[SSSD-users] filter ldap users or groups

George Vasiliu gvasiliu at hostopia.com
Tue May 13 19:56:46 UTC 2014


Hi,

We're migrating from pam_ldap to sssd and so far everything works as
expected: ldapsearch, getent passwd <user>, getent group <group>, tested
offline caching, great product!

>From a security perspective, nslcd ( CentOS 6) is not able to get any
users that are not part of certain allowed groups by having  "filter
passwd LDAP_FILTER" in /etc/nslcd.conf. Is there any similar
functionality I could use with SSSD to prevent exposing whole ldap tree?
Do filter_groups or/and filter_users work with ldap filters?

Example of sanitized conf:

[sssd]
config_file_version = 2
sbus_timeout = 30
services = nss, pam, sudo, ssh
domains = LOCAL, LDAP

[nss]
filter_users =
adm,avahi,bin,daemon,dbus,haldaemon,halt,ldap,mail,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,radiusd,root,rpc,rpcuser,saslauth,shutdown,smmsp,sshd,sync,tcpdump,vcsa
filter_groups =
adm,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,floppy,fuse,kmem,ldap,lock,lp,mail,man,mem,nfsnobody,nobody,nscd,ntp,root,rpc,rpcuser,saslauth,smmsp,sshd,sys,tape,tcpdump,tty,users,utempter,utmp,vcsa,video

[pam]
debug_level = 3
reconnection_retries = 3
offline_credentials_expiration = 2
offline_failed_login_attempts = 3
offline_failed_login_delay = 5
pam_verbosity = 2

[domain/LOCAL]
description = LOCAL Users domain
id_provider = local
enumerate = true
min_id = 500
max_id = 999

[domain/LDAP]
min_id = 499
debug_level = 3
cache_credentials = True
entry_cache_timeout = 864000

auth_provider = ldap
id_provider = ldap
access_provider = ldap
#chpass_provider = ldap
sudo_provider = ldap

# LDAP Search
ldap_search_base = dc=example,dc=com
ldap_user_search_base = ou=users,o=Example,dc=example,dc=com
ldap_group_search_base = ou=groups,o=Example,dc=example,dc=com

# LDAP Custom Schema
ldap_group_member = hMemberDN
ldap_user_member_of = description
ldap_schema = rfc2307bis

ldap_network_timeout = 3
ldap_id_use_start_tls = False
ldap_tls_reqcert = never
ldap_uri = ldaps://ldap2.example.com, ldaps://ldap1.example.com
ldap_tls_cacertdir = /etc/openldap/cacerts

ldap_default_authtok_type = obfuscated_password
ldap_default_bind_dn = uid=******
ldap_default_authtok = *********

ldap_user_ssh_public_key = sshPublicKey


# Password expiration
#ldap_pwd_policy=shadow
#ldap_account_expire_policy = shadow
#ldap_account_expire_policy = ad
#ldap_access_order = filter,expire
ldap_access_order = filter

ldap_access_filter =
(&(objectClass=posixAccount)(uidNumber=*)(|(description=CN=prodgroup,OU=groups,O=Example,DC=example,DC=com)(description=CN=secgroup,OU=groups,O=Example,DC=Example,DC=com)))


# SUDO
ldap_sudo_search_base = ou=sudoers,o=Example,dc=example,dc=com
ldap_sudo_full_refresh_interval = 86400
ldap_sudo_smart_refresh_interval = 3600

[sudo]

[ssh]
# debug_level=8


[root at nslcd /etc]$ id my_test_user
id: my_test_user: No such user
[root at nslcd /etc]$ echo $?
1

[root at nslcd /etc]$ egrep filter /etc/nslcd.conf
filter passwd
(&(objectClass=posixAccount)(uidNumber=*)(|(description=CN=prod,OU=groups,O=Example,DC=example,DC=com)(description=CN=sec,OU=groups,O=Example,DC=example,DC=com)))


[root at sssd /etc]$ id my_test_user
uid=*******13(my_test_user) gid=**** groups=*****(prod)
[root at sssd /etc]$ echo $?
0

-- 
Best regards,
George Vasiliu
Security Admin
Hostopia, a Deluxe Company
E-Mail: gvasiliu at hostopia.com
Tel: 416-883-6785, Cell: 647-924-7257
Key ID: 0x2D0D7895
Key Server: keys.gnupg.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20140513/d535c316/attachment-0001.html>


More information about the sssd-users mailing list