[SSSD] bug in sss_ssh_authorizedkeys
Jan Cholasta
jcholast at redhat.com
Mon Jul 16 12:03:32 UTC 2012
Hi,
it might work just fine, but it is a hack, not a proper OpenSSH-LPK
support implementation. That would require more extensive changes to the
code and also must not break IPA (which your change does).
If you have an existing OpenSSH-LPK setup, you have to stick with
ssh-ldap-wrapper, at least until proper OpenSSH-LPK support is
implemented in SSSD.
Honza
Dne 16.7.2012 11:34, Franky Van Liedekerke napsal(a):
> Hi,
>
> ok, but then the question remains:
>
> with the small change I've done, it seems to work just fine for reading
> openssh keys from ldap and returning them to sshd as expected.
> If the code currently supports only IPA, it seems that with a small
> change it then supports openssh-lpk keys just fine then also, no? Or is
> this not the intention and are people expected to switch to the new
> format (which would be very cumbersome for transition scenarios)?
>
> Franky
>
> On 2012-07-16 11:15, Jan Cholasta wrote:
>> Hi,
>>
>> that's because the output of sss_ssh_authorizedkeys is generated
>> using this code, so it is always executed.
>>
>> Honza
>>
>> Dne 13.7.2012 20:11, Franky Van Liedekerke napsal(a):
>>> If that is the case, why am I entering that code section when reading
>>> keys from LDAP? Maybe it is not the intention, but
>>> sss_ssh_authorizedkeys.c uses that section.
>>>
>>> Franky
>>>
>>> On Fri, 13 Jul 2012 17:22:18 +0200
>>> Jan Cholasta <jcholast at redhat.com> wrote:
>>>
>>>> This code is for writing public keys, not for reading them from LDAP.
>>>>
>>>> Dne 13.7.2012 17:18, Franky Van Liedekerke napsal(a):
>>>>> That seems weird to me, as the code clearly specifies
>>>>>
>>>>> "case SSS_SSH_FORMAT_RAW:"
>>>>> and
>>>>> "case SSS_SSH_FORMAT_OPENSSH:"
>>>>>
>>>>> in src/util/sss_ssh.c
>>>>> And everywhere else SSS_SSH_FORMAT_OPENSSH is used as the format
>>>>> (doesn't seem to be possible to change this via an option).
>>>>> So imho the code does support it just fine (as I've proven with my
>>>>> little patch), but has been incorrectly adapted to work for base64
>>>>> encoded keys while the format stays SSS_SSH_FORMAT_OPENSSH.
>>>>> My guess is: the format should be made configurable and then for
>>>>> openssh just return what's in ldap ...
>>>>>
>>>>> Franky
>>>>>
>>>>> On 2012-07-13 16:55, Jan Cholasta wrote:
>>>>>> Hi,
>>>>>>
>>>>>> you have the public keys in LDAP in wrong format. SSSD SSH support
>>>>>> is currently limited only to IPA, which stores only the raw public
>>>>>> key blob (see RFC 4253 section 6.6), as opposed to OpenSSH-LPK,
>>>>>> which stores public keys in OpenSSH format ("[options] <public key
>>>>>> algorithm
>>>>>> name> <base-64 encoded raw public key blob> [comment]", see
>>>>>> name> sshd(8)).
>>>>>>
>>>>>> So, you can either have public keys in LDAP in IPA format (you can
>>>>>> set them using "ipa user-mod" and "ipa host-mod" commands) and use
>>>>>> SSSD to provide the OpenSSH-LDAP link, or you can have public keys
>>>>>> in LDAP in OpenSSH format and use ssh-ldap-wrapper to provide the
>>>>>> OpenSSH-LDAP link. Anything else is not supported ATM.
