[SSSD-users] root login with domain passwd

Stephen Gallagher sgallagh at redhat.com
Thu Sep 25 15:29:45 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/25/2014 10:01 AM, John Hodrien wrote:
> On Thu, 25 Sep 2014, Joakim Tjernlund wrote:
> 
>>> is, which is why ssh provides the option:
>>> 
>>> AllowRoot without-password
>> 
>> Why would I want to enable that?
> 
> Because it's more secure than the default of allowing root logins
> with password remotely.  But forget it, it's not entirely ontopic,
> as I'd partially misread what you'd said.
> 
>> That is a choice I got in PAM, sssd offers no choice.
>> 
>> Still, I don't see how the above somehow documents sssd's "no
>> root login whatsoever" policy. The docs actually hints the 
>> opposite: filter_users, filter_groups (string) Exclude certain
>> users from being fetched from the sss NSS database. This is
>> particularly useful for system accounts. This option can also be
>> set per-domain or include fully-qualified names to filter only
>> users from the particular domain. Default: root
>> 
>> This make me think I only have to add an empty filter_users to
>> allow root
> 
> Sure, the documentation encouragages you to think you could disable
> it, and if that's not the case, it's a flaw in the documentation.
> 
> Maybe you've got a point that sssd should allow this unusual
> setup.
> 


SSSD is designed to protect you from yourself. First of all, let's be
clear: SSSD is a daemon and despite our best efforts, a daemon can
fail. If you cannot log in as root using only the /etc/passwd and
/etc/shadow files, it is *impossible* to restart SSSD or get your
system back.

Without root in /etc/passwd and /etc/shadow, you also cannot start
your system in single-user mode to deal with critical system failures,
because SSSD would not have been started.

Because of those two *absolutely critical* situations, we expressly
designed SSSD to ignore requests for UID 0. This fundamental decision
is too ingrained to change at this point because it would require a
major rewrite of nearly the entire code.

I have no regrets about this and no: we should not allow this unusual
setup. The only thing that can possibly come out of this is tragedy.

If you want a remote "root" password, the much saner approach would be
to create a central sudo rule allowing a user (or group of users)
privilege to execute 'sudo su -' on all machines. Then you can simply
log in as that user and trivially *become* root, without leaving all
of your machines in a state that will inevitably lead to breakage.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlQkNOkACgkQeiVVYja6o6On7wCgocIoO+k+d1fHEXsCKc0YBifr
b4EAoJOMmsVrt4nhco7Tzk5aGUCIoOCR
=STGj
-----END PGP SIGNATURE-----


More information about the sssd-users mailing list