[SSSD] [PATCH] pam_sss: add ignore_unknown_user option

Lukas Slebodnik lslebodn at redhat.com
Mon May 26 22:18:08 UTC 2014


On (14/03/14 14:22), Jakub Hrozek wrote:
>On Fri, Mar 14, 2014 at 02:14:04PM +0100, Lukas Slebodnik wrote:
>> On (13/03/14 15:24), Pete Fritchman wrote:
>> >On Thu, Mar 13, 2014 at 1:28 PM, Jakub Hrozek <jhrozek at redhat.com> wrote:
>> >> would you like any help amending the patch ? Are you still planning on
>> >> re-sending it?
>> >
>> >Hi Jakub,
>> >
>> >Sorry - I forgot to follow up to this thread.  I attached a new patch
>> >to the ticket that includes the case where send_and_receive returns
>> >PAM_IGNORE and also updates the pam_sss man page.
>> >
>> >https://fedorahosted.org/sssd/ticket/2232
>> >https://fedorahosted.org/sssd/attachment/ticket/2232/0001-PAM-add-ignore_unknown_user-option.patch
>> >
>> >thanks,
>> ndex d45b2e88f16b030b81b180cef233bc024347f5d8..32558fac9b18e5f62b8968f6fbfbada6c9b3f504 100644
>> 
>> >Index: src/sss_client/pam_sss.c
>> >===================================================================
>> >--- a/src/sss_client/pam_sss.c
>> >+++ b/src/sss_client/pam_sss.c
>> >@@ -47,6 +47,7 @@
>> > #define FLAGS_USE_FIRST_PASS (1 << 0)
>> > #define FLAGS_FORWARD_PASS   (1 << 1)
>> > #define FLAGS_USE_AUTHTOK    (1 << 2)
>> >+#define FLAGS_IGNORE_UNKNOWN_USER (1 << 3)
>> > 
>> > #define PWEXP_FLAG "pam_sss:password_expired_flag"
>> > #define FD_DESTRUCTOR "pam_sss:fd_destructor"
>> >@@ -1284,6 +1285,8 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
>> >             }
>> >         } else if (strcmp(*argv, "quiet") == 0) {
>> >             *quiet_mode = true;
>> >+        } else if (strcmp(*argv, "ignore_unknown_user") == 0) {
>> >+            *flags |= FLAGS_IGNORE_UNKNOWN_USER;
>> >         } else {
>> >             logger(pamh, LOG_WARNING, "unknown option: %s", *argv);
>> >         }
>> >@@ -1425,6 +1428,9 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
>> >     ret = get_pam_items(pamh, &pi);
>> >     if (ret != PAM_SUCCESS) {
>> >         D(("get items returned error: %s", pam_strerror(pamh,ret)));
>> >+        if (flags & FLAGS_IGNORE_UNKNOWN_USER && ret == PAM_USER_UNKNOWN) {
>> >+            ret = PAM_IGNORE;
>> >+        }
>> >         return ret;
>> >     }
>> > 
>> >@@ -1463,6 +1469,11 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
>> > 
>> >         pam_status = send_and_receive(pamh, &pi, task, quiet_mode);
>> > 
>> >+        if (flags & FLAGS_IGNORE_UNKNOWN_USER
>> >+                && pam_status == PAM_USER_UNKNOWN) {
>> >+            pam_status = PAM_IGNORE;
>> I think you can immediatelly return PAM_IGNORE
>
>I think it's cleaner not to create more exit points from the function.
>
>> >
>> >+        }
>> >+
>> >         switch (task) {
>> >             case SSS_PAM_AUTHENTICATE:
>> >                 /* We allow sssd to send the return code PAM_NEW_AUTHTOK_REQD during
>> >
>> 
>> But you did not implement the same behavoiour like pam-ldap with
>> argument ignore_authinfo_unavaile.
>> 
>> If sssd is stopped sss_pam will return PAM_AUTHINFO_UNAVAIL an local user
>> cannot authenticate.
>> 
>> LS
>
>Hm, that's true, I only tested with SSSD running. Feel free to send a
>follow-up patch.

follow-up patch is attached.

How to test on linux?