>>>>>>
>>>>>> Honza
>>>>>>
>>>>>> Dne 13.7.2012 15:25, liedekef at telenet.be napsal(a):
>>>>>>> Btw,
>>>>>>>
>>>>>>> I managed to get things working by making sure the function
>>>>>>> "sss_ssh_format_pubkey" just returns the value of the found
>>>>>>> public key, not base64 encoded (which it should not be for
>>>>>>> openssh formatted keys). So there the "return pubkey->data"
>>>>>>> statement worked just fine, skipping the whole
>>>>>>> sss_ssh_get_pubkey_algorithm logic and all. I wonder why the
>>>>>>> pubkey algoritm should be searched for anyway, ssh is capable of
>>>>>>> interpreting this all by itself.
>>>>>>>
>>>>>>> Franky
>>>>>>>
>>>>>>> On 2012-07-13 15:10, liedekef at telenet.be wrote:
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> I'm trying to use the experimental feature
>>>>>>>> "sss_ssh_authorizedkeys" on a up-to-date fedora 17. Now it seems
>>>>>>>> everytime I call that binary, it returns the non-descriptive
>>>>>>>> error "Not enough memory". Using my basic C-skills, I downloaded
>>>>>>>> the latest SSSD sources (1.8.4) and recompiled them myself: the
>>>>>>>> result was the same. Adding some print-statements, I stumbled
>>>>>>>> upon this function sss_ssh_get_pubkey_algorithm in
>>>>>>>> src/util/sss_ssh.c:
>>>>>>>>
>>>>>>>> char *
>>>>>>>> sss_ssh_get_pubkey_algorithm(TALLOC_CTX *mem_ctx,
>>>>>>>> struct sss_ssh_pubkey *pubkey)
>>>>>>>> {
>>>>>>>> size_t c = 0;
>>>>>>>> uint32_t algo_len;
>>>>>>>> char *algo;
>>>>>>>>
>>>>>>>> SAFEALIGN_COPY_UINT32(&algo_len, pubkey->data, &c);
>>>>>>>> algo_len = ntohl(algo_len);
>>>>>>>>
>>>>>>>> algo = talloc_zero_array(mem_ctx, char, algo_len+1);
>>>>>>>> if (!algo) {
>>>>>>>> return NULL;
>>>>>>>> }
>>>>>>>>
>>>>>>>> memcpy(algo, pubkey->data+c, algo_len);
>>>>>>>>
>>>>>>>> return algo;
>>>>>>>> }
>>>>>>>>
>>>>>>>>
>>>>>>>> ==> it seems I always end up in the "return NULL" statement,
>>>>>>>> which seems very weird to me. Current SSH setups can get their
>>>>>>>> authorized keys from LDAP just fine (using "AuthorizedKeysCommand
>>>>>>>> /usr/libexec/openssh/ssh-ldap-wrapper" in sshd_config), so my
>>>>>>>> keys are just fine in LDAP.
>>>>>>>> I believe the call to SAFEALIGN_COPY_UINT32 is either wrong or
>>>>>>>> has the wrong arguments, since algo_len is a bizare huge
>>>>>>>> number ... Trying to change the
>>>>>>>> return NULL
>>>>>>>> in
>>>>>>>> return "ssh-dss
>>>>>>>> resulted in better effects (but still my key wasn't being
>>>>>>>> accepted, maybe another issue). The result (a bit obfuscated):
>>>>>>>>
>>>>>>>> ./sss_ssh_authorizedkeys MYUSER
>>>>>>>> ssh-dss c3NoXXXXXXXXX MYUSER at default
>>>>>>>>
>>>>>>>> Also, fixing algo_len to "7" seemed to have an effect, but
>>>>>>>> resulted in another output:
>>>>>>>> dss AAA c3NoXXXXXXXXX MYUSER at default
>>>>>>>>
>>>>>>>>
>>>>>>>> So, there seems something wrong here, but I can't figure it out.
>>>>>>>> Any tips?
>>>>>>>>
>>>>>>>> Franky
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
--
Jan Cholasta
More information about the sssd-devel
mailing list