<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 11/25/2013 12:38 PM, Viviano, Brad wrote:<br>
<span style="white-space: pre;">> Some additional information on
my problem.<br>
><br>
> I've confirmed that for ssh, I am going through pam_sss.so
just fine. If I set the following in my sssd.conf:<br>
><br>
> ldap_access_order = filter<br>
> ldap_access_filter = (!(pwdAccountLockedTime=*))<br>
><br>
> Then the user doesn't get access if their account is locked:<br>
><br>
> $ ssh bviviano@somehost<br>
> Connection closed<br>
><br>
> Since this is a filter, it can't really give the user a
reason, they just get disconnected. It isn't an ideal situation,
but it works. My question to the sssd developers is, am I missing
something in sssd.conf that would make this work better and be
more useful to the user. As I said in a previous message, I don't
see anything in the manual pages or the WIKI that lists
OpenLDAP/ppolicy specific configurations or even if they are
supported.<br>
><br>
</span><br>
Couple thoughts:<br>
1) May be you can create a virtual attribute in OpenLDAP using some
plugin/overlay that would be true/false based on the presence of the
pwdAccountLockedTime. Then you would be able to point to it as an
attribute rather than use a filter.<br>
2) I do not recall this issue discussed on the list before. You
might want to file an RFE. However I am not sure how soon we would
be able to get to it. But help is always welcome!<br>
<br>
<br>
<span style="white-space: pre;">> Thanks,<br>
> -Brad Viviano<br>
><br>
> ===================================================<br>
> Brad Viviano<br>
> High Performance Computing & Scientific Visualization<br>
> Lockheed Martin, Supporting the EPA<br>
> Research Triangle Park, NC<br>
> 919-541-2696<br>
><br>
> HSCSS Task Order Lead - Ravi Nair<br>
> 919-541-5467 - <a class="moz-txt-link-abbreviated" href="mailto:Nair.Ravi@epa.gov">Nair.Ravi@epa.gov</a><br>
> High Performance Computing Subtask Lead - Durward Jones<br>
> 919-541-5043 - <a class="moz-txt-link-abbreviated" href="mailto:Jones.Durward@epa.gov">Jones.Durward@epa.gov</a><br>
> Environmental Modeling and Visualization Lead - Heidi Paulsen<br>
> 919-541-1834 - <a class="moz-txt-link-abbreviated" href="mailto:Paulsen.Heidi@epa.gov">Paulsen.Heidi@epa.gov</a><br>
><br>
> ________________________________________<br>
> From: <a class="moz-txt-link-abbreviated" href="mailto:sssd-devel-bounces@lists.fedorahosted.org">sssd-devel-bounces@lists.fedorahosted.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:sssd-devel-bounces@lists.fedorahosted.org"><sssd-devel-bounces@lists.fedorahosted.org></a> on behalf of
Viviano, Brad <a class="moz-txt-link-rfc2396E" href="mailto:Viviano.Brad@epa.gov"><Viviano.Brad@epa.gov></a><br>
> Sent: Monday, November 25, 2013 10:29 AM<br>
> To: Development of the System Security Services Daemon<br>
> Subject: Re: [SSSD] Configuring SSSD expire policy with
OpenLDAP and SSH.<br>
><br>
> I turned debugging in sssd on at a high level for the LDAP
section and found the following in the log when I try and login
with a locked account, that has an SSH public key:<br>
><br>
> (Mon Nov 25 09:18:12 2013) [sssd[be[default]]]
[sdap_attrs_add_ldap_attr] (0x2000): Adding nsAccountLock
[20131125140156Z] to attributes of [bviviano].<br>
><br>
><br>
> This directly corresponds to the pwdAccountLockedTime set on
my account, which is what I set ldap_ns_account_lock to:<br>
><br>
> [root@smtools ldap]# ldapsearch -x -ZZ cn=bviviano
pwdAccountLockedTime<br>
> # extended LDIF<br>
> #<br>
> # LDAPv3<br>
> # base <dc=epa,dc=gov> (default) with scope subtree<br>
> # filter: cn=bviviano<br>
> # requesting: pwdAccountLockedTime<br>
> #<br>
><br>
> # bviviano, users, epa.gov<br>
> dn: cn=bviviano,cn=users,dc=epa,dc=gov<br>
> pwdAccountLockedTime: 20131125140156Z<br>
><br>
> # search result<br>
> search: 3<br>
> result: 0 Success<br>
><br>
> # numResponses: 2<br>
> # numEntries: 1<br>
><br>
> From reading, "nsAccountLock" is expecting a true/false
field. OpenLDAP ppolicy doesn't seem to provide a locked/unlocked
true/false in any field. It only provides pwdAccountLockedTime,
which has the form of a time stamp. Is there anything in sssd.conf
that would allow me to check no the value of
"pwdAccountLockedTime" but if that value exists or not. I might be
able to craft an LDAP filter and search on that not existing, but
thought I'd ask if anyone else has been able to get OpenLDAP
w/ppolicy to work with SSSD.<br>
><br>
> Thanks,<br>
> -Brad Viviano<br>
><br>
> ===================================================<br>
> Brad Viviano<br>
> High Performance Computing & Scientific Visualization<br>
> Lockheed Martin, Supporting the EPA<br>
> Research Triangle Park, NC<br>
> 919-541-2696<br>
><br>
> HSCSS Task Order Lead - Ravi Nair<br>
> 919-541-5467 - <a class="moz-txt-link-abbreviated" href="mailto:Nair.Ravi@epa.gov">Nair.Ravi@epa.gov</a><br>
