_add_response(pd, SSS_PAM_SYSTEM_INFO,
+                           sizeof(AUTHR_SRV_NO_MATCH_MSG),
+                           (const uint8_t *) AUTHR_SRV_NO_MATCH_MSG);
+    if (ret != EOK) {
+        DEBUG(1, ("pam_add_response failed.\n"));
+    }
+
     ret = EOK;
 
 done:
-- 
1.7.3.3



More information about the sssd-devel mailing list