Use following pam configuration in /etc/pam.d/password-auth
# hbac will work, local user can connect to the machine with ssh
# but local user will not be able to connect if sssd is down
# e.g. service sssd stop

 account     required      pam_unix.so broken_shadow
 account     sufficient    pam_succeed_if.so uid < 1000 quiet
 account     required      pam_sss.so debug ignore_unknown_user
 account     required      pam_permit.so


This change should fix the problem if sssd is down.
-account     required      pam_sss.so debug ignore_unknown_user
+account     required      pam_sss.so debug ignore_unknown_user ignore_authinfo_unavail

Arguments ignore_unknown_user ignore_authinfo_unavail are also implemented
in pam_ldap.

LS
-------------- next part --------------
>From 318cb108cdd74b4150dd45c28609a28f495a3a8e Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Mon, 26 May 2014 18:31:06 +0200
Subject: [PATCH 1/3] PAM: add ignore_authinfo_unavail option

Resolves:
https://fedorahosted.org/sssd/ticket/2232
---
 src/man/pam_sss.8.xml    | 14 ++++++++++++++
 src/sss_client/pam_sss.c | 11 +++++++++++
 2 files changed, 25 insertions(+)

diff --git a/src/man/pam_sss.8.xml b/src/man/pam_sss.8.xml
index e42cb2d621705cba9083692a47699b9692af5e8e..859d42eeae0fab9a3097010252ae1b4e04d306da 100644
--- a/src/man/pam_sss.8.xml
+++ b/src/man/pam_sss.8.xml
@@ -40,6 +40,9 @@
             <arg choice='opt'>
                 <replaceable>ignore_unknown_user</replaceable>
             </arg>
+            <arg choice='opt'>
+                <replaceable>ignore_authinfo_unavail</replaceable>
+            </arg>
         </cmdsynopsis>
     </refsynopsisdiv>
 
@@ -116,6 +119,17 @@
                     the PAM framework to ignore this module.</para>
                 </listitem>
             </varlistentry>
+            <varlistentry>
+                <term>
+                    <option>ignore_authinfo_unavail</option>
+                </term>
+                <listitem>
+                    <para>
+                    Specifies  that  the  PAM module should return PAM_IGNORE
+                    if it cannot contact the SSSD daemon. This causes
+                    the PAM framework to ignore this module.</para>
+                </listitem>
+            </varlistentry>
         </variablelist>
     </refsect1>
 
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index 4dae7e1cab5a50e919177b9da1901be594609794..fdd6daab947f37e5235c0f201aa61fb3d0dd88a2 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -48,6 +48,7 @@
 #define FLAGS_FORWARD_PASS   (1 << 1)
 #define FLAGS_USE_AUTHTOK    (1 << 2)
 #define FLAGS_IGNORE_UNKNOWN_USER (1 << 3)
+#define FLAGS_IGNORE_AUTHINFO_UNAVAIL (1 << 4)
 
 #define PWEXP_FLAG "pam_sss:password_expired_flag"
 #define FD_DESTRUCTOR "pam_sss:fd_destructor"
@@ -1308,6 +1309,8 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
             *quiet_mode = true;
         } else if (strcmp(*argv, "ignore_unknown_user") == 0) {
             *flags |= FLAGS_IGNORE_UNKNOWN_USER;
+        } else if (strcmp(*argv, "ignore_authinfo_unavail") == 0) {
+            *flags |= FLAGS_IGNORE_AUTHINFO_UNAVAIL;
         } else {
             logger(pamh, LOG_WARNING, "unknown option: %s", *argv);
         }
@@ -1452,6 +1455,10 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
         if (flags & FLAGS_IGNORE_UNKNOWN_USER && ret == PAM_USER_UNKNOWN) {
             ret = PAM_IGNORE;
         }
+        if (flags & FLAGS_IGNORE_AUTHINFO_UNAVAIL
+                && ret == PAM_AUTHINFO_UNAVAIL) {
+            ret = PAM_IGNORE;
+        }
         return ret;
     }
 
@@ -1494,6 +1501,10 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
                 && pam_status == PAM_USER_UNKNOWN) {
             pam_status = PAM_IGNORE;
         }
+        if (flags & FLAGS_IGNORE_AUTHINFO_UNAVAIL
+                && pam_status == PAM_AUTHINFO_UNAVAIL) {
+            pam_status = PAM_IGNORE;
+        }
 
         switch (task) {
             case SSS_PAM_AUTHENTICATE:
-- 
1.9.3



More information about the sssd-devel mailing list