sssd-devel August 2011

sssd-devel@lists.fedorahosted.org

16 participants
68 discussions

Start a nNew thread

[PATCH] Fix returning groups when gidNumber attribute is not ordered
by Jakub Hrozek 04 Aug '11

04 Aug '11

https://fedorahosted.org/sssd/ticket/951

2 3

[PATCH] pyhbac: Do not convert int to bool
by Jakub Hrozek 04 Aug '11

04 Aug '11

The conversion blew up on Big Endian machines. The setter (which is the correct way to go) was added as a review suggestion and I didn't realize it wasn't used in __init__.

2 1

[PATCH] Memberof plugin rewritten
by Jan Zelený 04 Aug '11

04 Aug '11

Hi, after several weeks of work and couple failed concepts, I'm sending rewritten memberof plugin with reference counter support. For now I'm just interested in concept ack, since the plugin has still some heisenbugs and isn't stable at all. The recompute task also isn't ready, I don't want to do it before I have the concept acked and the rest of plugin stable. Many thanks in advance for any kind of review Jan

2 4

[PATCH] Fix two man page typos
by Jakub Hrozek 03 Aug '11

03 Aug '11

This patch was contributed in https://bugzilla.redhat.com/show_bug.cgi?id=727777 in diff format. I converted it into git-formatted patch retaining the attribution to Yuri.

