<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 04/15/2015 12:10 PM, Olivier wrote:<br>
</div>
<blockquote
cite="mid:CACgJ1ozU+rL2LjQOTssT5YWRo32bpTgYpsne-nQpxmnt5XBM9Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>Hi everyone,<br>
<br>
</div>
I saw couple of discussion around in this list as well as
others<br>
about how to exploit ppolicy with ssh : here are some
thought.<br>
</div>
<div><br>
</div>
<div>Currently, I am in a situation where I have inserted my
users<br>
</div>
<div>public ssh keys in ldap (openssh-ldappubkey shema) and<br>
</div>
<div>instructed sshd to consult ldap for ssh public keys,
adding in<br>
ssh_config :<br>
<br>
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys<br>
<br>
<div>I also have authorized password authentication , in
ssh_config:<br>
</div>
<br>
PasswordAuthentication yes<br>
<br>
</div>
<div>My current policy is the following :<br>
</div>
<div><br>
</div>
<div>- All my users must have a password in ldap (that is used
by<br>
applications other than ssh)<br>
</div>
<div><br>
</div>
<div>- not all my users may have an ssh key (some never use
ssh)<br>
<br>
</div>
<div>Everything works as I want.<br>
</div>
<div><br>
I now want to introduce ppolicy overlay and would like to
enforce<br>
rules for password management even for users that mainly use<br>
ssh keys.<br>
</div>
<div><br>
</div>
<div>Practically and basically : when a user with valid ssh
key ask for<br>
an ssh connexion, I would like ssh to behave exactly as if
this user<br>
had typed a correct "loging/password" and therefore check
for<br>
ppolicy situation before granting access.<br>
</div>
</div>
<div><br>
</div>
<div>aka :<br>
- if the account is 'ppolicy desactivated', ssh would refuse
to<br>
provide the session <br>
<br>
</div>
<div>- if the password is "ppolicy oudated", then ssh would warn
to<br>
change it (and decrease 'pwdGraceAuthnLimit<i>'</i>?)<br>
</div>
<div><br>
</div>
<div>... and so on.<br>
<br>
</div>
<div>I thought about two options/alternatives to do that :<br>
<br>
</div>
<div>* try to tune pam (may be there would be a way to tell pam
to check<br>
for user ppolicy fields once authentication has been done
before<br>
</div>
<div> granting access ?)<br>
<br>
</div>
<div>* add some sort of flag (aka: --ppolicy) to
sss_ssh_authorizedkeys<br>
</div>
<div> to instruct sss_ssh_authorizedkeys to check for user
ppolicy (use<br>
'ldap_default_bind_dn' as a binding user) and if there is
an issue<br>
return a "ppolicy error message" rather than the user ssh
key ?<br>
<br>
These are just some thoughts.<br>
<br>
</div>
<div>I'm currently exploring the first option (but I'm not a
'pam' expert and<br>
I'm even not sure that the ssh authentication process goes
through<br>
</div>
<div>pam if a valid key is found, even with 'UsePAM yes').<br>
</div>
<div><br>
</div>
<div>I would appreciate any guidance, advices or experiences
from you<br>
on that particular issue.<br>
</div>
<div><br>
</div>
<div>Thank you,<br>
<br>
--<br>
</div>
<div>Olivier<br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
Hello Olivier,<br>
<br>
are you aware of 'ldap_access_order' option and its values (see man
sssd-ldap) , could that help you? <br>
</body>
</html>