> High Performance Computing Subtask Lead - Durward Jones<br>
> 919-541-5043 - <a class="moz-txt-link-abbreviated" href="mailto:Jones.Durward@epa.gov">Jones.Durward@epa.gov</a><br>
> Environmental Modeling and Visualization Lead - Heidi Paulsen<br>
> 919-541-1834 - <a class="moz-txt-link-abbreviated" href="mailto:Paulsen.Heidi@epa.gov">Paulsen.Heidi@epa.gov</a><br>
><br>
> ________________________________________<br>
> From: <a class="moz-txt-link-abbreviated" href="mailto:sssd-devel-bounces@lists.fedorahosted.org">sssd-devel-bounces@lists.fedorahosted.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:sssd-devel-bounces@lists.fedorahosted.org"><sssd-devel-bounces@lists.fedorahosted.org></a> on behalf of
Stephen Gallagher <a class="moz-txt-link-rfc2396E" href="mailto:sgallagh@redhat.com"><sgallagh@redhat.com></a><br>
> Sent: Monday, November 25, 2013 7:20 AM<br>
> To: Development of the System Security Services Daemon<br>
> Subject: Re: [SSSD] Configuring SSSD expire policy with
OpenLDAP and SSH.<br>
></span><br>
<blockquote type="cite">On 11/24/2013 04:19 PM, Jakub Hrozek wrote:<br>
> On Fri, Nov 22, 2013 at 03:16:16PM -0500, Dmitri Pal wrote:<br>
>> On 11/22/2013 02:51 PM, Viviano, Brad wrote:<br>
>>> Hello, I've searched extensively and haven't found an
answer to<br>
>>> this. I have a RHEL6.4 system running slapd version<br>
>>> 2.4.23-32.el6_4.1 with sssd version
1.9.2-82.11.el6_4. I've<br>
>>> configured OpenLDAP to use ppolicy. Everything
(password<br>
>>> expires, account locked, grace periods, etc) is
working<br>
>>> beautifully if the user logs in with their password.
But if<br>
>>> they have an SSH public key, then even if the account
in<br>
>>> OpenLDAP is locked, the user can still login. I can't
seem to<br>
>>> find a FAQ on configuring OpenLDAP and SSSD in
regards to<br>
>>> ppolicy settings for this case. I hope I am just
missing<br>
>>> something simple. Any suggestions or pointers would
be much<br>
>>> appreciated.<br>
>><br>
>> You want to use account policies when log using SSH keys?<br>
>><br>
>> I am not an expert so I am not sure exactly how to do or
whether<br>
>> it is possible but I think you need to make sure that
when you<br>
>> log into the system via SSH the PAM accounting phase is<br>
>> performed. Please check SSH config to invoke pam
accounting for<br>
>> access control checks then you can use SSSD in the pam
stack and<br>
>> use its access control provider configuration for LDAP to
do the<br>
>> checks. At least this is the direction I would try to
dig.<br>
>><br>
>> HTH Dmitri<br>
<br>
> Dmitri is completely right.<br>
<br>
> When you log in with your public key the authentication is<br>
> performed by sshd, so the SSSD's pam_sss doesn't come to play
in<br>
> the authentication.<br>
<br>
> Some password policies (eg shadow) would be possible to check
later<br>
> during the account phase, but typically the expiration data
is<br>
> returned by the LDAP server during authentication, so this
solution<br>
> wouldn't be generic.<br>
<br>
> Also, by using public keys, you are logging in with another<br>
> authentication token then your password, so it would seem
strange a<br>
> bit to warn about password properties.<br>
<br>
> Account expiration is a different matter than password
policy.<br>
> Expiration should always be checked during account phase. I'm
not<br>
> sure which mechanism is most prevalent in OpenLDAP
deployments, but<br>
> please check the sssd-ldap man page, option<br>
> 'ldap_account_expire_policy'. If there is some widely used
overlay<br>
> or other mechanism which is not supported by the SSSD, let us<br>
> know.<br>
<br>
Two other things to check:<br>
<br>
1) Is /etc/ssh/sshd_config set with "Use PAM = yes"?<br>
2) What do you have set in sssd.conf for access_provider? If
you're<br>
not using "access_provider = ldap" and the appropriate<br>
"ldap_access_order" settings, the expiration policy may not be
checked.<br>
<br>
</blockquote>
<span style="white-space: pre;">>
_______________________________________________<br>
> sssd-devel mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
> <a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
> _______________________________________________<br>
> sssd-devel mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
> <a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
> _______________________________________________<br>
> sssd-devel mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
> <a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a></span><br>
<br>
-- <br>
Thank you,<br>
Dmitri Pal<br>
<br>
Sr. Engineering Manager for IdM portfolio<br>
Red Hat Inc.<br>
<br>
<br>
-------------------------------<br>
Looking to carve out IT costs?<br>
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a><br>
<br>
<br>
<br>
</body>
</html>