2 2

Announcing SSSD 1.6.0
by Stephen Gallagher 02 Aug '11

02 Aug '11

The SSSD team is proud to announce the version 1.6.0 release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Add host access control support for LDAP (similar to pam_host_attr) * Finer-grained control on principals used with Kerberos (such as for FAST or validation) * Added a new tool {{{sss_cache}}} to allow selective expiring of cached entries * Added support for LDAP DEREF and ASQ controls * This will result in a marked speedup when dealing with initgroups requests of users in many groups * Added access control features for Novell Directory Server * FreeIPA dynamic DNS update now checks first to see if an update is needed * Previously we would always issue an update upon any 'going online' event * Complete rewrite of the HBAC library * New libraries: libipa_hbac and libipa_hbac-python == Detailed Changelog == Gowrishankar Rajaiyan (2): * removing password option functionality * updating sss_obfuscate man page accordingly Jakub Hrozek (92): * Use realm for basedn instead of IPA domain * Reset server status after timeout * Prevent segfault in failover code * Always expire host name resolution * Run callbacks if server IP changes * Mention Samba libraries URLs in BUILD.txt * Fix LDAP search filter for nested initgroups * Add originalDN to fake groups * Use fake groups during IPA schema initgroups * Return from functions in LDAP provider after marking request as failed * Fix typo in sdap_nested_group_process_step * Mark transaction as done when cancelled * Only save members for successfully saved groups * Do not attempt to resolve nameless servers * Don't pass NULL to printf for TLS errors * Fix unchecked return values of pam_add_response * Remove detection of duplicates from SRV result processing * Use safe alignment macros for in-tree SRV record parsing * The systemd unit file should not require DBus * Provide a configuration option to use systemd unit file * Only check systemd unit dir if systemd is selected * Set same status for duplicate servers * Add user and group search LDAP filter options * Case insensitive originalDN test * Require openssl-devel is libcrypto backend is selected * Warn that some crypto features are implemented in NSS only * Disable libcrypto code * Do not leak LDAP paging controls * Fix order of arguments in select_principal_from_keytab() call * Do not leak pcre context * Do not leak LDAP URI with high log level * Do not leak netgroups hash table * Remove unused constants from data_provider.h * Use a temporary memory context in expand_ccname_template * Set c-ares to retry nameservers * Remove append_attrs_to_array * Rename label in expand_ccname_template * Add a new option to override primary GID number * Add a new option to override home directory value * Add new options to override shell value * sdap_get_generic_ext * Generic dereference data structures and utilities * Add support for Attribute Scoped Queries * OpenLDAP dereference searches * Generic dereference search * Change sysdb_add_fake_user to add OriginalDN * Use fake users during RFC2307bis nested group processing * Refactor RFC2307bis nested group processing * Use dereference when processing RFC2307bis nested groups * Fix bad comparison in sdap_has_deref_support * Fix uninitialized pointer read in sdap_x_deref_parse_entry * Fix uninitialized scalar variable in sdap_nested_group_check_cache * Separate return paths for success and failure in sdap_nested_group_check_cache * Add utility function to return IP address as string * Add a utility function to escape IPv6 address for use in URIs * Use escaped IP addresses in LDAP provider * Escape IPv6 IP addresses in the IPA provider * Make parse_args skip extra spaces * Unit test for parge_args * Add new resolv_hostent data structure and utility functions * Resolve hosts by name from files into resolv_hostent * Resolve hosts by name from DNS into resolv_hostent * Switch resolver to using resolv_hostent and honor TTL * Provide TTL structure names for c-ares < 1.7 * Test NULL server hostname in fail over tests * Log nsupdate message * ipa_dyndns: Use sockaddr_storage for storing IP addresses * Provide python bindings for the HBAC evaluator library * Move IP adress escaping from the LDAP namespace * Escape IP address in kdcinfo * Do not hardcode default resolver timeout * Split reading resolver family order into a separate function * Allow returning arbitrary address from resolv_hostent as string * Check DNS records before updating * Remove unused krb5_service structure member * Use ares_search instead of ares_query for hostname resolution * Fixes for python HBAC bindings * Fix python HBAC bindings for python <= 2.4 * Do not add a NULL host parsed from LDAP URI * Only print server address if one is available * Rename fo_get_server_name to fo_get_server_str_name * fo_get_server_name() getter for a server name * Fix indexing of skipped groups * Set gidNumber of non-posix groups to 0 even on updates * Explicitly ignore groups with gidNumber=0 * Remove dead code from python HBAC bindings * Handle allocation error in python HBAC bindings * UTF8 HBAC test * Wrong paramater to sysdb_attrs_add_uint32 * Change the default value of ldap_tls_cacert in IPA provider * HBAC rule validation Python bindings * Request password control unconditionally during bind Jan Zeleny (28): * Remove unused be_check_online() SBUS call * Remove unused sysdb_attrs object * Fix one unlikely case of failure in sdap_id_op module * Add last usn checking after reconnection * Extend and move function for finding principal in keytab * Allow new option to specify principal for FAST * Don't use negative cache in netgroup lookup * Configuration parsing updates * Added originalDN to attributes with case-insensitive search * Modify principal selection for keytab authentication * Fixed lastUSN checking improvements * Make sysdb_ctx_list public structure * Add a function for searching netgroups with custom filter * Cache cleaning tool * Some minor fixes and changes in sysdb_ops * Man page for sss_cache * Added some kerberos functions for building on RHEL5 * Fixed --debug-to-files for nss and pam services * Fixed wrong variable in sdap_initgr_nested_store * Possible memory leak fixed * Fixed unitialized return value in match_principal * Fixed unitialized pointer in select_principal_from_keytab * Fixed uninitialized value in sss_cache * Fixed copying of pam_data structure * Added sysdb_attrs_get_bool() function * Non-posix group processing - sysdb changes * Non-posix group processing - ldap provider and nss responder * Fall back to polling when inotify fails John Hodrien (1): * Add vetoed_shells option Kaushik Banerjee (1): * Changing default to Default for