[SSSD] ldap_access_filter being ignored?

Fairlight fairlite at fairlite.com
Sat May 26 16:02:44 UTC 2012


Only Stephen Gallagher would say something like:
> 
> SSSD *is* deny-by-default. See below for why I suspect that you're
> actually not hitting SSSD for evaluation.
> 
> > Any help I can get at this point would be hugely appreciated.  Let me know
> > what you might need in terms of seeing configuration.  I'll include the
> > relevant sssd section here [for confidentiality purposes, I changed my
> > client's domain name to my domain name, but everything else is accurate]:
> > 
> > [domain/fairlite.com]
> > access_provider = ldap
> > id_provider = ldap
> > auth_provider = ldap
> > chpass_provider = ldap
> > ldap_schema = rfc2307
> > ldap_uri = ldap://oh11.fairlite.com
> > ldap_search_base = dc=fairlite,dc=com
> > ldap_tls_reqcert = demand
> > ldap_tls_cacert = /etc/ssl/certs/oh11.fairlite.com-CA.crt
> > cache_credentials = false
> > enumerate = true
> > ldap_access_filter = memberOf=cn=oh11,ou=Group,dc=fairlite,dc=com
> > ldap_access_order = filter
> > 
> > It's worth noting that I can't get memberOf to actually supply a memberuid
> > field with ldapsearch.  That said, even if memberOf is -totally- broken,
> > I'd expect sssd to fail -all- logins, not let everyone in.
> > 
> > Any help I can get...I'd be extremely grateful for it.  I really need
> > sssd's name differentiation.  That's critical, and why I'm going with sssd
> > over direct ldap in the first place.
> 
> 
> Ok, I need a little bit of extra information to sort this out. First of
> all, can you show me what /var/log/secure (or SUSE's equivalent) shows
> during a login?
> 
> My best guess is that you are missing pam_sss.so in the 'account' phase
> of the PAM stack being executed at login (or it's configured to be
> 'optional'). Can you show me the /etc/pam.d/<service> file (and any
> included files)?
> 
> Another possibility would be that (if this is sshd), you are missing
> 'use_pam yes' in sshd_config, which would mean that it would skip using
> SSSD (and any other PAM module) for the account phase as well. If logins
> are properly denied by a console login but allowed by SSH, this is a
> likely potential culprit.
> 
> If none of that proves to be the issue, please set debug_level = 9 in
> the [domain/fairlite.com], restart SSSD, do a login and then send me
> your /var/log/sssd/sssd_fairlite.com.log file (or wherever it is put on
> SUSE) privately (sanitized of course).

/etc/ssh/sshd_config does contain "UsePAM yes"

/etc/pam.d/sshd:
auth     requisite      pam_nologin.so
auth     include        common-auth
account  requisite      pam_nologin.so
account  include        common-account
password include        common-password
session  required       pam_loginuid.so
session  include        common-session
session  optional       pam_lastlog.so   silent noupdate showfailed

/etc/pam.d/common-auth:
auth       required     pam_env.so
auth       sufficient   pam_unix.so likeauth nullok
auth       sufficient   pam_sss.so use_first_pass
auth       required     pam_deny.so

/etc/pam.d/common-account:
account    sufficient   pam_unix.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so

/etc/pam.d/common-password:
password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password   sufficient   pam_unix.so nullok md5 shadow use_authtok
password   sufficient   pam_sss.so use_authtok
password   required     pam_deny.so

/etc/pam.d/common-session:
session    required     pam_limits.so
session    required     pam_unix.so
session    sufficient   pam_sss.so
session    optional     pam_gnome_keyring.so    auto_start only_if=gdm,lxdm

/etc/sssd/sssd.conf domain definition:
[domain/fairlite.com]
debug_level = 9
access_provider = ldap
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldap://oh11.fairlite.com
ldap_search_base = dc=fairlite,dc=com
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/oh11.fairlite.com-CA.crt
cache_credentials = false
enumerate = true
ldap_access_filter = memberOf=cn=oh11,ou=Group,dc=fairlite,dc=com
ldap_access_order = filter

Logging from /var/log/messages after logging in with user in question:

May 26 11:30:52 oh11 sshd[23246]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=shell1.somehost.com user=fairlite
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=13 SRCH base="dc=fairlite,dc=com" scope=2 deref=0 filter="(&(uid=fairlite)(objectClass=posixAccount))"
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=13 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=13 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=14 SRCH base="dc=fairlite,dc=com" scope=2 deref=0 filter="(&(memberUid=fairlite)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))"
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=14 SRCH attr=objectClass cn userPassword gidNumber memberuid modifyTimestamp modifyTimestamp
May 26 11:30:52 oh11 slapd[10761]: conn=1102 op=14 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 26 11:30:52 oh11 slapd[10761]: conn=1103 fd=22 ACCEPT from IP=127.0.0.1:51811 (IP=0.0.0.0:389)
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=0 EXT oid=1.3.6.1.4.1.1466.20037
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=0 STARTTLS
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=0 RESULT oid= err=0 text=
May 26 11:30:52 oh11 slapd[10761]: conn=1103 fd=22 TLS established tls_ssf=256 ssf=256
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=1 BIND dn="uid=fairlite,ou=People,dc=fairlite,dc=com" method=128
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=1 BIND dn="uid=fairlite,ou=People,dc=fairlite,dc=com" mech=SIMPLE ssf=0
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=1 RESULT tag=97 err=0 text=
May 26 11:30:52 oh11 slapd[10761]: conn=1103 op=2 UNBIND
May 26 11:30:52 oh11 slapd[10761]: conn=1103 fd=22 closed
May 26 11:30:52 oh11 sshd[23246]: pam_sss(sshd:auth): authentication
success; logname= uid=0 euid=0 tty=ssh ruser= rhost=shell1.somehost.com user=fairlite
May 26 11:30:52 oh11 sshd[23244]: Accepted keyboard-interactive/pam for fairlite from 192.107.41.17 port 43658 ssh2
May 26 11:30:52 oh11 sshd[23244]: pam_unix(sshd:session): session opened for user fairlite by (uid=0)

One thing I've noticed is that in /var/log/sssd, the sssd_pam.log is still
zero bytes.  And I'm not seeing extra tracing anywhere from sssd, no matter
what the debug level is set to.  But you can see pam_sss is being hit and
succeeding on the third to last line of logging.

If you need anything else (and I'm sure you will), please don't hesitate to
ask, and I'll get it back to you ASAP.

Bests,

mark->



More information about the sssd-devel mailing list