<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 04/15/2015 01:46 PM, Olivier wrote:<br>
<blockquote
cite="mid:CACgJ1oyrQ49Ho0VRgEmgaKVUq-Z=ps9_CMfFRuaG+K=hyO3Rxw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Sorry to have missed that : sounds interesting really.<br>
<br>
stay to see the articulation between these sssd options,
sss_ssh_authorizedkeys<br>
and ssh the authentication process.<br>
<br>
I look at it.<br>
<br>
--<br>
</div>
Olivier<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2015-04-15 13:20 GMT+02:00 Pavel Reichl
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:preichl@redhat.com" target="_blank">preichl@redhat.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>
<div class="h5"> <br>
<br>
<div>On 04/15/2015 12:10 PM, Olivier wrote:<br>
</div>
</div>
</div>
<blockquote type="cite">
<div>
<div class="h5">
<div dir="ltr">
<div>
<div>
<div>Hi everyone,<br>
<br>
</div>
I saw couple of discussion around in this list
as well as others<br>
about how to exploit ppolicy with ssh : here
are some thought.<br>
</div>
<div><br>
</div>
<div>Currently, I am in a situation where I have
inserted my users<br>
</div>
<div>public ssh keys in ldap (openssh-ldappubkey
shema) and<br>
</div>
<div>instructed sshd to consult ldap for ssh
public keys, adding in<br>
ssh_config :<br>
<br>
AuthorizedKeysCommand
/usr/bin/sss_ssh_authorizedkeys<br>
<br>
<div>I also have authorized password
authentication , in ssh_config:<br>
</div>
<br>
PasswordAuthentication yes<br>
<br>
</div>
<div>My current policy is the following :<br>
</div>
<div><br>
</div>
<div>- All my users must have a password in ldap
(that is used by<br>
applications other than ssh)<br>
</div>
<div><br>
</div>
<div>- not all my users may have an ssh key
(some never use ssh)<br>
<br>
</div>
<div>Everything works as I want.<br>
</div>
<div><br>
I now want to introduce ppolicy overlay and
would like to enforce<br>
rules for password management even for users
that mainly use<br>
ssh keys.<br>
</div>
<div><br>
</div>
<div>Practically and basically : when a user
with valid ssh key ask for<br>
an ssh connexion, I would like ssh to behave
exactly as if this user<br>
had typed a correct "loging/password" and
therefore check for<br>
ppolicy situation before granting access.<br>
</div>
</div>
<div><br>
</div>
<div>aka :<br>
- if the account is 'ppolicy desactivated', ssh
would refuse to<br>
provide the session <br>
<br>
</div>
<div>- if the password is "ppolicy oudated", then
ssh would warn to<br>
change it (and decrease 'pwdGraceAuthnLimit<i>'</i>?)<br>
</div>
<div><br>
</div>
<div>... and so on.<br>
<br>
</div>
<div>I thought about two options/alternatives to
do that :<br>
<br>
</div>
<div>* try to tune pam (may be there would be a
way to tell pam to check<br>
for user ppolicy fields once authentication
has been done before<br>
</div>
<div> granting access ?)<br>
<br>
</div>
<div>* add some sort of flag (aka: --ppolicy) to
sss_ssh_authorizedkeys<br>
</div>
<div> to instruct sss_ssh_authorizedkeys to
check for user ppolicy (use<br>
'ldap_default_bind_dn' as a binding user) and
if there is an issue<br>
return a "ppolicy error message" rather
than the user ssh key ?<br>
<br>
These are just some thoughts.<br>
<br>
</div>
<div>I'm currently exploring the first option (but
I'm not a 'pam' expert and<br>
I'm even not sure that the ssh authentication
process goes through<br>
</div>
<div>pam if a valid key is found, even with
'UsePAM yes').<br>
</div>
<div><br>
</div>
<div>I would appreciate any guidance, advices or
experiences from you<br>
on that particular issue.<br>
</div>
<div><br>
</div>
<div>Thank you,<br>
<br>
--<br>
</div>
<div>Olivier<br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</div>
</div>
<pre>_______________________________________________
sssd-devel mailing list
<a moz-do-not-send="true" href="mailto:sssd-devel@lists.fedorahosted.org" target="_blank">sssd-devel@lists.fedorahosted.org</a>
<a moz-do-not-send="true" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
Hello Olivier,<br>
<br>
are you aware of 'ldap_access_order' option and its values
(see man sssd-ldap) , could that help you? <br>
</div>
<br>
_______________________________________________<br>
sssd-devel mailing list<br>
<a moz-do-not-send="true"
href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
<a moz-do-not-send="true"
href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel"
target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
</blockquote>
Olivier, <br>
<br>
could we stop posting in this thread and continue instead solely in
the thread you created on sssd-user list which is better suited for
this purpose?<br>
<br>
Thanks!<br>
</body>
</html>