consistency Matthew Ife (1): * Replace system() function with fork and execl call. Pierre Ossman (1): * Add host access control support Simo Sorce (8): * Check that the socket is really ours before attempting to close it. * Use neutral name for functions used by both pam and nss * sysdb: use header defined macros instead of explicit values * memberof: fix calculation of replaced members * memberof: free delete operation apyload once done * clients: use poll instead of select * fix typos * sss_client: avoid leaking file descriptors Stephen Gallagher (96): * Update version to 1.5.2dev * Sanitize search filters for nested group lookups * Bumping version to 1.6.0dev * Wrap cleanup task in a sysdb transaction * Add additional indexing for sysdb * Make the domain argument mandatory in sss_obfuscate * Gracefully handle permission errors in sss_obfuscate * Make SSSDConfig API configuration readable * Only print "no matching service rule" when appropriate * Clear up -Wunused-but-set-variable warnings * Fix cleanup transaction * Fix module registration with newer LDB libraries. * Verify LDAP file descriptor validity * Minor specfile changes * Detect the proper location for memberof.so * Fix specfile for RHEL5 * Do not attempt to use START_TLS on SSL connections * Point the IPA provider at the compat tree for netgroups * Remove cached user entry if initgroups returns ENOENT * Perform initgroups lookups for all domains * IPA provider: remove deleted groups during initgroups() * Allow krb5_realm to override ipa_domain * Add krb5_realm to the basic IPA options * Fix uninitialized value error in ipa_get_id_options() * Add transifex_client configuration * Add new translations from Transifex * Update translation sources * Require existence of GID number and name in group searches * Require existence of username, uid and gid for user enumeration * Add support for krb5 access provider to SSSDConfig API * Fix incorrect return value check * Create sysdb_get_rdn() function * Add sysdb_attrs_primary_name() * Ignore aliases for users * RFC2307: Ignore aliases for groups * RFC2307bis: Ignore aliases for groups * Use sysdb_attrs_primary_name() in sdap_initgr_nested_store_group * Add sysdb_attrs_primary_name_list() routine * Don't crash if we get a multivalued name without an origDN * Don't crash on error if _name parameter unspecified * Check result of talloc_strdup() properly * sss_obfuscate: Avoid traceback on ctrl+d * sss_obfuscate: abort on ctrl+c * Always complete the transaction in sdap_process_group_members_2307 * RFC2307: Ignore zero-length member names in group lookups * Fall back to cn if gecos is not available * Never remove gecos from the sysdb cache * Do not throw a DP error when failing to delete a nonexistent entity * Add debug logging to the negative cache * Fix a regression with the negative cache in multi-domain configurations * Fix regression where nonexistent entries were never added to the negative cache * Don't leak memory if sysdb_domain_init() fails * Run all appropriate upgrades * Reopen the LDB after modifying it * Always generate kpasswdinfo file * Add value of the last USN to server configuration * simple provider: Don't treat primary GID lookup failures as fatal * Log the LDAP message type we're processing * Enable paging support for LDAP * Add ldap_page_size configuration option * Add "description" option to SSSDConfig API * Regular translation update * Fix IPA config bug with SDAP_KRB5_REALM * Fix segfault in IPA provider * Fix bad password caching when using automatic TGT renewal * Fix minor typo in error message * Override config file debug_level with command-line * Include manpage for sss_cache * Create common sss_monitor_init() * Allow changing the log level without restart * IPA Provider: don't fail if user is not a member of any groups * Build SSSD plugins without a version number * Build sssd utils as a libtool helper library * Import config.h earlier * Make "password" the default for ldap_default_authtok_type * Add more detail to ldap_uri manpage entry * Fix typo in initgroups negative cache check * Ensure that SSSD always Requires: the primary-arch sssd-client * Do not attempt to close() a file descriptor < 0 * Add helper function msgs2attrs_array * Add HBAC evaluator and tests * Add helper functions for looking up HBAC rule components * Remove old HBAC implementation * Add new HBAC lookup and evaluation routines * Add ipa_hbac_refresh option * Add ipa_hbac_treat_deny_as option * Treat NULL or empty rhost as unknown * Allow NULL memctx in sysdb_custom_subtree_dn * libipa_hbac: Support case-insensitive comparisons with UTF8 * Fix memory leak in ipa_hbac_evaluate_rules * Fix incorrect NULL check in ipa_hbac_common.c * Converge accept_fd_handler and accept_priv_fd_handler * Require matched version and release for libipa_hbac * Remove incorrect private variable * Add rule validator to libipa_hbac * Allow LDAP to decide when an expiration warning is warranted Sumit Bose (38): * Fix handling of translated man pages in spec file * Remove LDAP_DEPRECATED * Make 'make check' look nice again * Introduce sysdb_ldb_connect() * Check LDB_MODULES_PATH for sysdb * Fix for generating lists of translated man pages * Remove renewal item if it is not re-added * Check ccache file for renewable TGTs at startup * Do not try to delete sysbd memberOf attribute * Fixes for dynamic DNS update * Add missing name to struct getent_ctx for missing netgroup * Refactor set_netgroup_entry() * Change state of hash entry if netgroup cannot be parsed * Release handle if not connected * Sanitize DN when searching the original DN in the cache * Read only rootDSE data if rootDSE is available * Initialise srv_opts even if rootDSE is missing * Initialise rootdse to NULL if not available * Return pam data to the renewal item if renewal fails * Add support for openldap24 package on RHEL 5.7 * Set _GNU_SOURCE globally * Remove unused defines from configure.ac * Include string.h in sss_cli.h * Sanitize username during initgroups call * Add online callback only once for TGT renewal * Delete cached ccache file if password is expired * Fix two typos * Add missing libsss_util to proxy provider * Fix proxy provider return code for secondary missing groups * Do not check pwdAttribute * Add sockaddr_storage to sdap_service * Add sdap_call_conn_cb() to call add connection callback directly * Use name based URI instead of IP address based URIs * Use ldap_init_fd() instead of ldap_initialize() if available * Do not access state after tevent_req_done() is called. * Call ldap_install_tls() on ldaps connections * Add support for experimental features * Add LDAP access control based on NDS attributes pbrezina (1): * silence compilation warnings on RHEL5

