sssd-devel August 2012

sssd-devel@lists.fedorahosted.org

22 participants
98 discussions

[PATCH] SSH: Parse OpenSSH formatted public keys
by Jan Cholasta 03 Sep '12

03 Sep '12

Hi, this patch allows use of OpenSSH formatted public keys in LDAP. This is needed to fix <https://fedorahosted.org/freeipa/ticket/2932>. Note that this is just a quick fix, only the public key portion of an OpenSSH formatted public key is used, options and comments are ignored. A full fix will need more extensive changes in the code. Honza -- Jan Cholasta

2 7

[PATCH] Adding -std=gnu99 flag.
by Michal Židek 03 Sep '12

03 Sep '12

GCC defaults to gnu89 if no explicit standard was set by -std flag. I think there is no reason to stick to this old standard. It was discussed earlier off-list and if nobody has anything against it, please apply this patch to use gnu99 instead of 89 (for gcc). The patch is attached. Thanks Michal

3 7

[PATCH] Check if the SELinux login directory exists
by Jakub Hrozek 03 Sep '12

03 Sep '12

This unbreaks user logins on RHEL5 when the SELinux feature is on. https://fedorahosted.org/sssd/ticket/1492

2 2

SSSD developer package for 3rd party application integration with IPA
by Michael Mercier 30 Aug '12

30 Aug '12

Hello, I was wondering if there are any plans to create a sssd-devel package that would expose some of the functionality for third party applications? I am specifically interested in accessing the HBAC rules processing functions with the ability to be able to pass arbitrary username/hostnames. Thanks, Mike

2 1

[PATCH] RPM: Always include the patch file
by Jakub Hrozek 29 Aug '12

29 Aug '12

I broke our nightly builds earlier today. The reason was that including the Patch file was conditional as well, but that doesn't work because our SRPMs are built on RHEL6 but rebuilt into binary RPMs in mock. The attached patch always includes the patch file. I've tested it by running make srpm on RHEL6 and rebuilding the SRPM on Fedora 17.

2 2

daemon using sss (PAM) for auth / account
by Michael Mercier 29 Aug '12

29 Aug '12

Hello, I am in the process of doing a proof-of-concept to use FreeIPA as a backend for the tac_plus (tacacs+) daemon. PAM authentication was already built in to the application and works with FreeIPA. I have added some code to tac_plus to also use the account section of the pam file and I have a question regarding (maybe this is PAM specific?) how pam_sss works with HBAC. I have done the following in FreeIPA: 1. Created a DNS entry for my device: pix.beta.local <-> 192.168.0.1 2. Disabled the 'allow_all' HBAC rule 3. Created an HBAC rule tacacs with the following: a) who: user group: ciscoadmin - user mike is part of ciscoadmin b) Accessing: hosts: pix.beta.local c) via service: tac_plus d) from: any host I can successfully login (auth) to a Cisco ASA via the tac_plus daemon using PAM, but accounting is giving permission denied. Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:auth): authentication success; logname=root uid=0 euid=0 tty= ruser= rhost=192.168.0.1 user=mike Aug 28 16:13:34 ipaserver tac_plus[2217]: pam_sss(tac_plus:account): Access denied for user mike: 6 (Permission denied) NOTE: I have hardcoded the rhost setting with pam_set_item(pam_handle, PAM_RHOST, "192.168.0.1") I see the following in my audit.log type=USER_AUTH msg=audit(1346184814.834:168): user pid=2217 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 msg='op=PAM:authentication acct="mike" exe="/home/tacacs/ tacacs+-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1 addr=192.168.0.1 terminal=pts/0 res=success' type=USER_ACCT msg=audit(1346184814.845:169): user pid=2217 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 msg='op=PAM:accounting acct="mike" exe="/home/tacacs/tacacs +-F4.0.4.26/.libs/lt-tac_plus" hostname=192.168.0.1 addr=192.168.0.1 terminal=pts/0 res=failed' It seems that the machine the daemon is running on (ipaserver.beta.local) is being used for the HBAC rule (at least that is what is looks like from the dirsrv access log) [28/Aug/2012:16:13:33 -0400] conn=29 op=45 SRCH base="cn=hbac,dc=beta,dc=local" scope=2 filter="(&(objectClass=ipaHBACRule)(ipaEnabledFlag=TRUE)(| (hostCategory=all) (memberHost = fqdn =ipaserver.beta.local,cn=computers,cn=accounts,dc=beta,dc=local)))" attrs="objectClass cn ipaUniqueID ipaEnabledFlag accessRuleType memberUser userCategory memberService serviceCategory sourceHost sourceHostCategory externalHost memberHost hostCategory" If I add the host (ipaserver.beta.local) the daemon is running on to the 'Accessing' list or enable the 'allow_all' rule, I am able to login. NOTE: ipaserver.beta.local is also the IPA server (running all ipa services) My questions: How is 'hostname' & 'addr' in the audit.log being generated? Is PAM sending these messages to the log (or is this something auditd specific)? Does one or both of them come via the rhost variable from pam_set_item? Is it possible to pass 'hostname' or 'addr' as the variable for checking the HBAC rule? Thanks, Mike

2 1

[PATCH] RPM: Switch the default ccache location
by Jakub Hrozek 28 Aug '12

28 Aug '12

The change of the ccache itself is a one-liner. The patch also adds an RPM patch that changes the default ccache location in the man pages we generate in the RPM. I think the upstream default should still stay set to FILE: for the sake of RHEL and other distributions. If maintaining the patch proves difficult, we can always revive https://fedorahosted.org/sssd/ticket/1378

2 5

[PATCH] Fix fallback in validate_tgt()
by Sumit Bose 26 Aug '12

26 Aug '12

Hi, this patch should fix the trusted domain use case by fixing an error which prevented the intended behaviour in validate_tgt(). Details about TGT validation should be also explained in the man page, but since there is already the string freeze for 1.9 I opened https://fedorahosted.org/sssd/ticket/1499 to track this. The second patch just replace the remaining old debug levels with the new ones. bye, Sumit

2 2

[PATCH] SSH: Parse OpenSSH formatted public keys
by Jan Cholasta 23 Aug '12

23 Aug '12

1 0

[PATCH] Typo in debug message (SSSd -> SSSD).
by Michal Židek 23 Aug '12

23 Aug '12

One line (or better, one character) change in debug message. https://fedorahosted.org/sssd/ticket/1434 Patch is attached. Thanks Michal

3 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2012