<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    On 04/15/2015 01:46 PM, Olivier wrote:<br>
    <blockquote
cite="mid:CACgJ1oyrQ49Ho0VRgEmgaKVUq-Z=ps9_CMfFRuaG+K=hyO3Rxw@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div>Sorry to have missed that : sounds interesting really.<br>
          <br>
          stay to see the articulation between these sssd options,
          sss_ssh_authorizedkeys<br>
          and ssh the authentication process.<br>
          <br>
          I look at it.<br>
          <br>
          --<br>
        </div>
        Olivier<br>
      </div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">2015-04-15 13:20 GMT+02:00 Pavel Reichl
          <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:preichl@redhat.com" target="_blank">preichl@redhat.com</a>&gt;</span>:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000">
              <div>
                <div class="h5"> <br>
                  <br>
                  <div>On 04/15/2015 12:10 PM, Olivier wrote:<br>
                  </div>
                </div>
              </div>
              <blockquote type="cite">
                <div>
                  <div class="h5">
                    <div dir="ltr">
                      <div>
                        <div>
                          <div>Hi everyone,<br>
                            <br>
                          </div>
                          I saw couple of discussion around in this list
                          as well as others<br>
                          about how to exploit ppolicy with ssh : here
                          are some thought.<br>
                        </div>
                        <div><br>
                        </div>
                        <div>Currently, I am in a situation where I have
                          inserted my users<br>
                        </div>
                        <div>public ssh keys in ldap (openssh-ldappubkey
                          shema) and<br>
                        </div>
                        <div>instructed sshd to consult ldap for ssh
                          public keys, adding in<br>
                          ssh_config :<br>
                          <br>
                          AuthorizedKeysCommand
                          /usr/bin/sss_ssh_authorizedkeys<br>
                          <br>
                          <div>I also have authorized password
                            authentication , in ssh_config:<br>
                          </div>
                          <br>
                          PasswordAuthentication yes<br>
                          <br>
                        </div>
                        <div>My current policy is the following :<br>
                        </div>
                        <div><br>
                        </div>
                        <div>- All my users must have a password in ldap
                          (that is used by<br>
                             applications other than ssh)<br>
                        </div>
                        <div><br>
                        </div>
                        <div>- not all my users may have an ssh key
                          (some never use ssh)<br>
                          <br>
                        </div>
                        <div>Everything works as I want.<br>
                        </div>
                        <div><br>
                          I now want to introduce ppolicy overlay and
                          would like to enforce<br>
                          rules for password management even for users
                          that mainly use<br>
                          ssh keys.<br>
                        </div>
                        <div><br>
                        </div>
                        <div>Practically and basically : when a user
                          with valid ssh key ask for<br>
                          an ssh connexion, I would like ssh to behave
                          exactly as if this user<br>
                          had typed a correct "loging/password"  and
                          therefore check for<br>
                          ppolicy situation before granting access.<br>
                        </div>
                      </div>
                      <div><br>
                      </div>
                      <div>aka :<br>
                        - if the account is 'ppolicy desactivated', ssh
                        would refuse to<br>
                           provide the session <br>
                        <br>
                      </div>
                      <div>- if the password is "ppolicy oudated", then
                        ssh would warn to<br>
                          change it (and decrease 'pwdGraceAuthnLimit<i>'</i>?)<br>
                      </div>
                      <div><br>
                      </div>
                      <div>... and so on.<br>
                        <br>
                      </div>
                      <div>I thought about two options/alternatives to
                        do that :<br>
                        <br>
                      </div>
                      <div>* try to tune pam (may be there would be a
                        way to tell pam to check<br>
                           for user ppolicy fields once authentication
                        has been done before<br>
                      </div>
                      <div>   granting access ?)<br>
                        <br>
                      </div>
                      <div>* add some sort of flag (aka: --ppolicy) to
                        sss_ssh_authorizedkeys<br>
                      </div>
                      <div>   to instruct sss_ssh_authorizedkeys to
                        check for user ppolicy (use<br>
                           'ldap_default_bind_dn' as a binding user) and
                        if there is an issue<br>
                            return a "ppolicy error message" rather
                        than  the user ssh key ?<br>
                        <br>
                        These are just some thoughts.<br>
                        <br>
                      </div>
                      <div>I'm currently exploring the first option (but
                        I'm not a 'pam' expert and<br>
                        I'm even not sure that the ssh authentication
                        process goes through<br>
                      </div>
                      <div>pam if a valid key is found, even with
                        'UsePAM yes').<br>
                      </div>
                      <div><br>
                      </div>
                      <div>I would appreciate any guidance, advices or
                        experiences from you<br>
                        on that particular issue.<br>
                      </div>
                      <div><br>
                      </div>
                      <div>Thank you,<br>
                        <br>
                        --<br>
                      </div>
                      <div>Olivier<br>
                      </div>
                      <div><br>
                      </div>
                    </div>
                    <br>
                    <fieldset></fieldset>
                    <br>
                  </div>
                </div>
                <pre>_______________________________________________
sssd-devel mailing list
<a moz-do-not-send="true" href="mailto:sssd-devel@lists.fedorahosted.org" target="_blank">sssd-devel@lists.fedorahosted.org</a>
<a moz-do-not-send="true" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
              </blockquote>
              Hello Olivier,<br>
              <br>
              are you aware of 'ldap_access_order' option and its values
              (see man sssd-ldap) , could that help you? <br>
            </div>
            <br>
            _______________________________________________<br>
            sssd-devel mailing list<br>
            <a moz-do-not-send="true"
              href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a><br>
            <a moz-do-not-send="true"
              href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel"
              target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a><br>
            <br>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
sssd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-devel@lists.fedorahosted.org">sssd-devel@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-devel">https://lists.fedorahosted.org/mailman/listinfo/sssd-devel</a>
</pre>
    </blockquote>
    Olivier, <br>
    <br>
    could we stop posting in this thread and continue instead solely in
    the thread you created on sssd-user list which is better suited for
    this purpose?<br>
    <br>
    Thanks!<br>
  </body>
</html>