1 0

[PATCH] Request password control unconditionally during bind
by Jakub Hrozek 02 Aug '11

02 Aug '11

https://fedorahosted.org/sssd/ticket/940

3 3

Shell overrides
by John Hodrien 02 Aug '11

02 Aug '11

I've just been playing with the allowed_shells stuff. I'm using a very large LDAP tree. It contains mostly good data, but has some users shells set to /bin/sh and /bin/csh. For these users I want to override the shell to something more sane (like /bin/bash). But I don't want to actually remove those shells from systems, as I want them to be available for local accounts and scripts. So on the client I have local accounts that make use of /bin/sh and /bin/csh and an /etc/shells of: /bin/sh /bin/bash /sbin/nologin /bin/tcsh /bin/csh If I don't edit /etc/shells it'll use those shells, which isn't what I want. If I remove it from /etc/shells, and set allowed_shells to an approved list, it'll switch their shell to nologin. Is there a way I can deal with this using the current setup? I couldn't see a way. I was wondering about adding a new config option to allow you to mark certain shells as being vetoed, such that the fallback shell is used instead. Is this in any way sane? Ignoring the trimmings, the meat of it is just: diff -ur sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c sssd-1.5.11/src/responder/nss/nsssrv_cmd.c --- sssd-1.5.11.orig/src/responder/nss/nsssrv_cmd.c 2011-07-05 18:41:13.000000000 +0100 +++ sssd-1.5.11/src/responder/nss/nsssrv_cmd.c 2011-07-28 15:46:10.787877792 +0100 @@ -314,7 +314,18 @@ user_shell = ldb_msg_find_attr_as_string(msg, SYSDB_SHELL, NULL); if (!user_shell) return NULL; - if (!nctx->allowed_shells) return talloc_strdup(mem_ctx, user_shell); + if (!nctx->allowed_shells && !nctx->vetoed_shells) return talloc_strdup(mem_ctx, user_shell); + + if (nctx->vetoed_shells) + { + for (i=0; nctx->vetoed_shells[i]; i++) { + if (strcmp(nctx->vetoed_shells[i], user_shell) == 0) { + DEBUG(5, ("The shell '%s' is vetoed. " + "Using fallback\n", user_shell)); + return talloc_strdup(mem_ctx, nctx->shell_fallback); + } + } + } By all means tell me I'm mad and there are much better ways of achieving what I'm trying to do. I'm new to sssd, but it looks like it offers a whole raft of advantages over nss_ldap (which I'm currently using) that makes it look irresistable. Thanks, jh

