[SSSD] daemon using sss (PAM) for auth / account

Michael Mercier mmercier at gmail.com
Wed Aug 29 00:43:12 UTC 2012


Hello,

I am in the process of doing a proof-of-concept to use FreeIPA as a  
backend for the tac_plus (tacacs+) daemon.
PAM authentication was already built in to the application and works  
with FreeIPA.  I have added some code to tac_plus to also use the  
account section of the pam file and I have a question regarding (maybe  
this is PAM specific?) how pam_sss works with HBAC.

I have done the following in FreeIPA:

1.  Created a DNS entry for my device:  pix.beta.local <-> 192.168.0.1
2.  Disabled the 'allow_all' HBAC rule
3.  Created an HBAC rule tacacs with the following:
  a) who: user group: ciscoadmin - user mike is part of ciscoadmin
  b) Accessing: hosts: pix.beta.local
  c) via service: tac_plus
  d) from: any host

I can successfully login (auth) to a Cisco ASA via the tac_plus daemon  
using PAM, but accounting is giving permission denied.
Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:auth):  
authentication success; logname=root uid=0 euid=0 tty= ruser=  
rhost=192.168.0.1 user=mike
Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:account):  
Access denied for user mike: 6 (Permission denied)

NOTE: I have hardcoded the rhost setting with pam_set_item(pam_handle,  
PAM_RHOST, "192.168.0.1")

I see the following in my audit.log
type=USER_AUTH msg=audit(1346184814.834:168): user pid=2217 uid=0  
auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0- 
s0:c0.c1023 msg='op=PAM:authentication acct="mike" exe="/home/tacacs/ 
tacacs+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1  
addr=192.168.0.1 terminal=pts/0 res=success'
type=USER_ACCT msg=audit(1346184814.845:169): user pid=2217 uid=0  
auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0- 
s0:c0.c1023 msg='op=PAM:accounting acct="mike" exe="/home/tacacs/tacacs 
+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1 addr=192.168.0.1  
terminal=pts/0 res=failed'

It seems that the machine the daemon is running on  
(ipaserver.beta.local) is being used for the HBAC rule (at least that  
is what is looks like from the dirsrv access log)
[28/Aug/2012:16:13:33 -0400] conn=29 op=45 SRCH  
base="cn=hbac,dc=beta,dc=local" scope=2  
filter="(&(objectClass=ipaHBACRule)(ipaEnabledFlag=TRUE)(| 
(hostCategory=all) 
(memberHost 
= 
fqdn 
=ipaserver.beta.local,cn=computers,cn=accounts,dc=beta,dc=local)))"  
attrs="objectClass cn ipaUniqueID ipaEnabledFlag accessRuleType  
memberUser userCategory memberService serviceCategory sourceHost  
sourceHostCategory externalHost memberHost hostCategory"

If I add the host (ipaserver.beta.local) the daemon is running on to  
the 'Accessing' list or enable the 'allow_all' rule, I am able to login.

NOTE: ipaserver.beta.local is also the IPA server (running all ipa  
services)

My questions:

How is 'hostname' & 'addr' in the audit.log being generated?  Is PAM  
sending these messages to the log (or is this something auditd  
specific)? Does one or both of them come via the rhost variable from  
pam_set_item?
Is it possible to pass 'hostname' or 'addr' as the variable for  
checking the HBAC rule?

Thanks,
Mike






More information about the sssd-devel mailing list