3 11

[PATCHES] HBAC access control rewrite
by Stephen Gallagher 01 Aug '11

01 Aug '11

While attempting to extract the SSSD's HBAC rule evaluation into a common library, I discovered several shortcomings. Some were related to extracting the library, others were related to the rule evaluation itself. Related to extracting the library, I needed for the code to be able to identify and resolve without having direct access to LDAP or the LDB. This meant I could not rely on the memberOf objects to be valid. As for the rule evaluation, I discovered that we were only caching for offline use those remote hosts that had previously attempted to log in. This meant that if the IPA server was unreachable, valid users would be unable to log in from some valid machines. After careful consideration (and a few false starts), I decided that a total rewrite was necessary. So here it is. The major changes are these: 1) We have moved to always performing a full enumeration of known IPA hosts and HBAC services. This actually results in a net reduction in round-trips to the LDAP server, which was a primary bottleneck. Additionally, this means that we also have a full understanding when offline as to whether a remote host is permitted access or not. 2) I've added a configurable timeout for hbac rule refreshes to the LDAP server. Previously, if we were online, EVERY pam_account() request would result in at least one LDAP round-trip. By default, we'll only refresh the HBAC rules every five seconds now. 3) I broke the acquisition and processing of the rules, hosts and services into separate C files, as ipa_access.c was getting to be much to large to manage. The overall view of the code (when online) is this: A request comes in, we call to LDAP to get, in order, the set of known hosts, the set of known PAM services and then finally the set of *enabled* rules with the current ipa_hostname as the targethost. And now, the patches: Patch 0001: The new standalone evaluator library. It's very simple at the moment (but it will become much more complex in the near future when timerule evaluation is added). Jakub, Rob and I agreed on the interface and Jakub is creating Python bindings for it. Patch 0002: This is the meat of the new IPA access backend. All of the helper functions necessary for looking up, storing and converting the hosts, rules and services are in this patch. Patch 0003: This is not really a patch as much as it is a trash can. I split this from Patch 0004 to make the latter more reviewable. Patch 0003 contains only the deletions of the old access provider implementation. Patch 0004: Adds the new IPA access provider, taking advantage of the helper functions from Patch 0002. Patch 0005: Adds a refresh timeout to reduce round-trips to IPA while online.

4 20

[PATCH] Provide python bindings for the HBAC evaluator library
by Jakub Hrozek 01 Aug '11

01 Aug '11

Hi, the attached patch provides a new python module "pyhbac" that implements python bindings for the HBAC evaluator library. The patch depends on Stephen's last patches which are on review as of now, but the test suite passed, so I think the bindings can be reviewed in parallel. "make check" loads the built python module from tree by doing some sys.path magic. If you'd like to experiment with the module yourself, you must either install it or set PYTHONPATH to $SSSD_BUILD_DIR/.libs

2 7

[PATCH] Coverity issues in python HBAC bindings
by Jakub Hrozek 01 Aug '11

01 Aug '11

[PATCH 1/2] Remove dead code from python HBAC bindings As Coverity noticed, we check for s != NULL in both if and else branches. [PATCH 2/2] Handle allocation error in python HBAC bindings This is kinda embarrassing, but the body of a NULL check was completely missing.

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2011